I'm looking for insight into a complicated case. We inherited a client whose data is encrypted with MAMBA. Their former IT deleted the MBR without backing up any drives. He had paid the ransom and received the passwords to decrypt, however, due to the deleted MBR the drives are not decrypting. We have tried replacing the MBR, mounting the drives on other machines, and mounting the drives with a new OS drive. Nothing is working. They are posting an Error 4 which is for the wrong password or missing header. DiskCryptor's forum is locked, so I cannot ask them either.
Any other ideas would be greatly appreciated.
Edited by hamluis, 18 July 2018 - 03:52 PM.
Moved from Encryption to Ransomware - Hamluis.