February 19, 20242 yr Back in October I got hit with a Ransomware attack as I had my shares open the internet temporarily. I now know how dumb that was and am taking steps to improve my security. At the time I noticed files with messages saying my data had been encrypted so I spot checked some of my files and verified my system was running ok. It seemed that my permission settings had prevented the attackers from doing anything other than creating these message files. Or so I thought. Due to stupidity my VM data was accessible via SMB and had full read/write permissions (I don't know why tf I had it setup that way) and the attackers encrypted the virtual disk of my one VM. I didn't find this out until I rebooted my system for the first time in 4 months the other day and noticed the VM wasn't working. Somehow the VM ran for months without issues despite the disk being encrypted. Is it possible the unencrypted data is sitting around somewhere? If the VM kept working all that time it must have been storing data somewhere and if it is it would be great to recover it. If not, it's not the end of the world, I have backups but unfortunately it took so long to notice I have to go back 4 months.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.