asked on

How to recover data from mysql 5.x

Hello

I have been tasked with trying to recover data from a legacy service win2003/mysql5.4. the server file system has been damaged by ransomware, specifically Dragon4444, possibly MBR and/or individual file damage.

So I am guessing its more of a data recovery job, so if it proves possible to recover files from the mysql directory, does anyone know of a way to attempt to restore even the text contents? structure if possible. Or try to reconstruct on a spare machine ?

All passwords available.

thanks in advance

thanks in advance

David Johnson, CD

if the file is encrypted then there is nothing you can do except replace it from a backup.

Adam Bell

ASKER

Thanks David. Dragon4444 is part ransomware which I was able to clean. And part cryptovirus. It seems it has encrypted quite a lot of data but may have been interrupted before it could get to the mysql directory. i plan to block the disk and try and access the mysql directory.

if successful I am think about how to handle any recovered files - maybe a fresh install of same version mysql and try to replace the schema and data from the damaged server.

Open to any possible method that has a fighting chance as the backups were encrypted before it could be interrupted.

thanks

David Johnson, CD

you can copy over the .mdf/ldf files and try

David Favor

It's unlikely you can play any games with your raw MySQL files to recover data.

Either all /var/log/mysql files are encrypted or none are encrypted.

You can easily make this determination by running a simple command...

mysql -u$user -p$pass -e "SHOW DATABASES"

Open in new window

then, for one database...

mysql -u$user -p$pass -e "SHOW TABLES" $dbname

Open in new window

If both commands fail, then you'll require a full restore, from a backup.

Tip: mysql5.4 is very old. Likely good to upgrade your database also.

Tip: If you have a backup copy of /var/lib/mysql raw data files that are pristine, these can be dropped onto pretty much any version of MariaDB + MariaDB will happily convert them from mysql5.4 to MariaDB-10.3.X (as it's best to use latest MariaDB for in place updates like this).

Adam Bell

ASKER

thanks to both, will test.

David Favor

Another dirt simple trick you can use, if you have the strings command available.

Just run strings on one of your database files + if any human readable text displays.

Good luck!

noci

If the database is still accessible: make an export using mysqldump....
if the database is not accessible for mysql ==> you need your backups.

ASKER CERTIFIED SOLUTION

skullnobrains

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

David Favor

I'd go on step further, regards skullnobrains comment.

Since you're running MySQL, just offload your database to a Linux machine... either short term or long term...

The continue working with to recover other files used by Windows.

Adam Bell

ASKER

spot on, thank you

David Favor

You're welcome!

Good luck!