Ransomware has locked up your files and now wants money in exchange for a password; however, there are many ways out of this situation besides just giving in and paying (which may end up being the most costly). We will identify the strain and attempt to restore as much of your data as possible. This includes: decryptable versions of the virus; any shadow copies that may exist; any backups; and any other unencrypted data. All of these items will then be preserved for your insurance company and investigators. First, prior to even considering payment, we provide you with a completely complimentary assessment of what can possibly be restored.
As soon as you realise you have been infected with ransomware, immediately disconnect all computers that were affected by the virus: remove them from the internet or network and keep them away from all backup systems to prevent further damage. Do not reformat, rebuild or delete anything at this time. Do not send money to try and get an unlock code or decryptor; it does not guarantee you will receive one after sending the money, and it also finances future crimes. Keep the ransom demand letter or email and a few of the files that have been encrypted and contact us. We will determine which type of virus was used initially, and some viruses can be unlocked for free.
Today’s ransomware attacks do more than just encrypt a couple of files. It propagates through all drives attached to the computer system, searches out your data backups, and attempts to disrupt those processes critical to maintaining operation at your workplace or business. This is the most common type of case that we see.
First, in order to determine which family of ransomware was used (and which specific variant), we have to identify both from the ransom note and a few encrypted files prior to making any moves. There are free or known decryptors that exist for certain strains, but with the current “big” families of ransomware, the encryption method has been designed so that you cannot break it; therefore, in these cases, we will attempt to restore via shadow copies, backups and unencrypted data.
We always do strain identification first: we check for any free decryptors on the No More Ransom project (run by Europol and police to publish free decryptors) as well as our own tool(s). We will honestly tell you what is recoverable before we start work.
We recover data that has been hit by ransomware across every major operating system platform including servers and NAS platforms (Windows, macOS and Linux) and also their virtual environments. If ransomware has reached it then the odds are we can help.
Desktops, laptops, workstations; physical and virtual servers; NAS and SAN systems; current and older versions of Windows, macOS and Linux.
The methodology behind our approach to ransomware relies on one fundamental principle: get your data restored without providing funding to the attacker. Ransomware remediation is specialised work, and it begins in exactly the same manner each and every time: first identify the strain, then do not pay blindly. All relevant information collected during the initial assessment is preserved as potential evidence and all recovery attempts occur only on read-only versions of the compromised system. Further, we will attempt to restore data through all possible means including using available decryptors when applicable, shadow copy restoration where available, restoring from backup systems where they were created in an uninfected state and finally recovering any remaining unencrypted data.
Explain what happened. We determine the strain of ransomware based on the ransom demand note sent during the attack and a few sample encrypted files. We will also determine if there is a functioning decryptor available for this particular strain of ransomware.
We create exact, read-only copies of the hard drives that have been damaged in some way. The original hard drive(s) are kept as evidence and never altered during our recovery process.
We identify all potential routes of data recovery: using a known decryptor, accessing Windows shadow copies, searching for backup data (offline, online or cloud), finding unencrypted fragments and performing file carving.
We can use a decrypter (if available) if you have an older ransomware strain; otherwise, for all current strains including LockBit, Akira and BlackCat, nobody can decrypt the files, and that includes us. These strains are encrypted using AES-256 along with an RSA-wrapped key. We will therefore recover your data around the encryption layer, i.e. original files which were deleted but not encrypted by the malware, shadow copies, partial file recovery etc.
Once we find and recover your missing files, databases and virtual machines we begin rebuilding them from the most critical items your business requires restored first.
A list is created of all recovered data and it will be sent to you via email. You review this list carefully, then the data is duplicated onto an external drive.
All recovered data is returned to you on new storage devices or media or transferred securely for smaller volumes of data so that you can restore your systems.
We will retrieve ransomware affected data from servers, NAS, RAID arrays, virtual machines and workstations: we identify the ransomware type; preserve evidence; and restore your data using all viable routes to do so.
Tell us what happened and we’ll get back to you, usually within a working day.
We’ll be in touch shortly. If it’s urgent, call 0191 406 1051.
There are no hidden fees or hard sell; you get a written quotation prior to any work being done.
We have recently successfully recovered data from several ransomware attacks on servers, NAS devices and workstations. We cannot disclose specific information about these attacks but can provide you with general details.
The ransomware had a known vulnerability. We created an image of each disk read-only, applied a decryptor, and then were able to fully restore both databases and file shares.
The ransomware could not access our client’s NAS snapshots; we were able to restore both the encrypted files (as well as the unencrypted parts) completely from the snapshots.
Because of the lack of direct decryption capability, we were forced to restore the majority of the files using Windows shadow copies and an older off-line backup and also from un-encrypted file fragments.
