How to recover your files from the Qlocker attack

As the QNAP technical support staff around the globe worked with affected users to test and purge Qlocker, and to offer our help by all possible means, we've identified a possible way to recover user data from affected QNAP NAS.

If you are

under the influence of Qlocker,
there is no encryption key that can be retrieved, and
you have not yet paid the ransom,

please do not pay the ransom, and contact QNAP technical support (https://service.qnap.com/) at the earliest convenience. QNAP will attempt to recover files from your QNAP NAS on a first come, first serve basis. Please do not delete, modify/change, or add files in the QNAP NAS to ensure a higher file recovery rate.

For advanced users, the following instructions are available for self-servicing your QNAP NAS to attempt recovery of encrypted files:

Prerequisites for using QRescue

For us to help you get back your encrypted files, the following conditions must be met:

you are under the influence of Qlocker,
the encrypted .7z files are intact (not deleted or modified/changed),
the disk space for storing the original files is not overwritten,
an empty external hard disk drive with sufficient capacity is available, and
you agree to the special QNAP Data Recovery terms and conditions (see below).

The capacity of this external HDD must be larger than the combination of all files to be recovered on the QNAP NAS. During the recovery, this external HDD will be formatted to the ext4 file system. Make sure that you properly back up existing data stored in this external HDD, or use a brand new disk.

How to contact QNAP technical support

Go to https://service.qnap.com/ with your web browser.
Click "sign in" to sign in to your QNAP account.
Enter your QNAP ID email address/phone number and password, and click "Sign in."
If you don't have a QNAP ID, click "Sign up now." to create a new QNAP ID.
Click "Support" at the top of the page.
Scroll down and click "Create Qlocker Support Ticket."
Follow the on screen instructions to complete the form, and click "Send Message" at the bottom of the page to submit the request.

QRescue operating instructions for advanced users

Acknowledgements

We would take this opportunity to acknowledge the contribution of the following developers for their help offered when QNAP is responding to the incident and developing related recovery utilities:

Christophe Grenier, author of PhotoRec (https://www.cgsecurity.org/wiki/PhotoRec)
flavomiano of the Bleeping Computer forum, author of filerestore

Special QNAP Data Recovery terms and condition

By downloading and installing the QRescue data rescue app, you agree to the special QNAP Data Recovery terms and condition detailed below:

The result of the data recovery assistance service related to the Qlocker incidents by QNAP could be different due to various factors. Your data might not be relocated back completely to the original status. QNAP does not guarantee the result of the data recovery service. Prerequisites required by QNAP for the recovery assistance service, including but not limited to essential backup storage space needed, must be met before any data recovery starts. Allowing uses of designated remote supporting tools will be needed in order to receive data recovery assistance from QNAP. Such data recovery support service does not constitute any admission of legal responsibilities by QNAP.