Many ransomware groups now target VMware ESXi hosts directly, because one attack encrypts every virtual machine on the host at once. The good news is that virtual disks are very large, and many of these strains only encrypt part of each file. A large share of the data is often intact underneath.
What we recover
- Encrypted VMware VMDK files and VMFS datastores
- Hyper-V VHDX files and Proxmox storage
- SQL Server, MySQL and Oracle databases from encrypted disks
- Exchange and file servers
- Domain controllers, so your users and permissions come back
How it works
- We image the datastore or server disks, on site or in our lab, so the originals are never changed
- We map which parts of each virtual disk are encrypted and which are intact
- We rebuild the file systems inside the virtual machines and extract the data, or repair the virtual disk so the machine boots
- You get your most important systems first, then the rest
Don’t delete or re-create the datastore, and don’t reinstall ESXi on the same disks. Power off the affected virtual machines and leave the host as it is.
Questions we get asked
Can you recover a database if the backups were also encrypted?
Often, yes. Large database files are commonly only partly encrypted, and we rebuild the database from the intact pages.
Start your recovery
Book online for a job number and shipping instructions, or call and talk to an engineer. We evaluate the drive and give you a fixed quote before any recovery work starts.