Recover NAS Disk after Deadblot

[coat]

Hi all!
As others, also my NAS has been attacked by Deadblot.
Now, when I access to it it ask me to reinitialize disks.

The first thing I would to do is to make an image of my three 3 TB disks into a 10 TB disk.
At the moment, if I connect them to a PC and read them I see that there is much space occupied but I can't see any files.
My disks are configured with RAID (I don't remember if RAID 3 or 5) and maybe this is why I can't read anything.

Do you know if I can simply create an image of each disk and store them into the new one? Or do I need to do a particular procedure to create disks images that are each "connected" to the others by RAID configuration?

Second thing: once the disks have been backed up..... is there a way to try to recover NAS without delete anything?

I hope I explained myself

Thanks for your help

[orion]

In case that you are familiar with Linux command, dd, you can actually copy whole disk images to one large disk manually. However it's not a usual way. You'll need to calculate and remember start sector location and size of each disk.

You should follow the guide (https://www.asustor.com/en-gb/knowledge ... oup_id=630) to recover your NAS. But your files are still encrypted. This way is just to remove this ransomware and recover ADM.

[coat]

Hi orlon and thank you for your reply.

In case that you are familiar with Linux command, dd, you can actually copy whole disk images to one large disk manually. However it's not a usual way. You'll need to calculate and remember start sector location and size of each disk.

I haven't many familiar with linux command dd. Can you tell me if there is a wizard to follow to clone disk? Or, is there a more practical way to do this that automate these calculation?

You should follow the guide (https://www.asustor.com/en-gb/knowledge ... oup_id=630) to recover your NAS. But your files are still encrypted. This way is just to remove this ransomware and recover ADM.

So, even if I recover my NAS I can't recover my files. Do you think it makes sense to clone the disk as we said above?

[orion]

If you are not familiar with Linux command, you should learn it first (google it). I believe you'll have hard time to study it.

No, I don't think cloning encrypted disk images is useful. Anyway, you should at least follow the guide to recover ADM. Maybe, some of files are not encrypted yet.

[coat]

If you are not familiar with Linux command, you should learn it first (google it). I believe you'll have hard time to study it.

No, I don't think cloning encrypted disk images is useful. Anyway, you should at least follow the guide to recover ADM. Maybe, some of files are not encrypted yet.

I see.
Thank you very much, Orion