Unraid server data recovery

Techbuilder22 · November 2, 2021

Hello, I have a unraid 6.9.2 server. It suffered a power loss and I lost all my shares. however it seemed the data is still there as the hard drives are still populated (see below). We have tried to find the data in the terminal, but we were unsuccessful. Also we noticed that my cpu on 50-100 % load. We checked it in the pining, and Xmrig (CPU crypto miner) was using the CPU. I am not sure how this happened but I use Xmrig on my pc where I accessed the server and was on the same network. My friend had a look and he said someone hacked in and did this then deleted all my data.

I may or may not be in denial but I don't understand how they could have deleted the data without anything (logs) from the machine. Let me know if you can think of any other ways to see if my data still exists.

jj9987 · November 2, 2021

1 hour ago, Techbuilder22 said:

I don't understand how they could have deleted the data without anything (logs) from the machine

Oh, that's the easy part. Rest depends on how they wiped it.

You can try using TestDisk to see if it can recover anything.

Also make sure your unRAID instance is not exposed to the Internet in any way, check your Docker containers as well as any other basic security checks/updates.