Reconnecting HDDs to recovery data from shadow copy

[Kevin_205]

Good day,

I recently had the joy of receiving the CryptoLocker background (sarcasm).
I removed all the drives from the PC to remove the ransomware but now want to reconnect them to see if I can get anything back via the shadow copies.

My question is;
Do I need to connect all the drives to the original ports or can I connect them to any SATA port, as long as I boot from the original Windows HDD, for the shadow copies to be found?

Many thanks,
Regards,
Desecrator

 

[ex_bubblehead]

One of the first things Cryptolocker type malware does is to delete all shadow copies to prevent exactly what you are trying to do. It's highly unlikely that anything recoverable remains.

 

[Kevin_205]

I have managed to retrieve information from the Windows drive but when re-installing the other two HDDs (D & E), I can't seem to find any shadow copies. I'm not sure if it was set to run on those drive Or if is because the HDDs are connected differently Or if the ransomware deleted it?

If the connector make no difference then i'll stop were i am and just format, but if the connectors do make a difference then I would like to at least try to get something back.

 

[ex_bubblehead]

If you can't find the shadow copies then you have your answer, the ransomeware deleted them. It makes no difference as to which port the drives are connected.

 

[Kevin_205]

Thank you for the feedback.