Private cloud estate, two Proxmox hypervisors · 2026
Ransomware response and virtual machine recovery
Led recovery after a ransomware event destroyed one hypervisor: rebuilt business VMs from partial disks, recovered ext4 and LVM volumes without a partition table, proved the entry vector, hardened the surviving nodes and set up off-site backups.
Role: Incident responder
Incident responseProxmoxext4 and LVM recoveryPostgreSQL forensicsBackups
Highlights
- Rebuilt several production Odoo systems on a surviving node, recovering data from damaged disks with filesystem forensics rather than restoring from backups that did not exist.
- Mined PostgreSQL write-ahead logs to recover records that were never committed to a dump.
- Proved the intrusion path, cleaned a second host that had been running a hidden miner, and hardened every remaining node.
- Introduced off-site backups to network storage over a private tunnel, with an inventory of every VM’s database, filestore and add-ons.
- Later recovered a cloud instance whose root disk failed to boot after a storage stall, using a helper instance and a documented filesystem repair.