The context
An e-commerce SMB in Charleroi centralizes on a Synology DS920+ NAS (4 × 8 TB in SHR, i.e. 24 TB usable) its product sheets, visuals, invoices and customer databases. One Monday morning, nothing is readable: every file carries a foreign extension, and a note demands a cryptocurrency payment. Diagnosis: eCh0raix, a ransomware specifically targeting QNAP and Synology NAS.
The IT team's reflex was right: immediately disconnect the NAS from the network and try nothing. That's what changed everything.
The intervention
The NAS is entrusted to us as a business emergency. The golden rule applies: we never work inside the original enclosure. Steps:
- Extraction of the 4 disks and sector-by-sector cloning, behind a write blocker, on a dedicated bench.
- SHR volume reconstruction (mdadm + LVM stack) outside the enclosure, from the images.
- Analysis of the Btrfs file system and inventory of the snapshots: eCh0raix had encrypted the visible files but ignored the read-only snapshots predating the attack.
- Mounting the snapshot dated the day before the intrusion and extracting the healthy state: product sheets, visuals, accounting, customer databases.
Processing was done on an air-gapped network, to rule out any spread during analysis.
The result
In seven days, all 24 TB was restored to its state the day before the attack — a near-zero data loss. The files were returned on a new encrypted array, after VeriFiles list approval. No ransom was paid. The company resumed activity, and we recommended a 3-2-1-1-0 strategy with an offline copy so the next attack is a non-event.