Case Study

32 TB Data Recovered After "Weaxor Ransomware" Encrypts Education Company’s RAID 6 Server

Ransomware attack locked important educational files, including documents and media, prompting the need for a quick recovery process.

Published On : Mar 11, 2025

Overview:

An IBM NAS server with a RAID 6 setup at an educational organization was hit by the Weaxor ransomware. In addition to the ransomware attack which encrypted vital documents and multimedia, the drives were also physically damaged, hence inaccessible. Stellar Data Recovery quickly recovered the lost data, minimizing downtime and allowing the organization to resume its operations without significant delays.

Client Background:

An educational organization, which relies heavily on its data for managing educational content and official documents, faced a perilous situation. Their IBM NAS server with a RAID 6 setup (12 drives, 6 TB each) was hit by the Weaxor ransomware. This, along with physical damage to the drives, caused the loss of vital MS Office documents, PDFs, ZIP files, and multimedia.

Problem Statement:

The ransomware encrypted the data and appended the filenames with “.ROX” extension. Physical damage to the system made recovery even more difficult. The RAID 6 setup offers redundancy, but as the attack affected both the logical and physical components, much of the data was compromised. The client needed to recover 32 TB of data urgently, without paying the ransom.

Drive Specifications:

Raid Configuration: Backward Dynamic Raid 6 comprising 12 HDDs (6 TB each)
Drive Model: Toshiba MG04ACA600E
Server Model: IBM NAS Server
File System: XFS
Affected File Type: MS Office documents, PDFs, ZIP files, official documents, & multimedia
Issue: Data encrypted by ransomware + Physical Damage

Data Recovery Actions & Approach:

We recognized the critical nature of the client's data, and undertook our recovery process with utmost precision and care. The following steps highlight the meticulous approach we adopted:

Diagnosis & Assessment: Stellar's RAID recovery experts started with a thorough evaluation of the logical corruption and physical damage to the drives. They reviewed the RAID 6 array and the XFS file system.
Cloning Affected Drives: To avoid further data loss, they made sector-by-sector clones of all affected drives, preserving the data, both encrypted and unencrypted.
Rebuilding RAID 6 Array: A team of technicians carefully reconstructed the RAID 6 array, which involved restoring the drives, data striping, and parity to recover access.
Ransomware Decryption: Using advanced tools and proprietary tech, the experts performed ransomware recovery and decrypted the files, restoring the data to its usable state.
Data Recovery: After rebuilding the RAID and decrypting the files, the team recovered 32 TB of critical data, including documents and multimedia files.
Testing & Verification: Stellar ensured that all files were intact, accessible, and usable by running thorough tests on the recovered data.

Outcomes:

The recovery process was a success, with all data retrieved and restored accurately, demonstrating Stellar Data Recovery’s expertise:

With Stellar’s expertise, the educational organization was able to recover 100% of their data without having to pay the ransom. The process was quick, and the organization was able to resume normal operations after minimal downtime. Stellar also provided the organization with the knowledge and tools to better protect their data against future threats, ensuring a stronger security posture moving forward.
This case demonstrates the value of professional data recovery services and the importance of preventive measures to safeguard business-critical data.

Check Out Our More Success Stories:

Preventive Tips to Avoid Ransomware Attacks:

Backup Regularly: Use the 3–2–1 backup rule (three copies of data, two different media, one offsite) to ensure data safety.
Use Ransomware Protection: Implement reliable ransomware protection software to block malicious attacks.
Network Segmentation & Access Control: Isolate critical data and set strict user access controls.
Keep Systems Updated: Regularly update all software and hardware to patch vulnerabilities.
Employee Training: Educate staff about phishing and other modes of ransomware attack to reduce risks.
Incident Response Plan: Prepare a plan for identifying, containing, and recovering from ransomware attacks.
Data Encryption: Encrypt sensitive data to prevent unauthorized access in case of a breach.
Avoid Paying the Ransom: Don’t engage with attackers, as even after the payment of ransom, it is likely that the data and known vulnerabilities will be sold on the dark web. Instead, rely on professional data recovery services.

Business Need

The organization urgently needed to recover 32 TB of data due to a ransomware attack and physical damage to their RAID 6 system. The data comprised educational content and official documents, and was critical for business.

Data Recovery Approach

1. Cloned the affected drives to prevent further data loss.

2. Rebuilt the RAID 6 array and decrypted ransomware-encrypted files.

3. Recovered 32 TB of data and tested it for integrity.

Result

The prompt and effective recovery of 32TB of vital educational data allowed the organization to swiftly resume full operations, protecting its reputation and ensuring continuity in delivering educational content without delay.