He understands his own case precisely. In 2021 he was "a victim of Qlocker on my QNAP NAS", but he acted fast: "I've managed to shut the NAS before the encryption process completed and I haven't power on the NAS since". So he has "2 HDDs with partially encrypted data" and one sharp question — can encrypted data be recovered, "or can you only recover the data which is not yet encrypted". His question contains its own honest answer: the completed encryption is sealed by sound cryptography, but everything the process never reached is fully recoverable — and shutting down early is precisely what preserved that unencrypted majority.
| Media | Two hard drives from a QNAP NAS caught partway through Qlocker ransomware encryption, powered off before completion and left unpowered since |
| Reported situation | Qlocker infection on a QNAP NAS · NAS shut down before encryption completed · drives unpowered from that point to now · two disks holding partially encrypted data · a direct question about recovering encrypted versus not-yet-encrypted data |
| Fault class | Interrupted ransomware encryption on a NAS array — encrypted files sealed by strong cryptography, unencrypted files fully intact, with the interruption point determining the split |
| Equipment used | Both drives imaged under hardware write-blockers before anything, preserving the exact interrupted state · array configuration reconstructed and the QNAP volume assembled read-only from the images in UFS Explorer · Qlocker's method identified — it moves files into password-protected archives rather than encrypting in place, a distinction that shapes recovery · unencrypted files extracted directly, archive-related remnants and unallocated space swept in X-Ways Forensics for recoverable originals · results validated and separated honestly into recovered and sealed |
Qlocker works in a way that makes early shutdown unusually effective. Rather than scrambling files in place, Qlocker moves them into password-protected archives, deleting the originals as it goes — a sequential process that works through the array file by file. Interrupting it stops that march partway, which means every file it had not yet reached remains exactly as it was, untouched and fully recoverable.
His instinct to power down and leave it down was the correct one, twice over. Shutting down halted the encryption where it stood, preserving the unencrypted majority. Not powering on since prevented any further progress and, just as importantly, avoided writing anything new over the deleted originals — which, as with any deletion, may still be recoverable from free space until something overwrites them. Both decisions directly expanded what can be returned.
The honest answer to his direct question has two halves. Files Qlocker finished placing into password-protected archives are sealed with strong encryption, and without the key those cannot be broken — no laboratory brute-forces sound cryptography, and it would be dishonest to imply otherwise. Files the process never reached are recovered in full. The interruption point is the line between the two, and where he stopped it determines how much falls on the good side.
There is a second avenue beyond the untouched files, and it can pay. Because Qlocker deletes originals after archiving them, those deleted originals may persist in the array's free space — recoverable by the same techniques used for any deletion, provided nothing has overwritten them. His keeping the NAS off is exactly what keeps that avenue open, potentially returning files that had already been archived.
The NAS context shapes the method without changing the principle. The two drives form a QNAP array with a Linux-based volume, reassembled read-only from the images before anything is read — recovery works from that reconstructed volume, not from the bare drives, and never touches the originals.
The deliverable is an honest ledger, not a vague promise. The result separates cleanly into what was recovered — untouched files plus any deleted originals reclaimed from free space — and what remains sealed inside completed archives. He sees exactly where the line fell, quantified from the reconstruction, before anything is paid.
Both drives were imaged under hardware write-blockers, preserving the interrupted state exactly. The array was reconstructed and the QNAP volume assembled read-only from the images in UFS Explorer. Qlocker's archive-based method was identified, unencrypted files extracted directly, and archive remnants and unallocated space swept in X-Ways Forensics for deleted originals. Results were validated and separated into recovered files and sealed archives.
Interrupted state preserved by imaging, the array reconstructed, untouched files and reclaimable deleted originals recovered, and the sealed remainder reported honestly. The assessment is free and the quote is a single fixed figure inclusive of VAT; if the data cannot be recovered, there is nothing to pay. The decode: your fast shutdown drew the line — everything the encryption never reached is fully recoverable, and the originals it deleted may still be reclaimable from free space. What it finished sealing stays sealed, and keeping the NAS off is what protected the rest.
Keep it powered off, exactly as done here — every additional minute risks encrypting more files and overwriting the deleted originals that may still be recoverable from free space. Don't run decryptors or recovery tools against the live array; work belongs on write-blocked images. Preserve the ransom note and a sample for identifying the strain, since how it operates determines the recovery. Everything the encryption never reached comes back in full, and stopping early is what maximises that share.
Our case files are written up from genuine enquiries our lab has handled for customers across Staines, Surrey and the surrounding area, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.
Free diagnostic, fixed quote, no fix no fee — start now or call the freephone.