c3rb3r-btrfs-recovery skill
A skill that helps Synology and Btrfs NAS owners recover their own files after the C3RB3R (.L0CK3D) ransomware without a key.
- 51 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Operation needs root SSH access to the NAS holding the data, and the sample pipes the sudo password through input.
- A mistaken operation on a volume with encrypted data can reduce the chance of recovery.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/c3rb3r-btrfs-recoveryDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Operation needs root SSH access to the NAS holding the data, and the sample pipes the sudo password through input.
- A mistaken operation on a volume with encrypted data can reduce the chance of recovery.
This is third-party code. Review the repository files before installing.
What it does
The skill guides an agent through recovering data on a Btrfs NAS after the C3RB3R ransomware, which renames files to `.L0CK3D`. The ransomware overwrites a file in place and encrypts only part of it: small files entirely, large ones about 12 percent. Btrfs copy-on-write leaves old data blocks on disk while the unencrypted part of the file still references them. The agent proceeds in order: checks whether the encryption process is alive and whether a key can be pulled from memory, runs an environment self-check, determines the attack generation, validates the method on a known original, surveys all files, streams the export and verifies it against Btrfs checksums. Only read-only scripts run on the NAS, and results are written to another disk.
Who it is for. Administrators and owners of Synology DSM and other Btrfs NAS whose own files were encrypted by C3RB3R and who have no backup or snapshots.
Good fit when
- Files on the NAS gained the `.L0CK3D` suffix with a `read-me3.txt` note beside them
- There are no backups or snapshots and no key either
- The ransomware already stopped after a reboot and a key can no longer be taken from memory
- You need to check what share of photos and documents is recoverable before exporting
- Recovery must be confirmed against Btrfs checksums
Not a fit when
- The ransomware is still running: the author advises freezing it and pulling the key first, which recovers all files
- The file system is not Btrfs: the method relies on copy-on-write
- You want to recover someone else data without rights to it: the skill is for your own data
Example request
My Synology was encrypted last night, files became `.L0CK3D` and there are no backups. Check whether data can be recovered and start with an environment self-check.Limitations
The method cannot return small files up to 1 MiB encrypted whole, database files and data written after the last snapshot on volumes without copy-on-write. Results depend on the attack generation and what remains on disk. Running on the NAS needs root access over SSH, and the sample command pipes the sudo password through input, so work on a trusted network. Operations are read-only, but the author warns of risks and asks you to preserve evidence and validate on one known file first. The README is in Chinese with an English summary.
How to disable. Delete the `c3rb3r-btrfs-recovery` skill folder from the agent skills directory. Job files and exported data are stored separately, so remove them after verifying the result.
FAQ
How do I install the skill?
Run `npx skills add crt106/c3rb3r-btrfs-recovery`, add `-g` for all projects or `-a claude-code` for one agent. You can also copy the `skills/c3rb3r-btrfs-recovery/` folder into the skills directory manually.
What if the ransomware is still running?
Freeze the process with `kill -STOP`, do not kill it or reboot the NAS. A live process memory can yield the key to decrypt everything, as two third-party repositories in the README describe.
What will the skill not recover?
Small files under 1 MiB encrypted whole, database files and data in non-copy-on-write shares written after the last snapshot.
Does the skill change data on the NAS?
No. Operations on the NAS are read-only: ioctl queries, reading files and the block device, with results written to another disk.
How do I verify the recovery is correct?
Validate the method on a file whose original you hold before bulk export. The skill confirms the result against Btrfs block checksums.
Discussion
No questions or reviews yet.
Related
SkillsA cyber threat intelligence and OSINT skill: structured investigations, domain and breach recon, analyst-grade reports
A skill that finds Brotli decoder copies hit by CVE-2026-111497 in projects and container images and says what to update.
122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
REx@Skill
REx-skill
Claude Code skill that finds and proves defects in compiled binaries using seven subagents and a pinned toolchain.
A skill with Claude Code, Codex and Kiro adapters that writes, tests and deploys remediations for AWS Automated Security Response.
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
README in short
The README explains the principle, shows the first case result, lists what cannot be recovered, gives installation through the skills CLI and describes scripts for the NAS and the local machine. A warning up top covers what to do if the ransomware is alive.
