Ransomware and re-adding drive

[denywinarto]

This morning my server was hacked and the hacker encrypt all of my drives with bitlocker.

Now he gave me a password to unlock it and it was successful so i unlock all drives.

But now on bottom right tray there's a multiple encrypting drive X... in progress.. 

There are over 180 TB of data. Now what i dont understand, drivepool still can't detect the drives. I am able to open the files on the unlocked drives though,

do i have to wait until encryption process completed? what i dont understand is, isnt' it supposed to be decrypting instead of encrypting?

[Christopher (Drashna)]

First, I'm sorry to hear about that, as that is never a pleasant experience. 

Try restarting the service.  

If that doesn't help, check to see if the files show up, and specifically, PoolPart.xxxx folders. 

 

[denywinarto]

Sorry forgot to update, i managed to recover my data.

and yes, drivepool had to be restarted.

Painful (and expensive) lesson, but it taught me one thing, never ever create RDP shortcuts to your important servers