autres solution de bleeping :
https://www.bleepingcomputer.com/fo...crypting-with-extension-7z-read-metxt/page-23
FIRST: NO WRITING/CHANGE/DELETE/CRTEATE FILES AFTER ENCRYPTION ATTACK
MAKE SURE THE NAS IS NOT AVAILABLE IN THE INTERNET, DELETE ALL EXPOSED HOST RULES ON YOUR ROUTER
The files are deleted after archiving and encrypting with 7z and exists in the not allocated space of your disk.
You need to have access the ssh terminal of your QNAP NAS (you can activate it over the GUI it doesn't change your data)
1. Create a samba share on your windows computer (yes it should be work on linux or macOS but I didn't tried it)
HowTo:
https://pureinfotech.com/setup-network-file-sharing-windows-10/
You should use your Windows Account with a password (if your account haven't one, create it. You can delete it after recovering)
2. Login over SSH (Putty on Widows) on your NAS. You should use ypur admin credentials to login.
3. After Login you get an screen with some option. You didn't need it ant press only 'Q'. (Confirm it with 'Y') You should get a shell.
4. Connect to your samba share:
Code:
mkdir /mnt/rescue-share
sudo mount -t cifs -o user=<USERNAMEOFREMOTECOMPUTER> //XXX.XXX.XXX.XXX/<NAMEOFYOURSHARE> /mnt/rescue-share
cd /mnt/rescue-share
5. look for your architecture (uname -a) for i386 or x86_64
Linux NAS-XXXX 4.14.24-qnap #1 SMP Tue Mar 2 06:10:10 CST 2021 x86_64 GNU/Linux
6. Download testdisk
Code:
i386: wget https://www.cgsecurity.org/testdisk-7.2-WIP.linux26.tar.bz2 -O testdisk.tar.bz2
x86_64: wget https://www.cgsecurity.org/testdisk-7.2-WIP.linux26-x86_64.tar.bz2 -O testdisk.tar.bz2
7. Untar testdisk, go to the directory and change the permissions of the executable
Code:
tar -xvf testdisk.tar.bz2
cd testdisk*
chmod +x ./photorec_static
8. Search for your volume. At me it was '/dev/mapper/cachedev1' (You can use df -h for it) and note it
Filesystem Size Used Available Use% Mounted on
none 300.0M 272.7M 27.3M 91% /
devtmpfs 938.4M 8.0K 938.4M 0% /dev
tmpfs 64.0M 3.1M 60.9M 5% /tmp
tmpfs 949.7M 156.0K 949.6M 0% /dev/shm
tmpfs 16.0M 0 16.0M 0% /share
/dev/mmcblk0p5 7.7M 46.0K 7.7M 1% /mnt/boot_config
tmpfs 16.0M 0 16.0M 0% /mnt/snapshot/export
/dev/md9 493.5M 140.1M 353.4M 28% /mnt/HDA_ROOT
cgroup_root 949.7M 0 949.7M 0% /sys/fs/cgroup
/dev/mapper/cachedev1
898.3G 573.5G 324.3G 64% /share/CACHEDEV1_DATA
/dev/md13 417.0M 387.7M 29.3M 93% /mnt/ext
tmpfs 48.0M 72.0K 47.9M 0% /share/CACHEDEV1_DATA/.samba/lock/msg.lock
tmpfs 16.0M 0 16.0M 0% /mnt/ext/opt/samba/private/msg.sock
//XXX.XXX.XXX.XXX/share
1.8T 104.7G 1.7T 6% /mnt/samba_spar_abo_share
9. open photorec_static with 'sudo ./photorec_static'
10. choose the /dev/mapper/cachedev1 disk (it should be the disk from step 8)
11. choose the ext2/3/4 partition
12. choose ext2/ext3 option
13. choose FREE option
14. chosse the directory you want on the share (if you follow exactly the steps, you only need to select once '..' and after it press c)
15. wait and the files would be recover in folders named 'recup_dir.X' on the share
16. sort the results (HAVE FUN xD)
Big thanks to the guys of received.eu and Tobias Vorwachs (https://twitter.com/tobias_vorwachs) for the help!
il me restait une sauvegarde recente sur hdd externe ainsi qu'une autre sur le pc.