Ransomware data recovery

Files renamed with a strange extension, a ransom note on the desktop, shared folders that no longer open. What you do in the first hour decides how much can be saved.

Get help now Call 020 7237 6805

First steps

Disconnect. Unplug affected computers from the network and switch off Wi-Fi. Disconnect backup drives and NAS units that are still clean.
Do not wipe or reinstall yet. The encrypted disks are the evidence and the raw material for recovery.
Do not pay. Payment does not guarantee a working key, and it marks you as a target.
Keep the ransom note and a few encrypted files. They identify the strain.
Check your backups from a clean computer, not from an infected one.
Call us on 020 7237 6805 before trying recovery tools.

What recovery is realistic

It is important to be straight about this. Modern ransomware uses strong encryption, and for most current strains the files cannot be decrypted without the attackers' key. Anyone who promises otherwise before seeing the data should be treated with caution.

That does not mean everything is lost. Recovery usually comes from one or more of these routes:

Known decryptors

Some strains have flaws, and free decryption tools exist for them. Identifying the strain is the first step.

Backups and snapshots

Offline backups, cloud version history and NAS snapshots are often intact even when the attackers tried to remove them.

Deleted originals

Some ransomware writes an encrypted copy and deletes the original. On hard drives, those deleted originals can often be recovered.

Partly encrypted files

To work fast, many strains encrypt only part of large files. Databases, virtual machine disks and archives can often be repaired or have their contents extracted.

Unaffected disks

Drives, partitions or machines the attack did not reach, or did not finish.

We copy the affected disks first and work only on the copies, so nothing is made worse. Recovery starts with a professional evaluation, charged at £94.80. It tells you what has failed and what can be recovered, and you then receive a fixed price for the recovery itself.

For businesses

If personal data has been affected, a business may have to report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it. Attacks should also be reported to the police through the national fraud and cyber crime reporting service, and the National Cyber Security Centre publishes guidance for organisations.

Once the data is safe, the systems have to be rebuilt, not just cleaned: the attackers had access before they encrypted anything. We can reinstall from clean media and restore the recovered data. Passwords should be changed throughout, and the route the attackers came in by has to be found and closed. Creative IT (UK) Ltd is itself registered with the ICO, registration ZA060744.

Common questions

Can you decrypt my files?

Only if a working decryptor exists for that strain, or the key is obtained. For most current ransomware neither is the case, and recovery comes from backups, deleted originals and partly encrypted files instead.

Should we pay the ransom?

Our advice, like that of UK law enforcement, is not to. There is no guarantee of a working key, and the decision has legal and insurance implications. Speak to us and to your insurer first.

Our backups were encrypted too. Is there any hope?

Often there is. Backup files are large, so they are frequently only partly encrypted, and NAS snapshots or deleted backup sets can sometimes be recovered.

It is a home computer, not a business. Can you still help?

Yes. Switch it off, do not pay, and contact us. See also viruses, pop-ups and scam warnings.

Get a price from a technician

Tell us the make, the model and what has gone wrong. A technician replies with a price and the quickest way to get your laptop to us – normally the same working day.

020 7237 6805

Creative IT workshop
Unit 1, 80 Willow Walk, London SE1 5SY
Monday to Saturday, 9am–6pm