A Story of Data Loss and What Could Have Been

Why I harp, harass, cajole, and harp some more.

Some years ago I posted this on Facebook:

I want to share what happened and explain how this could have been close to a non-event.

A story of data loss

After repairing a friend’s hard disk failure, I discovered files on it were encrypted by CryptoWall ransomware. Despite recovering the drive contents, decryption was impossible, and there were no backups. Regular backups are critical to avoid data loss and heartache.

Hard drive failure

I got a call from a friend standing at a local office supply store’s computer service desk. He was a tad befuddled at the terms and dollar amounts the technician was throwing at him.

• The hard drive had had some kind of physical failure — probably a bad sector or area.
• The technicians had installed a replacement hard drive into my friend’s computer.
• The technicians were unable to back up the faulty drive with their normal tools.
• The faulty drive contained important information my friend wanted to recover.
• The next step for this particular computer service organization was to send it out to data recovery; costs were quoted from $200 to $1600.

My friend’s question was simple: did he need this, or was he being taken for a ride? He put the technician on the phone.

The bottom line was that, no, he probably wasn’t being taken for a ride, and that yes, the situation was serious. They’d just gone beyond what the in-store technician could do; hence the need to send it out.

He brought the machine to me instead.

Hard-drive recovery

At the time, my go-to tool of choice for bad sectors on a hard drive was SpinRite, so that’s where I started. I hooked the faulty drive up to one of my spare systems and let it work.

Unfortunately, SpinRite hasn’t been updated in years — which is really sad, as it’s a great tool when it works. It didn’t work for me in this case. Be it the BIOS on the machine, the SATA interface, or the sheer size of the one-terabyte drive, SpinRite would only go so far before crashing.

I Googled SpinRite alternatives, and while there weren’t any, I came up with something close: MHDD.

MHDD’s basic difference from SpinRite is that when it finds a bad sector, it “remaps” it, taking it out of use and replacing it with one of the spare sectors that hard disks have for exactly this purpose. Note, however, that it doesn’t recover the data in that bad sector. SpinRite will first work long and hard, if need be, to recover the data in that sector, often recovering and repairing it, so no remap is needed.

I let MHDD do its thing, after which I could use Macrium Reflect to take a complete image backup of the faulty drive and restore that image to the replacement drive in my friend’s machine.

All seemed well, and I sent the machine home.

Later that day, I got an email. My friend wanted to know why he couldn’t open his pictures.

Cryptowall

When he tried to open an image, my friend got an error message.

Since I’d kept a copy of the backup image “just in case”,1 I restored it to a hastily created partition on one of my own machines and started looking around.

What I found was not pretty.

The images weren’t images anymore. They had the same names and the “.jpg” extension, but their contents didn’t look like jpg image data at all. In fact, the contents looked more like random data. Almost as if the files had been… encrypted.

And then I found this:

At some point, this machine had become infected with the CryptoWall ransomware: software that encrypts all your important files and then displays a ransom note instructing you how to pay to get the decryption key to access your files again.

My friend had never seen that ransom note. That means either the encryption process hadn’t been completed when he’d last turned off the machine, or the virus had attached itself to the machine while at the service center. (Timestamps on the files showed that the malware had arrived prior to the service center touching the machine.)

Either way:

• The encryption appeared to be unrelated to the hard disk failure. (It’s possible that the encryption process caused the hard disk to stumble into a previously unused bad sector, but there was no real direct cause and effect at play here.)
• The hard disk recovery was a success, but the prognosis for this new situation was even worse.

Related

How to Avoid Ransomware

Avoid ransomware the same way you avoid any malware. A full backup will save you not only from ransomware, but from a host of other problems as well.

Recovery efforts

BleepingComputer.com has a good page on CryptoWall, including common approaches to recovery. Unfortunately, none of them worked2.

• Restore from a backup: There was no recent backup. Some files were available on a months-old backup, but that didn’t help with recently created, updated (or encrypted) files.
• File Recovery Software: The process of recovering the original drive to another drive invalidated anything that file recovery tools could use. (Though the original “failed” drive remains unaltered in my basement and may be used as a last resort at some point.)
• Shadow Volume Copies: The process of recovering the drive to the new one invalidated anything that file recovery tools might use. The original drive may have the files, but the chances are slim since CryptoWall intentionally deletes them.
• Restore DropBox Folders: Dropbox wasn’t being used.

In short, and as of this writing and update, we were SOL: severely out of luck. The files that were encrypted remain encrypted with little chance of direct recovery.

Which leads to the moral of this story.

What could have been

Bad stuff happens. It just does. You cannot avoid it all the time.

Hard disks die without notice or warning. In fact, they can die so suddenly and so completely that all data stored on them can be instantly and irretrievably lost forever. Nothing malicious is required — they just die. Most failures aren’t instantaneous or irretrievable, but they can be.

And, of course, malware happens. It shouldn’t. In a perfect world, we’d never invite it in, and if we did, our perfect anti-malware tools would protect us 100% of the time. Neither the world, our computer, our security software, nor even ourselves are perfect. Stuff happens, as it did to my friend in a double dose: ransomware and a failed hard drive.

You can’t avoid it.

But you can prepare for it.

This makes situations like my friend’s so frustrating. Here’s what could have been:

• Hard disk dies.
• Replace it.
• Restore the previous day’s image backup.
• Get on with your life.

And/or:

• Machine is infected with malware; all files on it are encrypted and a ransom is demanded.
• Restore the machine from the previous day’s backup.3
• Get on with your life.
• Learn from the experience: don’t repeat whatever caused the infection.

THIS IS WHY I harp and harp and harp on backing up.

It hurts me to see data loss — particularly important data like irreplaceable family photos, as was the case here.

Podcast audio

Download (right-click, Save-As) (Duration: 12:14 — 11.3MB)

Subscribe: RSS

Related Video