Ransomware and Partly Encrypted Database Files

Encrypting a multi-terabyte database file in full takes time, and some ransomware avoids that by encrypting only part of each file, such as the first section, or blocks at intervals. That makes the attack faster and harder to detect, but it also means that a large file may still contain readable data. Whether any of it can be used depends on the ransomware, the database engine and the file, and nothing about it can be assumed.

Database files are made of fixed-size pages, and the data is spread across them, with a header and allocation structures that the engine needs in order to open the file at all. If the encrypted portion covers that header or those structures, the database will not start or attach even though many of the pages containing table data are still intact. In that case, the normal tools fail, and the useful information can only be reached by reading the surviving pages directly.

Isolate the affected systems from the network so that encryption cannot spread and the attacker cannot reach backups. Do not delete, rename or try to open the encrypted files, and do not run repair commands against them. Take read-only copies or images of the affected files and volumes, and do all further work on those copies. Keep the ransom note and any file extension or file name pattern, because they help identify the ransomware family.

Backups are frequently a target. Check whether the backup repository, and any copies stored on the network, are intact, and verify them from a system that is not part of the affected environment. An offline or immutable copy that the attacker could not reach is worth more than any other recovery route.

For some ransomware families, free decryptors exist, and the No More Ransom project is a reputable place to check. They only work for specific families and versions, so a match is not guaranteed. Test any decryptor on a copy, never on the only remaining version of the file, because a tool that fails can leave the file in a worse state.

If the ransomware encrypted whole files with strong encryption, and no backup or key exists, the encrypted data cannot be recovered. If only parts of the files were encrypted, the unencrypted pages may still be readable, and rows can sometimes be extracted from them. The proportion recovered depends on how much was encrypted and where, and it is not possible to know until the files have been examined.

Whether to pay a ransom is a business and legal decision that is outside the scope of this article, and payment does not guarantee that a working decryption key will be provided.

If the affected databases matter and there is no clean backup, a specialist assessment of the encrypted files can establish quickly whether the encryption is partial and how much of the data may be readable. Keep the originals untouched in the meantime.