This case study documents two recoveries after attacks by the Akira ransomware: a production SAP database on Oracle that was recovered completely, and a Veeam backup from which the files were recovered in part. Both were done without the attackers’ key.
Case 1: SAP on Oracle, 2.5 TB
- Client Name: Confidential (a healthcare technology company in the United Kingdom)
- Data Type: SAP on Oracle: the production database, its Oracle export (DMP) and datafiles
- Data Capacity: about 2.5 TB
- Ransomware: Akira
- Ransomware Extension: .akira
Incident Summary
The company’s SAP-on-Oracle environment was hit by Akira. The production database was encrypted, both the Oracle export and the datafiles, which were renamed with the .akira extension, and the SAP system could not start.
How the Recovery Was Done
The work was done directly on the encrypted Oracle files. The database was recovered from them and repaired until it was consistent and usable again. Nothing was written to the original files.
Result
The database was fully recovered and repaired to a consistent, working state.
Case 2: Veeam Backup, 70 GB
- Data Type: Veeam full backup (VBK)
- Data Capacity: about 70 GB
- Ransomware Extension: .akira
Incident Summary
A Veeam full backup was encrypted by Akira and renamed with the .akira extension. Veeam refused to open it.
Technical Analysis
Measured directly on the file, Akira had encrypted the header, the metadata area, roughly the first 2.3 GB and two further stripes. 62% of the file was still readable. Every Veeam metadata page was destroyed, so the virtual disks inside the backup could not be rebuilt.
Result: a Partial Recovery
The files were recovered from the readable part of the backup by their internal structure: 6,255 files (2,806 JPEG, 1,388 PNG, 975 ZIP and others), without their original names and folders. In a check with independent reader software, 97 of 102 sampled files opened correctly.
What These Two Cases Show
Akira encrypts large files only in part. When the important structures survive, as in the Oracle database, everything can come back. When they are destroyed, as in the small Veeam backup, the contents can still be recovered, but not in their original form. Which case applies is measured on your files first, and you are told what is realistic before any chargeable work starts.
Hit by Akira?
Do not restart, reinstall or restore over the affected servers. Keep the ransom note and a few encrypted files, and contact us for a free assessment.