Jack Cable
Jack Cable
Thanks! I am good to use bash. There may be cases where some command fails but the script is fine to continue executing - for instance if the encrypted nvram...
Hi @okamah, are you running a windows VM? If so, you may consider trying the steps at https://enes.dev/#update-1.
Hi @yortx85, were you able to have any luck with the guidance at https://enes.dev/#update-1 for the Windows VM? For the linux VM, could you share more info regarding your configuration...
Hi @okamah and @yortx85, I have made some changes to the script that may fix some bugs if you would like to try running again. Additionally, please ensure that the...
@merimo is the flat file encrypted as well? If it is, this script cannot be used. If not, let me know what you’re seeing.
Hi all, I suspect some of this may be due to a later version of the ransomware which also encrypts the virtual disk (I will update the guidance shortly around...
Hi @wxthss82, can you try running the check command on a flat vmdk file?
Hi @wxthss82, it appears that the flat file may unfortunately be encrypted. Can you check the ransom note via “ cat /usr/lib/vmware/hostd/docroot/index.html”?
Hi @kpma1985, are you able to share the commands that you ran to successfully recover with sesparse?