Linode MySQL Data Recovery

My Linode-hosted Linux server fell victim to ransomware. The machine is still up and reachable by SSH, but the attacker wiped my MySQL data directory. I have no usable backups, so I need someone who can dig into the volume itself—ext4 file system at /dev/sda—locate any remaining InnoDB or MyISAM files, and reconstruct the missing databases.

All databases were targeted, so I will give you the exact schema names and paths that matter. Everything else on the server can be ignored as long as we get those tables back.

I can grant you temporary root access, enable rescue mode, or provide a cloned block-storage snapshot if you prefer working offline. Feel free to employ Sleuth Kit, TestDisk/PhotoRec, foremost, or low-level hex tools—whatever gives us the best shot. Once recovered, please export the data to .sql dumps and place them in /root/recovered-dumps, then tell me how to restore them cleanly.

Deliverables
• Recovered MySQL databases (SQL dump files)
• Brief log of steps/commands used, so I can audit and repeat if needed
• Two or three hardening recommendations to prevent a repeat attack

I’m ready to start as soon as you are and can stay online to reboot into rescue mode or provide any disk images you require.