1

So, first thing first, we had some trouble with a ransomware getting into our file server, encrypting everything. The shadow copy was on a different drive, and crypto missed that, so we have a copy from everything.

We have copied the infected server to a sandbox for further testing, and restored the server from a previous backup.

Since the guys who have configured the servers left the company in a “hurry”, and we didnt really had the time to get familiar to this system, we kinda missed the check the permissions part. That was a huge mistake.

There is a shared folder, lets call it A, with only 1 AD group permission, everything else is removed, including SYSTEM. Owner is BultIn Administrators.

The data we restored from the backup is missing files ( because of the insufficient permissions… )

We have to restore the shadow copy from the infected server, (we cleaned the executeable parts of the ransomware, so it is not running anymore, theoretically)

What we tried is:

Mounting the VSS in every way

Restoring with a local user in Administrators group

Restoring the shadow copy as Builtin Administrator and System

Copying a DC under the Sandbox and desperately trying to force the Fileserver to communicate with it ( no luck )

We are still trying to somehow mount VSS under linux

Is there any way to remove the permissions, or restore the files?

3 Spice ups
2

Have you tried ShadowExplorer?

3

I did, no luck. Copied no folders n files

4

Are you actually getting permissions errors? It’s sounding more and more like the data may just not be there.

5

Quick update:

I’ve been able to verify the files, a cached account had read rights, so the data is there. I am trying to figure if i can use this account to somehow restore the data.

6

Have you tried duping this drive (to keep the original safe) then taking full ownership of the VSS folders with an admin account?

7

Yea.

But since the cached admin and SYSTEM accounts are a no go since they were removed from the security tab, and were not members of the group that had full access, it failed when i tried to take control over it.

8

Taking ownership should override whatever the current permissions are, though. That’s kind of the point of it.