It's still getting worse, which is why this situation is urgent. A QNAP NAS is "partially encrypted" with files renamed to a ".devon extension", and it continues to encrypt "when it is powered on": they "reinstalled with a new image, but when the old disks are inserted, it is starting to encrypt" again. The disks contain "10 TB of backup". The ransomware continues on every power-up, so the malicious process remains present on the disks themselves. That makes the first rule the opposite of the instinct to keep trying: stop turning on the array, because each time it is turned on, more of what remains will be encrypted.
| Media | QNAP NAS disks containing approximately 10 TB of backup data, partially encrypted with files renamed to a .devon extension; the encryption continues to resume whenever the disks are powered up, even after a NAS firmware reinstall |
| Reported situation | Partially encrypting ransomware with a .devon file extension · NAS reimaged with fresh firmware in an attempt to halt it · original disks reinserted and encryption beginning again on power-up · 10 TB of backup data stored on the array · the encryption process ongoing rather than complete |
| Fault class | Persistent active ransomware on the storage disks (completed encryption locked behind strong cryptography; unencrypted data still intact but continuing to shrink with every power-up; malicious code re-triggered from the disks themselves) |
| Equipment used | Individual disks imaged at the hardware level using write-blockers (so they are never powered by a system running the malware again) · the QNAP array rebuilt read-only from those images using UFS Explorer · the ransomware's operation and the specific .devon variant analysed, and its persistence mechanism located · unencrypted data extracted directly, deleted originals swept from free space in X-Ways Forensics · results separated honestly into recovered and sealed groups |
This kind of resuming encryption demonstrates that the threat lives on the disks, not just the NAS. Replacing the NAS operating firmware was a sensible step; however, the encryption resuming after the previous disks went back into the array indicates that the harmful component of the ransomware, or its trigger, resides on the disks themselves. Therefore, even with new firmware, the persistent threat will run again as soon as the firmware reads the disks. The issue was never limited to the part they replaced.
The most important instruction is one which reverses your natural reaction. There is a strong tendency to keep the array powered up to evaluate the extent of the damage or try to repair it, but each time you do so the encryption makes further progress through your remaining unencrypted data. With a partial encryption, this directly reduces what can be recovered. The disks must not be turned on in any live system again; the first protective step is to stop, and image the disks in isolation instead.
The honest way to divide up the data follows the pattern of all ransomware. Files that the process has already encrypted are sealed using strong cryptography, and without the key they cannot be reversed: there is no laboratory in the world that can brute-force sound encryption, and it would be dishonest to suggest that the .devon files could simply be unlocked. On the other hand, everything that the process has not yet reached remains intact and fully recoverable. Because the encryption process is still ongoing, how much ends up recoverable depends on whether you stop it now or later.
Imaging in an isolated environment preserves your data while at the same time eliminating the risk. We remove the disks and image each one under write-blocked conditions, capturing the exact current state of each disk without ever powering it in a system that would execute the malicious code. All further work happens on the images, and the array is reconstructed from them read-only, so the recovery itself cannot trigger further encryption and the live threat is taken out of the loop entirely.
A second path exists which can recover more than just the untouched files. Ransomware of this type usually deletes or overwrites original files as it encrypts them, and those deleted originals may remain in the free space of the array. If nothing has overwritten them, they can be recovered with the same techniques used for any deletion. Keeping the disks powered off protects this path too, potentially returning files that had already been processed.
The final outcome is an honest ledger that makes the timing clear. It clearly separates what has been recovered (the untouched files and any reclaimed originals) from the files still sealed in .devon-encrypted form, and makes clear that stopping the power-ups maximised the recoverable share. He knows exactly where the line fell.
Each disk was taken out of the NAS and imaged individually using hardware write-blockers, without ever being connected to a system that could run the malware again. Then the images were used to reconstruct the QNAP array in read-only mode using UFS Explorer. After identifying the .devon variant and the way it persisted, all unencrypted data was extracted directly. Deleted originals were located in the free space using X-Ways Forensics. And finally, the results were separated honestly into two categories: recovered files and sealed .devon archives.
The threat was halted by imaging each disk separately, the array was rebuilt in read-only mode, all untouched and reclaimable data was recovered, and the sealed .devon remainder was reported honestly. The assessment is free and the quote is a single fixed figure that includes VAT; ransomware work is paid upfront once you accept the fixed quote. The decode: the encryption starting again whenever the disks are powered on means the threat is still on your disks, so every time you turn them on you lose more data. Stop turning them on and have them imaged in isolation: everything the process has not touched yet can be recovered. Everything it has finished encrypting will stay sealed.
Shut the array off and do not turn it back on: reimaging the NAS won't solve the problem while the threat remains on the disks, and each time you boot up, more of your remaining data will be encrypted. Do not keep inserting the original disks to test it. Remove them and have them imaged in isolation, where the malware can't run. All data the ransomware has not reached should be recoverable, and deleted originals may be recoverable from free space, so stopping now directly determines how much comes back.
Our case files are written up from genuine enquiries our lab has handled for customers across Staines, Surrey and the surrounding area, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.
Free diagnostic, fixed quote, and in most cases you only pay if we recover your data. Start now or call the freephone.