1

I had a an instance of SQL Server 2014 with filesteam on. Recently the machine was infected with a virus that basically decrypted all the files that were possible to modify, so SQL Server was broken. The administrator of the machine gave us a backup in form of .mdf and .ldf files of our database, no .bak file, he was basically just saving what was on disk instead of doing SQL Server backups. Anyways, I have installed a new instance of SQL Server 2014 on that machine (witch filestream on) and I'm trying to attach the recovered .mdf file. If I use this script:

CREATE DATABASE [ABC] ON  PRIMARY 
( NAME = N'ABC', FILENAME = N'D:\SQL Server 2014 2\MSSQL12.SQLEXPRESS2\MSSQL\DATA\ABC.mdf'), 
( NAME = N'ABC_log', FILENAME = N'D:\SQL Server 2014 2\MSSQL12.SQLEXPRESS2\MSSQL\DATA\ABC_log.ldf')
 FOR ATTACH

I get the following error message:

Msg 3634, Level 16, State 1, Line 5
The operating system returned the error '2(The system cannot find the file specified.)' while attempting 'FsFileHeader::Open' on 'D:\Filestream\ABC.FS'.
Msg 5105, Level 16, State 14, Line 5
A file activation error occurred. The physical file name 'D:\Filestream\ABC.FS' may be incorrect. Diagnose and correct additional errors, and retry the operation.
Msg 1813, Level 16, State 2, Line 5
Could not open new database 'ABC'. CREATE DATABASE is aborted.

So it basically tries to refer to a location of a filestream that is broken (the data there was decrypted by the virus). However, the ABC.FS folder exists, so I don't know why such a message is shown. Maybe it refers to some filestream files that this folder contains? If I delete everything and leave this folder empty, the same error is thrown.

I have also tried another script, where I try to create a new Filestream directory (the rest of the script is same as above):

FILEGROUP [ABC.FS] CONTAINS FILESTREAM  DEFAULT 
( NAME = N'ABC', FILENAME = N'd:\Filestream2\ABC.FS' )
LOG ON

This gives me a following error:

Unable to open the physical file "d:\Filestream2\ABC.FS". Operating system error 5: "5(Access is denied.)".

I think I have added every possible user, including the user on which SQL Server runs, to have full control over this folder, but it would not help.

I will also point out that I don't want to restore any data the filestream containded, this is pretty much gone. I just want to be able to attach this database from the .mdf file.

matt137
  • 169
  • 1
  • 14
  • "Decrypted"? You mean "encrypted" ? BTW, someone should have a few words with the "administrator" that didn't take backups - why do you assume you can just copy an `mdf` file and expect it to work, esp. without losing any data? If you have filestream enabled, the filestream data is *not* stored in the `mdf` file. Has the "administrator" ever tried to verify that he can "restore" these files? And why are *you* trying to restore the DB instead of *him*? – Panagiotis Kanavos Jan 05 '16 at 09:10
  • Yes I meant 'encrypted', sorry for that. As to the administrator not doing proper sql backups, well you can imagine there has been some fuss about the situation :) but that's really another story here, what I'm left with at this moment is to try and restore the mdf. I realize that the data from filestream folder is lost, as I mentioned at the end. Let's say we can live with that for the moment. – matt137 Jan 05 '16 at 09:49
  • I am in the same situation. A ransom virus encrypted the MDF, LDF, and Filestream folder. We were able to decrypt the MDF and the LDF, but not the Filestream folder. I didn't make any backups. Now I cannot attach the database without the Filestream. I don't care about the Filestream, I just need the MDF data. – Richard Woolf Jul 08 '19 at 14:27

0 Answers0