Problem recovering from backup

[Jens_Lagerqvist]

Core Machine

Qnap TS251-D 8gb RAM

Network Details

Ethernet directly to router

Audio Devices

WRITE HERE

Description of Issue

I had some problems with the disc space on ny NAS and when I got that sorted out I had to reinstall the Roon Core but I can’t recover from any of my saved backups. I got the same message no mather which backup I try.

Am I doing something wrong, it is the first time I try to recreate from backup.

[killdozer (Brutalise me with music)]

Hi @Jens_Lagerqvist, I’m not support but while you’re waiting I’ll offer some second rate help

I don’t want to alarm you but the first screenshot (top left) has a file called README_FOR_DECRYPT.txtt. At first I wondered if you had encryption turned on but a quick Google suggests that you might be suffering a ransomware attack:

https://forum.qnap.com/viewtopic.php?t=160274&sid=9d262e1623b4912a282b1737242a8108

This would mean that all of the backup files are encrypted and are therefore unreadable by Roon, which fits the behaviour you’re seeing. There are a few (lot?) of cases of this across NAS devices. This is covered in another forum thread here:

Massive malware attack on QNAP

Except me and 28 others, so far. You can see where the link goes (bleeping computer) by hovering on the link. I noticed that my QNAP installed or updated and ran a malware remover this morning. It didn’t find anything and my files are intact. From the discussion at bleeping computer, it looks like many machines have been affected world wide. I’m now headed to QNAP to see if there is more preventive action we should take. Thank you dpstjp for the heads up.

This thread holds a discussion for affected users and you might get some joy there:

https://www.bleepingcomputer.com/forums/t/617854/ech0raix-ransomware-qnapcryptsynology-nas-encrypt-support-topic/

DON’T jump to the conclusion that this is the case but you’re certainly showing the symptoms and it’s worth investigating. Sorry for breaking what might be bad news.

[killdozer (Brutalise me with music)]

The only consolation I can offer is that Roon can still see the details of the backups (date made and version of software running) which I’d have thought might also be unreadable after encryption. It is just speculation though as I have no idea how Roon works that out.

Can you read other files on the NAS and do you have backups of the NAS itself?

[Jens_Lagerqvist]

Thanks @killdozer, well spoted and it seems that you are correct in your suspition. It seems like the attack is only on the ssd-disc and not the hdd in the other slot because there I can see roon backups without the decryption txt-file. But I got the same error message when trying from that backup, its old though from version 764 in the beginning of March.

Well this sucks….

[killdozer (Brutalise me with music)]

Sorry to hear that @Jens_Lagerqvist it really sucks. I hope that you’ve not lost too much data to encryption and can recover everything without having to pay money to low-lives.

Good luck,
Carl

[Jens_Lagerqvist]

Thanks again @killdozer! I have everything but roon on a number of backups so no music or pictures gets lost due to this thankfully. But it sucks to lose the history (and all the settings) in Roon. Strange though that I can’t use the non-decrypted backup on the hdd, maybe there is a way out with that hopefully.

[Jens_Lagerqvist]

Hi again,

You can close this topic. I’ve managed to create a new core and got a backup that was not encrypted.

I don’t know if I can close a topic myself, thanks!