Skip to main content

Recovering from Ransomware Acronis 11.5

Thread needs solution

Greetings,

A client of mine had their server attacked and encrypted with ransomware. During the process the USB attached external hard drive had the files "deleted" by the infection.

I've used a data recovery tool to recover the latest backup on the external drive. Because the target backup drive was formatted in Fat32 I have 21 4gb files that comprise the backup.

Are these 21 .tib files all I need to mount and browse the contents of the backup or do I need some other supporting files such as catalog or database files that were on the target drive as well?

Also, can I boot the server from the recovery media and do a bare metal restore to the drives or do I have to install Windows first?

Thank you.

0 Users found this helpful
frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 0
Comments: 2016

Hello Jerry,

welcome to Acronis forums!

Are these 21 .tib files all I need to mount and browse the contents of the backup or do I need some other supporting files such as catalog or database files that were on the target drive as well?

Please store these files in the same folder so you will be able to mount this backup and browse the data in it.

Also, can I boot the server from the recovery media and do a bare metal restore to the drives or do I have to install Windows first?

Please follow this detailed recovery guide: https://kb.acronis.com/content/35681

You can download an ISO version of Acronis bootable media (the latest build) which could be burned on CD/DVD for recovery purposes: https://kb.acronis.com/content/4828

or create one in software UI (please make sure you use the latest available build of Acronis Backup in your account).