What if there is a blackmail virus in the database?

1. SQL Server

SQL Server is a relational database management system. It was originally developed by Microsoft Sybase and Ashton-Tate, and the first OS/2 version was released in 1988. After the launch of Windows NT, Microsoft and Sybase parted ways in the development of SQL Server. Microsoft migrated SQL Server to Windows NT system and focused on developing and promoting the Windows NT version of SQL Server. Sybase focuses more on the application of SQL Server on the UNIX operating system.

Second, fault information

Database type: SQL Server

Version type: 2008R2

Failure condition: one database of the user is encrypted and is currently unavailable.

Presentation: database MDF, LDF, and log log file names have been changed, as shown in the following figure:

The database backup is encrypted and the file name has been changed, as shown in the following figure:

3. Back up the database

In order to prevent the secondary damage to the original database caused by misoperation in the process of data recovery, we must first make a backup for each database. Since then, all recovery operations are carried out on the backup database to prevent damage to the original database.

IV. Fault analysis and recovery

1. Using professional recovery software to open the SQL server database of the virus, you can see that the head of the database has been destroyed.

2. The page size of sqlserver database is 8K, cut into blocks according to 8K, look down, and finally get the result that every 128K is encrypted.

3. Open the database backup and find that it is encrypted every 128K.

Search down for the start flag 00F of the database page and find that it is not encrypted. After analysis, the database is encrypted in the same way as the database backup, which is encrypted every 128K. Because the backup information is recorded in the database backup header, the database page starts to shift downward. Therefore, the encrypted pages in the database are exactly staggered from the encrypted pages in the database backup.

4. Repair the encrypted database

Combine the database backup to repair the encrypted pages in the database, attach the modified database through the database management tool, and query and verify.

V. results of data recovery and acceptance

After the user acceptance check, the database can be successfully attached, the display data is correct, and the data recovery work is completed.