ReadyNAS Raid1 - are both disks identical, or data only?

[uplink]

Greetings,

My client was just attacked with CryptoWall 3.0 [yup, he's effed], now tryin' to pay ransom.

My question is. Of the residual data on NAS, that are uncrypted. When I put out one HDD, from the raid1 array, is the other twin array disk member "the same", or just data part is identical?

There are three partitions on those disks, all marked as "nas raid hdd member", so no known FS.

Please advise. I need to know whether do backup of both, or one is enough [image backup > Acronis True Image],

Thank You!

regards

Bryan

[StephenB]

There's an OS partition (4 GB) which is mirrored on both disks. This shouldn't have data, but is needed to boot up the NAS.
There's tmpfs (~536 MB). I'm not sure if that is mirrored, or if it needs to be backed up. One would hope not, given the name.
Then the large partition, which is the data image and fully mirrored.

[uplink]

Thank You for Your answer Stephen!

One more question. When I clone only one HDD, and hit the NAS with two cloned HDDs [not genuine], will it work? Or will it crash?

Thank You!

Regards

Bryan

[Nhellie]

uplink wrote:
One more question. When I clone only one HDD, and hit the NAS with two cloned HDDs [not genuine], will it work? Or will it crash? Bryan

It might crash, there are things like the superblocks that needs to fixed or repartitioned.

[StephenB]

uplink wrote:
Thank You for Your answer Stephen!One more question. When I clone only one HDD, and hit the NAS with two cloned HDDs [not genuine], will it work? Or will it crash?

It sounds like you are thinking you will clone a disk twice? (I am thinking it will have been unlocked somehow)...

If so I think I'd insert just one disk. When that boots, hot insert a blank disk and let it resync.

If I am misunderstanding (quite likely) please sketch out your recovery plan in a bit more detail.

[uplink]

Thank You Nhellie for Your reaction!

Stephen - I don't want to make backup of both raid1 members in general [it's ~6 TB instead of ~3 TB], thus, my question is, whether I can spit out the image of one drive from raid1 to two drives, and make them work?

Or should I spit the image to one drive, and format the other, and let it sync?

Thank You for Your time! I appreciate it!

Humble regards,

Bryan

[mdgm-ntgr]

Which model NAS is this?

If it's an OS6 NAS and you used snapshots on this NAS then you may have some snapshots of your data from before the files were infected.

I assume a PC was hacked and that PC had one or more mapped network drives for shares on the NAS?

[uplink]

I will update the thread asap. Btw. ReadyNAS from NETGEAR is one awesome device. I can't react now for the global security reasons. Will explain it in a few days. Thank You all guys for now!