How to Recover Files From Qlocker Attack on Qnap NAS?

As the Qnap Systems, Inc.’s technical support staff around the globe worked with affected users to test and purge Qlocker, and to offer our help by all possible means, the company has identified a possible way to recover user data from its affected NAS.

If you are:

1. under the influence of Qlocker,

2. there is no encryption key that can be retrieved, and

3. you have not yet paid the ransom,

Do not pay the ransom, and contact the company’s technical support at the earliest convenience. The firm will attempt to recover files from your NAS on a first come, first serve basis. Please do not delete, modify/change, or add files in the the NAS to ensure a higher file recovery rate.

Click to enlarge

For advanced users, following instructions are available for self-servicing your Qnap NAS to attempt recovery of encrypted files:

Prerequisites for using QRescue
For us to help you get back your encrypted files, the following conditions must be met:

1. you are under the influence of Qlocker,

2. the encrypted .7z files are intact (not deleted or modified/changed),

3. the disk space for storing the original files is not overwritten,

4. an empty external hard disk drive with sufficient capacity is available, and

5. you agree to the special Qnap Data Recovery terms and conditions (see below).

The capacity of this external HDD must be larger than the combination of all files to be recovered on the NAS. During the recovery, this external HDD will be formatted to the ext4 file system. Make sure that you properly back up existing data stored in this external HDD, or use a brand new disk.

Full version online

Click to enlarge

QRescue operating instructions for advanced users
QRescue is the data recovery tool for Qlocker-encrypted 7z files. It contains:

• PhotoRec (Open Source Project / GNU General Public License / Project Link):
  File recovery software designed to recover lost files from hard disks and CD-ROMs, and lost pictures (thus the Photo Recovery name) from storage medium.

• QRescue (Powered by QNAP):
  The script to recover file structures from the encrypted 7z files and PhotoRec files.

Instructions (PDF in English langage)

Acknowledgements
The company would take this opportunity to acknowledge the contribution of the following developers for their help offered when Qnap is responding to the incident and developing related recovery utilities:

• • Christophe Grenier, author of PhotoRec

  • flavomiano of the Bleeping Computer forum, author of filerestore

Special Qnap Data Recovery terms and condition
By downloading and installing the QRescue data rescue app, you agree to the special Qnap Data Recovery terms and condition detailed below:
The result of the data recovery assistance service related to the Qlocker incidents by Qnap could be different due to various factors. Your data might not be relocated back completely to the original status. Qnap does not guarantee the result of the data recovery service. Prerequisites required by Qnap for the recovery assistance service, including but not limited to essential backup storage space needed, must be met before any data recovery starts. Allowing uses of designated remote supporting tools will be needed in order to receive data recovery assistance from Qnap. Such data recovery support service does not constitute any admission of legal responsibilities by Qnap.