He understands his own case precisely. Back in 2021 he was "a victim of Qlocker on my QNAP NAS", and he reacted quickly: "I've managed to shut the NAS before the encryption process completed and I haven't power on the NAS since". That leaves him with "2 HDDs with partially encrypted data" and one question he wants a straight answer to, whether the encrypted data can be recovered, "or can you only recover the data which is not yet encrypted". He has more or less answered it himself, in that whatever the encryption managed to finish is locked by sound cryptography, while everything it hadn't reached yet can be recovered in full, and it was his shutting down early that kept that unencrypted majority out of its hands.
| Media | Two hard drives from a QNAP NAS, caught mid-process during Qlocker ransomware encryption, turned off before it completed and left off since |
| Reported situation | A QNAP NAS infected with Qlocker ransomware · the NAS shut down before the encryption process completed · the two drives unpowered from that time until today · both disks containing partially encrypted data · a direct question about whether encrypted data can be recovered, or only data not yet encrypted |
| Fault class | Ransomware encryption interrupted on a NAS array: encrypted files locked behind strong cryptography, non-encrypted files completely intact, with the point of interruption determining where the split falls |
| Equipment used | Both disks imaged under hardware write-blockers before anything else, preserving the exact interrupted state · array configuration reconstructed and the QNAP volume assembled read-only from the images in UFS Explorer · Qlocker's method identified: it does not encrypt in place but moves files into password-protected archives, a distinction that shapes recovery · unencrypted files extracted directly, archive-related remnants and unallocated space swept in X-Ways Forensics for recoverable originals · results validated and honestly separated into recovered and sealed |
Early shutdown happens to work unusually well against Qlocker, and that's down to how it goes about things. It doesn't scramble your files where they sit. What it does is move them into password-protected archives and delete each original as it goes, working its way through the array file by file, so when you shut it down mid-stream, every file it hadn't got to yet remains intact, exactly as it was, and can be recovered.
He made the correct choice to shut it down and keep it shut down, for two reasons. Shutting down stopped the encryption at a point when most of his data was still unencrypted. And by not turning the NAS back on, he stopped it encrypting any more and, just as important, avoided writing anything new over the originals it had deleted, which, like any deleted files, may still be recoverable from free space until something overwrites them. Both of those choices added directly to what can be given back.
So, to answer what he actually asked. If Qlocker had already finished putting a file into one of its password-protected archives, that file is sealed with strong encryption, and nobody can decrypt it without the key, since no lab brute-forces sound encryption and we'd be lying if we said we could. Anything it never got round to, though, he gets back in full, and wherever he happened to stop it is the line between the two, which is what decides how much ends up on the good side.
Beyond the untouched files, there is a second route back to the lost data, and it might pay off. Once Qlocker has put a file into an archive, it deletes the original. However, those deleted originals may still exist in the array's free space and can be recovered with the same methods used for any deleted file, provided they haven't been overwritten. Keeping the NAS switched off is what keeps this route open, and it means that some files which had already been archived may still be restored.
Does the NAS change anything? The method, a bit, but not the principle. His two disks are a QNAP array, with a Linux-based volume spread over both, so the first job is rebuilding that volume read-only from the images, before reading anything. Then we recover from the rebuilt volume and not the bare drives, and his original disks don't get touched.
What he receives is an honest ledger, and not just a vague promise. It sets out what we were able to recover, meaning the untouched files and also any deleted originals that were reclaimed from free space, and separately it sets out what is still sealed inside the completed archives. Both figures are taken from the reconstruction, so he will be able to see exactly where the line fell.
Both drives were imaged through hardware write-blockers first, which kept the interrupted state exactly as it was. The array was then reconstructed from those images, and the QNAP volume was assembled read-only in UFS Explorer. How was Qlocker working here? It was using its archive-based method, so the unencrypted files could be extracted directly, and the archive remnants and unallocated space were then searched in X-Ways Forensics for any deleted originals. The results were validated and the recovered files kept separate from the sealed archives, so it was clear what had come back and what hadn't.
So what did he get? His interrupted state was preserved by imaging, the array was reconstructed, his untouched files came back along with the deleted originals we could reclaim from free space, and we gave him an honest report of the sealed remainder. As usual the assessment was free and the quote a single fixed figure plus VAT, but with this being ransomware work it's paid upfront once you accept the fixed quote. His quick shutdown is what drew the line, so anything the encryption didn't reach can be fully recovered, and the originals it deleted might still be reclaimable from free space, but whatever it finished sealing will stay sealed, and it was keeping the NAS off that protected the rest.
Keep it turned off like he did. Every minute it's running, it could be encrypting more files and writing over the original files it deleted, which might still be recoverable from free space. Do not run decryption or recovery tools on the live array. That type of work needs to take place on write-blocked images. Also hang on to both the ransom note and an example of one of the encrypted files, which will let the strain be identified, as the way it operates will dictate the path to recovery. Everything the encryption didn't touch comes back in full, and the sooner you shut it down, the larger that share will be.
Our case files are written up from genuine enquiries our lab has handled for customers across Staines, Surrey and the surrounding area, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.
Got a NAS like his sitting switched off? Leave it off and start online or ring the freephone, the diagnosis is free and the quote's fixed, and on most jobs you only pay if we recover your data.