Hit With Ransomware. zfs Rollback Having No Effect

[depasseg]

I'm sorry to break this to you, but your Titan snapshots only contain data that exists in Titan (and sub-folders in it), but not the sub-datasets that are under Titan. I'm guessing you don't have the "recursive" option checked in your snapshot settings for Titan.

If you wanted to pay, I've heard that it's extremely likely that they will provide the decryption key (otherwise word would spread, and no one would ever pay).

 

[anodos]

Hi anodos,

That file is 378 GB in size, so I can't copy it here. Not sure there is a practical way to share that.....is there something else, or a subset of that which I can provide you?

Dropbox, Google drive, etc. With download link here will work. I concur with @depasseg, with the caveat that I'm uncertain what effect your previous recovery attempts will have on your ability to decrypt the files. The debug will give quite a lot of insight into your present system, and the status of your zpool and its history.

 

[bbqnerd]

Make sure the CrashPlan has what you expect, from a system that you know isn't compromised.

Solid advice. Thanks.

 

[bbqnerd]

I'm sorry to break this to you, but your Titan snapshots only contain data that exists in Titan (and sub-folders in it), but not the sub-datasets that are under Titan. I'm guessing you don't have the "recursive" option checked in your snapshot settings for Titan.

If you wanted to pay, I've heard that it's extremely likely that they will provide the decryption key (otherwise word would spread, and no one would ever pay).

Depasseg - Thank you for this explanation. I sure do appreciate you taking the time to pitch in here. I guess I am hosed, and will learn a great many lessons from this ordeal.

Thank you to all for replying and confirming what I feared.

 

[Mirfster]

Not sure if it will help, but some of the Decryptor Keys have been discovered and released:

https://noransom.kaspersky.com/
http://arstechnica.com/security/2014/08/whitehats-recover-victims-keys-to-cryptolocker-ransomware/

Might be worth looking into...

 

[styno]

Just to be clear, do you have the following checked or not in the periodic snapshot task? (don't worry about the other values/checkboxes for now)

 

[bbqnerd]

Just to be clear, do you have the following checked or not in the periodic snapshot task? (don't worry about the other values/checkboxes for now)

Sonofo$%^*&$%$%&.

Problem solved. I'm an idiot. Thanks.