Help I think I was hacked need help restoring files.


Recommended Posts

Some of my shared windows folders on unraid were deleted and the majority of my server is now free space. What commands or utilities can I run to retrieve my data? I changed my root password on unraid what else can i do to prevent this. Im missing TB's of data what can i do if anything to recover it?

Link to comment
8 minutes ago, ashman70 said:

First of all do you have your server exposed to the internet? Secondly, what makes you think you were hacked? Did you have a strong root password? Is there nothing in the logs to indicate what happened?

 

How would I ensure it isn't exposed to the internet?

Link to comment

Google for "Shields up" which will scan your Internet connection for open ports.  Read the material that is presented about what the results are telling you.  Gibson Research has been around since the days when I was using a dial-up modem. 

 

Then scan your Windows computer(s) for any viruses or malware.  Here is link to an good article on some excellent tools that Microsoft has developed to help ferret out nasty software:

 

    http://www.infoworld.com/article/2883958/antimalware/how-to-detect-malware-infection-in-9-easy-steps.html

Link to comment

One more point.  If you have a wireless router, does it have a secure password (preferably one that is twelve or more characters in length containing letters--Caps and Small--, numbers and symbols and contains no recognizable words that are in any dictionary of any major language)?   I have a friend who has told me that breaking into a wireless router is usually one of the easiest cracks to accomplish!  So make the job as difficult as possible by making your router password extremely difficult to break by brute force.

 

Remember unless you have secured your shares with permission and passwords to restrict who has write-access to your server, anyone on your network could have deleted that share in a few seconds! 

Edited by Frank1940
Link to comment

It would not be difficult to delete the user share folder and this is exactly what would happen.

 

I do think, if there have been no updates to the disks, it may be possible to undelete some of the files. I am not sure how well undelete works with XFS (assuming that is your FS).

 

Does not sound like a hack to me.

Link to comment
9 hours ago, WinHac said:

Not sure what error would delete a directory off all 10 HD's in the Array.

 

I think what happened, as bjp999 also surmised, is that you somehow deleted a share -- which will delete all of the folders associated with that share.   This easily explains what happened.

 

1 hour ago, WinHac said:

Looks like it will recover easily got one drive back so far with names and directory structure intact.

 

Sounds like the file system check was able to recover the deleted files okay on one disk -- this is good news.   You simply need to methodically repeat this for all of the other disks --- and when done your share will be intact ... hopefully with no (or at least minimal) lost data.    It would be best to NOT use the array during this process -- at least not for anything that will write to the disks, as any writes will reduce the likelihood of successful recovery.

 

I assume from your comments that you don't have backups of your data ... if so, this clearly would have been much easier (just copy the data from the backups).   Might be a good time to consider a backup strategy :D

Link to comment

Ya right now im puting one drive from the array at a time on my pc running the recovery to a USB drive putting the original disk back in the array and moving the recovered data over to it. Then starting the process again. That would be the best way to do it right?  I'd love to have a backup but its cost prohibitive to backup 30TB for me so I have to settle for backing up only the most important.

Edited by WinHac
Link to comment
9 minutes ago, WinHac said:

Can I just re add  the missing shared folder to all the drives again and put the files back in each one then create the share again in unraid or will that delete the contents?

Does the share not exist anymore? The share is the top level folder, so if you have the folder on any drive you should still have the share. If not, I would suggest creating the share first and getting it set like you want then add the folder to each disk as needed.

Link to comment

The share was gone from the config. I created it just on the disk im restoring and excluded all other disks and spun them down now copying files to the resotred disk share and will include more disks to the share for each disk restore. Sound like the right way to go?

Link to comment
Just now, WinHac said:

The share was gone from the config. I created it just on the disk im restoring and excluded all other disks and spun them down now copying files to the resotred disk share and will include more disks to the share for each disk restore. Sound like the right way to go?

Are you copying to the disks or to the share?

 

If to the disks, then it doesn't matter about the share settings. If to the share, then the share settings will determine where each file ends up, but including more drives as you go won't necessarily make the files go to the newly included disks. You would have to only include a specific disk if you wanted to insure it would only go to that disk.

 

I would just set the share like you want it to work in the end.

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.