SQL Server LockBit + RAID-5 degraded at a manufacturer · DSET dual-channel recovery 96%
A manufacturer's SQL Server 2019 was encrypted by LockBit while at the same time the RAID-5 array had one failed disk (DEGRADED). If a second disk crashed, the data would be completely lost. By freezing the array, DSET restored 96% of the data with hybrid recovery (tape + log replay) and no ransom was paid.
01 The Challenge
In the morning there was no ERP, an SQL "unable to open .mdf" error. The .mdf + .ldf were encrypted with a .lockbit extension while at the same time the RAID controller dashboard showed 1 disk DEGRADED + rebuild not started. A typical waste of time, like an operator's change window. The last weekly backup was 6 days earlier, the tape off-site and clean. 8 days of ERP + accounting + sales data at risk.
02 DSET's Approach
T+0 · Freeze the array
The RAID array was frozen and disk replacement was NOT done. We did not additionally subject the encrypted data to rebuild stress.
T+8h · DSET on site
The DSET data recovery + incident response team on site. A tape backup with a clean version from 6 days earlier. Transaction logs from 6 days ago to today available for SQL log replay.
T+24h · Hybrid recovery
Three channels in parallel: (a) tape restore, (b) SQL log replay, (c) DSET LockBit decrypt attempt (an LFE recovery chance).