Moreover, for those virtual machine files with abnormal suffixes after encryption, we have retrieved the files from the VMDK disk through data recovery methods. Their underlying layer is only encrypted for approximately 700MB. Therefore, we can retrieve the data from those virtual machine disk files with abnormal encryption. However, this cannot start our original system and can only be reinstalled. So what I want to say is that this has brought us a lot of troubles.