Got called in to this perfect scenario. The server is locked down with crypolocker. When you log in to it, it comes up with the usual BS blurb about entering payment to unlock. Cannot access the server any other way except the network shares that were created by the previous consultant.
No server disks or recovery disks. And the system is RAIDed. System has NOT been rebooted since infection. System is isolated on a closed network with a few Win7 Pro workstations.
However, clients are still running the two sql apps. They have backups for the first sql app. The second sql app is running. We have the data. We just need to shut sql down so we can copy the microsoft folder.
Any ideas?