disParity » General Discussion

file by file restore from hashcheck failure / file corruption

(8 posts)
  • Started 1 year ago by BloodlustMAC
  • Latest reply from Roland
  1. BloodlustMAC
    Member

    I don't know if anything can be done or not ... but I am asking anyway.

    I was recently hit by the cryptolocker ransomware, file have been encrypted across multiple drives. The file are encrypted by their size the same.

    All drives have some changed files ... they show hash check errors.

    Each drive has an undelete option ... but I am guessing this is recovers by using the other drives data.

    Is there any way to restore the original files ?

    What I was thinking is that parity is done across the drives but essentially file by file.

    So would it be possible to re-create a modified file from the files on the other drives where the associated files have not changed.
    { it would possible mean this type of file by file recover would work but not if more than one associated file were corrupted - hash check failure. }

    Any thoughts on this would be gratefully received.
    This could also allow recovery on all partially failed drives.

    Thanks

    BloodlustMAC

    Posted 1 year ago #
  2. Roland
    Roland

    Damn, that's a frustrating problem.

    You are correct, a file can't be recovered if other files it also shares parity data with have also been deleted or modified. So I guess it depends on how widespread the encryption is. If it's just a few files here and there, you might be able to recover some of them.

    The "Undelete" option will only restore missing files, not modified ones. So what you could try is, try deleting (or moving to a temporary location) one of the encrypted files, then run a Scan (NOT AN UPDATE!). You should then be able to "undelete" the file. I think disParity will a attempt the undelete whether other files have been modified or not. You may get warnings, and it will do a hashcheck at the end to let you know whether the file was recovered successfully.

    I assume this goes without saying, but whatever you do, do not run an update. That will commit the encrypted versions of the files to the backup and any hope of recovery will be lost.

    Posted 1 year ago #
  3. BloodlustMAC
    Member

    Thanks for that ... much what I expected.

    Also I noticed on the parity drive some files*.bak files could you explain what these are ?
    I am guessing the files*.dat is a full list of the files making up the parity sequence.

    Is there a way to see a details log of the files being compared side-by-side ?
    Or a full hash check report of all files ?

    The GUI does really give you any sort of debugging information.

    What I was really hoping to do is see the list of files hash check failures in relation to each other so I can determine if a single file is affected and therefore I could attempt a recovery (move to another drive + undelete).

    Thoughts ?

    Thanks again

    BloodlustMAC

    Posted 1 year ago #
  4. Roland
    Roland

    The *.bak files are backups of the files*.dat files made whenever a files.dat is updated. The files*.dat files contain all the meta data and critical index information for the parity; I make a backup of them just in case something goes catastrophically wrong during an update and the .dat file gets corrupted. Without the files*.dat files the parity data is useless.

    Disparity has a log file that may have what you are looking for. It is usually in C:\Users\<username>\AppData\Local\disParity\logs. It should show the progress of a hashcheck operation as it is running.

    However if you are trying to figure out ahead of time which files may be unrecoverable due to overlap in the parity, I can't think offhand of any way to do this. I think the best way to go is just to try recovering files one at a time and see what happens.

    Posted 1 year ago #
  5. BloodlustMAC
    Member

    Just to confirm doing a full hash check the log file will contain all files processed in the order they were checked ... but obviously that important bit that is not shown is the file interleave relating to the parity.

    Why is there no undelete on all drives option, such that it prompts for a drive to move the old files to before it performs the undelete !?
    The commands undelete and restore are drive specific ... why ?

    ... and finally (hopefully)

    Is it correct to see a green tick on one disk and to have 4 hash failures ?
    I would assume that does mean for that the files referenced are corrupted/different on one of the other disks.

    The issue I have is that I do not know which of the other disks needs to have undeletes to allow the hash checks to pass on the disk with the green tick.

    Just trying to workout the point of a hash check on a single disk.

    Thanks again

    Posted 1 year ago #
  6. Roland
    Roland

    > Just to confirm doing a full hash check the log file will contain all files processed in the order they were checked

    Yes the log file will show all the files as they are being hash checked. When you do a "Hashcheck All" it runs on all drives simultaneously, so you'll see a jumble of files from all drives go by, but you can't infer anything from the order. In fact looking at the log file is not going to tell you anything useful at all. The "Hashcheck All" command will tell you at the end about all bad files it found.

    > Why is there no undelete on all drives option, such that it prompts for a drive to move the old files to before it performs the undelete !?

    You could ask the same question about 100 other features that disParity should have but doesn't. It only does what I've had time to implement so far. The purpose of the "Undelete" command is to recover an accidentally deleted file. It may turn out to help in your case as well, but fixing widespread corruption is not what it was designed for, so it will take extra effort.

    > Is it correct to see a green tick on one disk and to have 4 hash failures ?

    The green checkmark means disParity thinks the backup is up to date for that drive as of the last scan (i.e. it did not find any, deleted, or modified files.) But there are cases where a hashcheck will fail even though a scan didn't find any changes, such as when a drive is starting to go bad, or perhaps in the case of your ransomware. During a scan disParity will only check to see if a file has changed if either its length or last modified time has changed. If both of those attributes are the same as last time, it's not going to re-hash the file on every scan; if it did, every "Scan" would take hours to complete. That's what the hashcheck feature is for: when you suspect something is going wrong that a normal scan isn't picking up.

    > The issue I have is that I do not know which of the other disks needs to have undeletes to allow the hash checks to pass on the disk with the green tick.

    I think you might be misunderstanding either what hashcheck does or how undelete works. A hashcheck simply recomputes the checksum for a file and compares it against the checksum from the last time the file was processed. No other disks or files are involved. It just examines a single file to see if its contents have changed (that's what a "hash" code is for; if even a single byte changes somewhere in the file, the file's hash value will change.) The main purpose of the hashcheck feature is to check for drive corruption. It doesn't really have anything to do with the backup or the parity.

    Furthermore, if 2 corrupted or encrypted files from different drives overlap in the parity, you can't undelete one first in order to then undelete the other. Neither file will be recoverable. They are both lost and there is nothing disParity can do to help in this case.

    Here is my advice, assuming I understand correctly what is happening (some malware has encrypted some of your files, either only on a single drive, or on multiple drives, right?) The first thing you should do is run the "Hashcheck All" command. It will take a while, but at the end it will give you a report of all files on all drives that failed. Now you have a master list of all files that got encrypted.

    Now, let's say it finds 100 bad files. Pick one file, and either delete it, or move it to a temporary location. Run a "Scan" for that drive. The "Undelete..." option should now be available for that drive. Try "Undelete..." and see if it works.

    If it works, then the file doesn't overlap with any other encrypted files. You can now repeat this process for the other files. To make it fast, you can try ordering the 100 bad files by drive, and deleting/moving all the files on a single drive at once, and then recovering them all with a single "Undelete..." command.

    Posted 1 year ago #
  7. BloodlustMAC
    Member

    Just as a follow up ...

    I managed to recover all but 2 files which I have a different source for.

    So disparity saved a lot headache ... many thanks

    Posted 1 year ago #
  8. Roland
    Roland

    Wow, that's great to hear. I was wondering what became of this. Thanks for letting us know!

    Posted 1 year ago #

RSS feed for this topic

Reply

You must log in to post.