This case study documents the successful recovery of a QNAP TS-h1290FX NAS running QuTS hero after a ransomware attack encrypted the ZFS storage pool and deleted local snapshots. Our engineers recovered the client’s complete file archive by reconstructing the ZFS pool metadata independently of the compromised system.
Client & Data Information
- Client Name: Confidential
- Data Type: QNAP TS-h1290FX, QuTS hero, ZFS storage pool
- Data Capacity: 60 TB usable (RAID-Z2 pool)
- Ransomware Extension: .qlocker
Incident Summary
The client’s QNAP TS-h1290FX was compromised through an exposed remote access service, allowing the .qlocker ransomware to encrypt the majority of files across the RAID-Z2 pool and delete the NAS’s local snapshot history to prevent easy restoration. The client had no viable off-device backup for the most recent three weeks of data.
Technical Analysis
Forensic analysis of the ZFS pool revealed:
- Selective Encryption: The ransomware encrypted file contents in place but did not corrupt the underlying ZFS pool structure or dataset metadata.
- Snapshot Deletion: Local snapshots had been deleted through the QTS API, but ZFS’s copy-on-write design meant the underlying blocks referenced by those snapshots were not immediately overwritten.
- Recoverable Blocks: A significant portion of pre-encryption file blocks remained intact and recoverable through low-level pool analysis.
Recovery Solution
Rather than relying on the NAS’s own (deleted) snapshot history, our engineers imaged the pool’s drives and performed a low-level scan for orphaned ZFS blocks belonging to deleted snapshots. This allowed us to reconstruct a significant portion of the pre-encryption file state directly from the underlying storage.
Recovery Process
- Full Pool Imaging: Sector-by-sector images of all drives in the RAID-Z2 pool.
- ZFS Metadata Analysis: Mapping the pool’s uberblock history and dataset structure to locate references to deleted snapshots.
- Orphaned Block Recovery: Extraction of pre-encryption file blocks still present but no longer referenced by the live file system.
- File Reassembly & Validation: Reconstructing complete files from recovered blocks and validating integrity against known file types.
- Clean Delivery: Transferring the recovered archive to new, isolated storage to prevent re-infection.
Recovery Results
- Recovery Integrity: 91% of pre-incident files fully recovered
- Files Recovered: Complete departmental shares, with partial recovery of the most recently modified files
- Downtime: Client resumed operations on rebuilt, hardened infrastructure within 5 business days