README badge
Original SKILL.md
--- name: c3rb3r-btrfs-recovery description: 恢复被 C3RB3R / Cerber 系勒索软件（文件后缀 .L0CK3D、勒索信 read-me3.txt）加密的群晖（Synology DSM）或其他 Btrfs NAS 上的数据，无需密钥：利用 Btrfs 写时复制留下的旧 extent 逐字节还原原文件，并用 Btrfs 校验和逐块证实。覆盖 CoW / NoCOW 判定、子卷快照代数（lastsnap）效应、extent 树精确重组、大文件跨 extent 推测、统计、导出、验证和报告。只要用户提到 NAS / 群晖 / 黑群晖 被勒索、.L0CK3D、read-me3.txt、C3RB3R、Btrfs 文件被加密想恢复、"没有备份没有快照怎么救"，即使没提 Btrfs 或 extent，也应使用本 skill。Use for ransomware recovery of .L0CK3D files on Synology/Btrfs volumes without the key. --- # C3RB3R 勒索后的 Btrfs 无密钥恢复 ## 这个 skill 解决什么 C3RB3R 用 ChaCha8 只加密每个文件的一部分：小文件整体加密，1–5MB 的文件只加密前 1MiB，更大的文件加密三段、共约 12%。加密后在文件末尾追加 588 字节，再改名为 `*.L0CK3D`。没有密钥就解不开，但**它是原地改写文件的**。只要满足下面任一条件，这次改写在 Btrfs 上就会写到新位置，原始明文留在旧 extent 里： - 共享是 CoW（DSM 建共享时勾选了"数据校验和"）； - 共享虽是 NoCOW，但数据写入早于该子卷**最后一次快照**（快照即使后来删掉了也算）。 旧 extent 只要还被文件中未加密的那部分引用，就不会被释放，原始字节也就一直在盘上。我们直接读块设备把它取回来，再拿 Btrfs 自己存的校验和逐块证实。 参考成果（第一个案例）：homes、photo 等 CoW 共享找回 35,445 个文件（229.9GB，经 SHA 核对与解码验证）；NoCOW 共享中 2024 年 6 月快照前写入的部分又找回约 1 万个可精确还原的文件。精确恢复的部分在开启校验和的共享上抽检约 20 万个 4K 块，全部与 Btrfs 校验和一致。 先读 `references/principles.md` 了解原理。遇到环境或设备问题查 `references/compatibility.md`，遇到结果异常查 `references/pitfalls.md`。 ## 第 0 步：先判断还有没有"拿密钥"的窗口（只有几小时） **加密进程可能还在跑。** 如果攻击就发生在几小时内，用 `ls -l /proc/*/exe 2>/dev/null | grep deleted`、`ps` 查有没有可疑进程，例如公开案例里的 `/usr/bin/libgld -n 308`。如果有，**先 `kill -STOP` 冻结它，不要 kill，也不要重启**，然后按公开救援项目从进程内存里取会话主密钥： - https://github.com/soimy/c3rb3r-rescue - https://github.com/Benjamin-zlt/c3rb3r-baremetal-rescue 这是唯一能把文件全部解开的路线，比本 skill 的收益大得多。 进程已经退出（重启过，或事发已十几小时）时，内存路线基本无望。第一个案例对 16.7GB RAM、zram、磁盘 swap 做了逐字节 AES 密钥扫描，又拿内存中 194 个 ChaCha 状态对 77.8 万个文件试解，结果都是 0。此时直接进入下面的 Btrfs 路线，不要在内存上反复投入。详见 `references/c3rb3r-format.md`。 ## 安全红线（关系到恢复能否成功） 1. **不删除、不移动到别的卷、不覆盖任何 `.L0CK3D` 文件，不清空回收站。** 旧 extent 靠密文文件"拽着"才没被释放，删掉密文就等于销毁原件。 2. **不做 defrag、balance、`btrfs check --repair`、rescue，不运行来源不明的"解密器"。** defrag 会重写 extent。 3. 恢复期间尽量减少卷上的写入：暂停 NVR 录像、下载、Photos 索引、同步任务。NAS 重启或 DSM 升级本身不会破坏被引用的旧 extent，但会丢掉内存现场，并带来大量写入。等导出完成后再做。 4. 恢复结果写到 **NAS 以外**的盘，绝不回写原目录。 5. 所有 NAS 端操作只读。用本 skill 的 `scripts/c3r_btrfs.py`，它只做查询、读文件和读块设备，临时文件只放在 `/tmp`，用完删除。 6. 汇报要诚实："精确恢复 + 校验和证实"、"推测后解码通过"、"失败"必须分开写，候选不等于恢复成功。 ## 工具 | 文件 | 在哪运行 | 作用 | |---|---|---| | `scripts/c3r_btrfs.py` | NAS（root，Python 3.6+ 标准库） | `preflight`（环境自检）、`env`、`gens`、`survey`、`extract`（可用 `--variant prev\|next\|both` 只导一种候选）、`patch`（只导出推测段另一侧候选的数据）、`csum`、`plan` |