When you send the unit in for its free diagnostic, let us know what happened with the unit. An engineer will review the unit and confirm your quote in writing prior to starting on your recovery.
Before you post or drop off your device, please get a quote from us by phone or with the form. Once we receive your device, our recovery process can start. Safely pack your device, include your name and contact information within the packaging and ship it to us. After performing your free diagnostic, we’ll send you a written confirmation of the exact price of our services prior to starting any work.
If you decide to post it, we would advise using a trackable and insured postal service. Or if you prefer to drop it off, we are open Monday to Friday, 9am to 5:30pm, and you don’t need an appointment. Just pack the unit as described in step one before dropping it off.
Would you like a little more background information prior to sending it? Fill in the form to provide more details about your problem; an engineer will evaluate it and reply with a customised quote.
We’ll be in touch shortly. If it’s urgent, call 0191 406 1051.
Common questions that people have asked us about ransomware after they’ve been attacked by ransomware.
Often, yes. It really just depends on the type of ransomware. Some types of ransomware are decryptable while others aren’t. When a particular type of ransomware cannot be decrypted, there is typically some other method for recovering your data: either through Windows shadow copies, back-ups stored offline or in “the cloud”, or even just by restoring the un-encrypted portions of the data that were left on the hard drive. An assessment will provide you with a good idea of whether or not it will be possible to recover your data.
We would always recommend getting an assessment done before making any payments. There is no guarantee that paying for the decrypter keys will allow you to access your data. Additionally, when you make a payment to a hacker it sends a message to them that you’re willing to do business with them again. Also, many times the attackers will use those funds to fund their next attacks against other victims. In many cases we recover the data with no payment to the attacker at all.
Sometimes we do this directly. There are some strains with well-known flaws in their code or keys that allow us to decrypt your files for free. If you have an intact encryption and no breakage in the encryption, we will be unable to use these methods and therefore will pursue other avenues such as recovering your data from your backup(s), Windows shadow copies, etc.
Yes. Many ransomware attacks miss backups that are located either offline or off-site; they also miss NAS snapshot(s) it cannot access. Additionally, even though backups may be affected, there is usually still earlier version(s) available to recover along with un-encrypted data. Stop immediately using the system(s) and contact us before any overwrites occur.
After determining which ransomware family has infected your computer based upon the information contained within your ransom note and a few samples of your encrypted files, we will determine if there are any free decryptors available. These include those that have been made publicly available via the No More Ransom project. Regardless of what type of strain you’ve been infected with, we will consider all available paths for potential recovery, not limited to decrypting your files.
Yes, this is our speciality (encrypted servers, virtual machines, NAS units and RAID arrays). After imaging each disk, we will rebuild any necessary arrays and recover your databases, mailboxes and file shares.
Completely. Any case involving ransomware is treated as confidential, and we are happy to sign an NDA if that is what you require. It is your data and the fact you have been attacked which remains between us.
Our normal pricing structure is a flat rate for each single drive (starting at £300 + VAT for a one-disk system), with individual quotes provided for each ransomware incident based upon the specific strain of ransomware used, volume of data affected, and number of systems involved. All quotes are in writing prior to commencing any work; there are never any “surprises”.
Our drop-off hours are Monday to Friday, 9am to 5:30pm, at our Newcastle office. Alternatively you may also send them by post (fully insured). If you have a server or NAS unit simply remove all hard drive(s), label each one with either its original order number or bay number, include your contact information so we can book it in and prior to any work being done we will inspect the units.
Protecting yourself is not glamorous; it’s protecting your data with offline or older versions of files that cannot be accessed by the malware, updated systems, and a healthy dose of scepticism when receiving emails with attachments. If the damage has already been done, disconnect the infected system from your network. Don’t install clean software over the only copies. And do not rush into paying ransom. Deliver the hard drives to us. Between shadow copies, backup archaeology and unencrypted remnants, there may be more recovered than indicated on the ransom demand itself. The free diagnostic will provide an honest assessment of what exists prior to making a final decision.
Yes, this is quite normal. Our engineers will typically work directly with your insurer and/or their appointed incident response or breach team as part of the process, as opposed to working around them. The reason we are able to achieve this is due to the fact that all forensic images taken by us are done so in read-only mode. This means that nothing we do during the recovery process affects the integrity of the original evidence which your insurer and/or investigators need. As such, we can also document the strain, which systems were affected and exactly what we were able to recover for your claim. If you have cyber insurance please let us know at the earliest possible time. Some policies may include requirements to use an approved provider or specific steps etc., and we will adapt accordingly.
First we identify the strain of ransomware; then we provide you a written quote based upon that information; and then we can begin recovering files from your server(s), NAS and workstation(s) while preserving evidence for your insurance company. Contact us now.