SQL Server Database Bitcoin Encryption Ransomware Recovery

E-mail：chf.dba@gmail.com

Title: SQL Server Database Bitcoin Encryption Ransomware Recovery

Author: DATABASE SOS©All rights reserved [without my consent, it may not be reproduced in any form, otherwise there is the right to further legal responsibility.]

For the Oracle database encrypted by GANDCRAB virus, we can provide a more perfect recovery. “GANDCRAB V5.0.4 Bitcoin encryption oracle database recovery”> GANDCRAB V5.0.4 Bitcoin encryption oracle database recovery and GANDCRAB Upgraded Oracle Recovery , we have done some research on the SQL Server database encrypted by GANDCRAB recently, and now it can be better recovered.
gandcrab5.2-sql-server

1

And if the cost of finding a hacker to decrypt is $ 10w, the customer cannot accept the cost.The main thing in the system is that the sql server database is encrypted. The customer has a backup of several months ago, but the data is severely lost and cannot bear the relevant losses. Recovery support. After a series of recovery, we can achieve a more perfect recovery of the database
gandcrab5.2-sql-server1

gandcrab5.2-sql-server2

If your sql server database is unfortunately encrypted by Bitcoin, you can contact us at any time to provide database level recovery support
E-Mail:chf.dba@gmail.com

GANDCRAB V5.0.4 Bitcoin encryption oracle database recovery

E-mail：chf.dba@gmail.com

Title: GANDCRAB V5.0.4 Bitcoin encryption oracle database recovery

Author: DATABASE SOS©All rights reserved [without my consent, it may not be reproduced in any form, otherwise there is the right to further legal responsibility.]

After receiving a friend’s recovery request, the win server file was encrypted by the bitcoin ransomware oracle database of GANDCRAB V5.0.4 (Zhonglian his [large Chinese table name / xml type]), let us analyze it and determine whether it can be restored
3
4

Through the analysis of the tool, it is found that the file header and data file space need to be reconstructed using bitmap-related blocks. The main business data should theoretically be good. By analyzing the basic database information such as database tablespaces and data files, Manually rebuild, rebuild the control file, and after a series of recovery, the database forced to open successfully

SQL> select open_mode from v $ database;

OPEN_MODE
--------------------
READ WRITE

SQL> select name from v $ datafile;

NAME
-------------------------------------------------- ------------------------------
E:\ORCLNEW1\SYSTEM01.DBF.HKNWFZ
E:\ORCLNEW1\SYSAUX01.DBF.HKNWFZ
E:\ORCLNEW1\UNDOTBS01.DBF.HKNWFZ
E:\ORCLNEW1\USERS01.DBF.HKNWFZ
E:\ORCLNEW1\BHDATA.DBF.HKNWFZ
E:\ORCLNEW1\BHMAIL.DBF.HKNWFZ
E:\ORCLNEW1\BHINDEX.DBF.HKNWFZ
E:\ORCLNEW1\ZHBASIS.DBF.HKNWFZ
E:\ORCLNEW1\ZHARCHIVES.DBF.HKNWFZ
E:\ORCLNEW1\ZHSERVICES.DBF.HKNWFZ
E:\ORCLNEW1\ZHADVICES.DBF.HKNWFZ
E:\ORCLNEW1\ZHEXPENSES.DBF.HKNWFZ
E:\ORCLNEW1\ZHMEDICINE.DBF.HKNWFZ
E:\ORCLNEW1\ZHLAB.DBF.HKNWFZ
E:\ORCLNEW1\ZHCHECK.DBF.HKNWFZ
E:\ORCLNEW1\ZHLOB.DBF.HKNWFZ
E:\ORCLNEW1\ZHINDEX.DBF.HKNWFZ
E:\ORCLNEW1\SLREPORT.DBF.HKNWFZ
E:\ORCLNEW1\ZHMATERIAL.DBF.HKNWFZ
E:\ORCLNEW1\ZHMEDREC.DBF.HKNWFZ
E:\ORCLNEW1\ZHINSURE.DBF.HKNWFZ

Because the customer’s database has a large number of xml column types, exp cannot be exported, and only expdp can be used for export. Because expdp creates intermediate tables during the export process, some repairs are made to the database to ensure that the database can write normally. Object and database export succeeded
2