CouchDB doesn't create .locked files. I am not sure why that is happening. Since you mentioned "restore", since CouchDB doesn't have a built-in backup/restore feature, perhaps it's the software used to restore database files?

@ozgursel you can make sure that the shard files in the _dbs db match up with the shard map. https://docs.couchdb.com/en/3.2.2/cluster/index.html

You can make a new database named differently, (say newdb1) with the same Q sharding factor and see what the _dbs shard doc looks like. Then re-create the clustered db doc for your db to match.

@ozgursel you can read the docs from either the :5986 localhost port (a node-local port) or from the :5984/_node/_local/$shardname paths

@nickva Is it a possible 0-day vulnerability on CouchDB?

As a general (and obvious) note you should not pay ransomware authors but restore from a backup on to a clean, secured replacement server. obviously that is not always an option.

If you have recovered your shard files (shards/000-FFF/blah123.couch, etc) you can recreate the _dbs database manually. The format is not documented but it's fairly simple, an example is below. shard_suffix is an erlang string of the .12345 part of the shard filenames (a list of integers where the ints are ascii values).

If you uncover any evidence to suggest your served was compromised via couchdb we are very interested to hear any and all details.

{
 "_id": "dbname",
 "shard_suffix": [
 46,
 49,
 54,
 53,
 52,
 54,
 51,
 53,
 48,
 54,
 56
 ],
 "by_node": {
 "node1@127.0.0.1": [
 "00000000-7fffffff",
 "80000000-ffffffff"
 ],
 "node2@127.0.0.1": [
 "00000000-7fffffff",
 "80000000-ffffffff"
 ],
 "node3@127.0.0.1": [
 "00000000-7fffffff",
 "80000000-ffffffff"
 ]
 },
 "by_range": {
 "00000000-7fffffff": [
 "node1@127.0.0.1",
 "node2@127.0.0.1",
 "node3@127.0.0.1"
 ],
 "80000000-ffffffff": [
 "node1@127.0.0.1",
 "node2@127.0.0.1",
 "node3@127.0.0.1"
 ]
 }
}

It would be great if @ahmedsaifreza, @paragasu and @ozgursel could tell us which version of CouchDB they are each running, so we can eliminate previously patched security vulnerabilities from consideration.

oh and Operating System and version would help too.