SOLVED
Home

Download of server VHD file

D. David Paulson
New Contributor

We had an Azure ARM server undergo a brute force attack.  The attacker got into the server by attacking a service account on our domain.  Once inside the server, the attacker encrypted the server with a variation .dharma.  The server was less than a week old, so staff had entered only small data batches into the new server.

 

I created the server with a 1TB size drive.  Our security consultant would like a download of the VHD to test if the attacker breached any data in addition to encrypting data on the server.  I would mount the VHD file to in a segregated Hyper-V environment for the security consultant to test for a data breach.  The consultant does not want to test for the breach on the now deallocated server to preserve the chain of evidence.

 

  • What is the best way to download the 1TB size VHD file?
  • Does Microsoft offer a service where they would download the file to media and then ship the media to me?
  • Any other suggestions on how to approach this issue?  There is a high level of concern in the Executive Office of a data breach.

Thank you for your thoughts.

2 Replies
Highlighted
Solution

Azcopy, or Microsoft storage explorere should only download the actual data, and once it relizes the rest is empty the file should be generated. But the file will still indicate on you end that it is and requires 1 TB

I ended up using Microsoft Azure Storage Explorer and the VHD download successfully and in a reasonable amount of time.  Thanks.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
48 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies