A plumbing company suddenly sees its entire business ground to a halt. On their screens, a terrifying file extension: .mkp. The MAKOP ransomware has just struck.
Facing a €15,000 ransom demand—and backed by the sound advice of one of our partners—the company refused to give in to the cybercriminals.
The problem? Their backup system relied on Drive Snapshot, a lightweight, niche German software whose .sna files are rarely encountered by recovery experts. That is when the local IT team and the software publisher decided to hand the case over to the Recoveo laboratory.
📌 At a Glance: Ransomware Recovery Success by Recoveo
Victim Company: Plumbing Sector
Threat: MAKOP Ransomware (.makop / .mkp)
Target: MS SQL Database (.mdf / .ldf) and Drive Snapshot Backup (.sna)
Demanded Ransom (Estimated): €15,000 (Unpaid)
Volume of Restored Data: 535 GB
Recoveo Solution: In-house proprietary reconstruction tool developed by our R&D department
Final Result: 100% recovery rate on the database and 99.9% on remaining data.
The Challenge: Encrypted SQL Database and Niche Backup Format (.SNA)
Diving into the company’s infrastructure, one thing became immediately clear: there was no modern virtualization or containerization in place here. The MAKOP ransomware hit right at the heart of their operations by encrypting their primary backup.
What is the MAKOP Ransomware (.mkp)?
According to the Digital Health Agency (Agence du Numérique en Santé), Makop is a ransomware strain first spotted in 2020 and widely considered a variant of the Phobos family. Despite having hit roughly a hundred European businesses, this cybercrime group is generally categorized as a secondary actor.
The Rare Case of Tom Ehlert’s Drive Snapshot Software
The encrypted backup originated from an editor rarely seen in recovery scenarios: Drive Snapshot (.sna format). Rare, yet actively deployed by Tom Ehlert – Software & Consulting—a German firm founded in October 2000 that specializes in real-time disk imaging. Their flagship software, “Drive Snapshot,” has been around since 2002. It is an extremely bare-bones utility whose interface has barely changed since the era of Windows NT or 2000.
Drive Snapshot Interface
Drive Snapshot is something of a cult favorite among system administrators (“sysadmins”): in its home country of Germany, it enjoys a solid reputation as an “unsung hero” among veteran IT technicians.
Its ability to create live disk images on the fly without rebooting, its extreme portability (a single executable file requiring no installation), and its lightweight footprint make it a go-to tool for maintenance scripts—which is likely where it holds its largest indirect market share.
In fact, German industrial infrastructure management firms (such as Ondeso) officially bundle Drive Snapshot licenses into their software suites to automate Operational Technology (OT) backups on industrial PCs and production machinery (spanning legacy Windows NT4 all the way to Windows 11).
Recoveo’s Intervention: Custom R&D and In-House Repair Tooling
To bypass the encryption lock, our teams deployed our new internal reconstruction tool (currently in continuous R&D development).
The initial analysis revealed an excellent survival rate: only 570 invalid (encrypted) pages out of nearly 185,000—representing a raw loss of barely 0.3%.
However, the encrypted header corrupted certain tables, temporarily creating orphaned data.
Listing of critical encrypted client files (.mdf and .ldf) bearing the .mkp extension
Our R&D department then pushed the repair process a step further…
A Proven Alternative to Paying a €15,000 Ransom
Thanks to this surgical approach—which delivers results at least 30% higher than off-the-shelf recovery tools—the client successfully avoided extortion.
Following a new breakthrough from our R&D team, our repair utility revealed 149 additional tables and nearly 400,000 extra rows. Furthermore, every single orphaned data entry was matched and mapped for the client’s validation.
Query test performed on the fully functional database
Final Recovery Rate
100% of data restored as of the last valid backup date (May 16, 2026), delivered alongside a complete ZIP archive of the recovered Drive Snapshot image (535 GB total).
Despite the unprecedented challenge of dealing with a niche .sna backup encrypted by MAKOP, our engineers achieved a 100% recovery rate on the critical database and 99.9% overall. The client was able to resume full operations using data that was less than two weeks old!
Engineer’s Note:
“This case proves that an encrypted MS SQL database is never permanently lost. Even when the database header has been scrambled by ransomware, our specialized techniques allow us to rebuild tables and rows to make the database fully operational again. Additionally, we are actively expanding our recovery capabilities on niche backup formats like Drive Snapshot.”
Overcoming MAKOP Ransomware
This victory was not luck—it was the direct result of deep expertise in Drive Snapshot architectures and emergency database recovery.
Are your SQL databases encrypted or corrupted by ransomware? Just like in this complex Drive Snapshot case, our R&D engineers build tailored recovery solutions to restore your critical data without paying a single cent in ransom.
📞 Request an Emergency Database Recovery Assessment
