DriveSavers Data Recovery

When an Akira ransomware attack left an organization’s production virtual machines encrypted and its backups encrypted or deleted, the incident response team turned to DriveSavers for specialized data recovery.

The challenge extended beyond the attack: roughly 15TB of new data was written to the same volume the following day. DriveSavers engineers rebuilt the filesystem map to access deleted backup data, then combined that data with data salvaged from the affected production disks. Recovery reached 99.91% of the priority database server’s virtual disk data.

See how DriveSavers supported the incident response team when standard restoration options were exhausted.
https://drivesaversdatarecovery.com/case-studies/vmdk-data-recovery-after-an-akira-ransomware-attack/

VMDK Data Recovery After an Akira Ransomware Attack DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.

Star Trek turns 60 this month. Ten years ago, DriveSavers finished reading about 200 floppy disks belonging to Gene Roddenberry.

Both computers that wrote them were gone: One had been sold at a charity auction, and the other wouldn't power on. The disks were mostly CP/M, formatted by software with no documentation, so our engineers spent three months figuring out how they were written before they could open a single file. Reading all 200 took about a year. Mike Cobb and Jim Wilhelmsen, pictured with Roddenberry's computer and many of the floppies, led the project.

Rod Roddenberry later sent a signed photograph of his father: "To DriveSavers, thank you for recovering my father's voice from digital oblivion!"

Read more about the Roddenberry data recovery in the PCWorld article from 2016, republished on the DriveSavers website: https://drivesaversdatarecovery.com/press-coverage/pcworld-how-star-trek-creator-gene-roddenberrys-words-were-freed-from-old-floppy-disks/

A stolen safe held a Trezor hardware wallet and the only paper copy of its 20-word recovery phrase. Anyone holding the full phrase can move the funds.

The client had 10 of the 20 words and had to rebuild the rest before the thieves used the copy they took.

An outside video forensics team reviewed office security footage of the phrase being written and found the resolution too low to read the words.

DriveSavers engineers reviewed it again and narrowed each missing word from 1,024 SLIP-0039 candidates to about 200.

Find out how they did it: https://drivesaversdatarecovery.com/case-studies/stolen-cryptocurrency-recovery-how-drivesavers-rebuilt-a-trezor-seed-phrase-from-10-missing-words/

Thieves stole a safe holding a Trezor hardware wallet and its 20-word recovery seed phrase on paper. With the full phrase, they could move the funds whenever they wanted.

The client had the first 10 words and had to reconstruct the other 10 and move the funds first.

Brute-forcing 10 words from the SLIP-0039 list runs about 803 trillion years on standard hardware. Weeks of forensic analysis narrowed the search.

DriveSavers data recovery engineers recovered the cryptocurrency assets before the thieves could access the wallet.

Read the case study to find out how: Read "Stolen Cryptocurrency Recovery: How DriveSavers Rebuilt a Trezor Seed Phrase from 10 Missing Words"

https://drivesaversdatarecovery.com/case-studies/stolen-cryptocurrency-recovery-how-drivesavers-rebuilt-a-trezor-seed-phrase-from-10-missing-words/

Stolen Cryptocurrency Recovery: How DriveSavers Rebuilt a Trezor Seed Phrase from 10 Missing Words DriveSavers crypto recovery services combined forensic video analysis with proprietary recovery software to solve a brute-force problem initially estimated to be computationally infeasible

Your immutable backup is probably reachable from the network right now. That is not a misconfiguration. That is what immutability is.

Immutability stops a backup from being altered. An air gap stops it from being reached. Your organization may have purchased one, believing that it includes both.

Immutability holds the data for a set retention period. But the setting that enforces it lives in the backup software; the software has a console, and the console has credentials. With those credentials, an attacker does not have to defeat the immutability setting. On some platforms, they can change it or switch it off from the console, the same way an administrator would.

A disconnected copy removes that path. While it is off the network, credentials can't reach it. The cost is speed, because someone has to reconnect it before you can restore.

So the question is not whether your backups are immutable. It is whether any copy sits outside the reach of your primary backup system.

Read more at the link in the comments.

In ransomware data recovery cases that DriveSavers has handled, backups were marketed as immutable but were deleted anyway.

Learn why write-once protection may not stop ransomware, what to ask your backup vendor, and what DriveSavers can still recover even after the backups are gone.

https://drivesaversdatarecovery.com/blog/why-immutable-backups-can-still-be-compromised/

Why Immutable Backups Can Still Be Compromised Why immutable backups can still be compromised, when a decryptor won't save you, and where ransomware data recovery fits.

How do you modernize decades of enterprise data—and where do you start?

Tape inventory is just one step. True modernization begins with data triage: discover what you have, determine what still matters, and prioritize what needs to remain accessible.

The compatibility window has narrowed across tape generations, shifting from broad backward access in earlier LTO systems to much tighter read support in modern drives.

The tapes may be intact. The question is: can you still access—and interpret—the data on them?

Read "The Asset Isn’t the Tape:
Protecting Historical Enterprise Knowledge" at the link in the first comment.

Andy Maus, Head of Cyber Recovery at DriveSavers, told the Financial Times that rather than prohibiting payment for an attack that has already happened, subsidized backup infrastructure or tax incentives for cybersecurity spending would do more to reduce the underlying exposure.

Organizations can't set tax policy, but they can document what an incident response would need before one happens. 5 things worth storing outside your primary systems.

Full article in the first comment.

The UK is advancing plans to ban ransomware payments for public sector organizations and critical national infrastructure providers. The asked DriveSavers whether that's the right call.

Andy Maus, Head of Cyber Recovery Services at DriveSavers, said it depends on whether restoring operations is technically possible. A ban makes sense when there's a viable alternative to paying the ransom. When a water utility doesn't have one, for example, the systems stay offline, and customers go without service.

This article goes into greater depth on DriveSavers Data Recovery's viewpoint, as developed from our direct experience working with customers who have been victims of attacks: https://drivesaversdatarecovery.com/press-coverage/to-pay-or-not-to-pay-drivesavers-weighs-in-after-being-quoted-in-the-financial-times/

Financial Times Asks DriveSavers to Weigh In on Ransomware Payment Bans Quoted in the Financial Times, DriveSavers explains why blanket ransomware payment bans can backfire, and what years of ransomware data recovery casework show.