restore_samba_virus_encrypted
To restore files encrypted by Locky virus, one must first delete all files with .locky extension
find /chroots/samba/data -type f -iname "*.locky" -delete find /chroots/samba/data -type f -iname "_Locky_recover_instructions.txt" -delete
Then it is necessary to restore all of the missing files. The easiest way is to change rsync flags in the BackupPC host config and restore the entire samba data tree.
- Go to the BackupPC web page
- Navigate to the correct host
- Add --ignore-existing to Edit config -> XFER -> RsyncRestoreArgs
- Press Save
- Restore the entire tree /chroots/samba/data from the appropriate backup
- Remove --ignore-existing from the configuration
- Press Save
This approach has an additional benefit in that rsync won't hang forever on currently opened files (typical for samba).