Ransomware data recovery: the three routes your files come back by

Hour one: freeze the scene

Disconnect the infected machines from the network (pull the Ethernet cable, turn off the Wi-Fi) and then slow down. The two most damaging moves in the first hour of any attack are both clean-ups: wiping machines to reinstall them, and tidying away encrypted files. Leave servers and NAS units exactly as they are until you have a plan; photograph the ransom note and write down the strange new extension the files now carry. Above all, suspend every scheduled backup right now, because the next automatic run can push encrypted copies over the clean ones you'll want later.

There's one admin task that belongs in the first hour too. Where personal data is involved, UK GDPR may treat the attack as a reportable breach, so whoever is responsible for compliance in your business should hear about it today, not at the end of the week.

Where the surviving data actually is

Copies the malware never reached. Off-site and offline backups, plus version history on the major cloud platforms: SharePoint, OneDrive, Dropbox and Google Drive can all roll files back to the day before. There are also snapshots on the NAS and shadow copies on Windows. Current strains go looking for snapshots and shadow copies to destroy them, but their aim isn't perfect, and partial survivors turn up in case after case.

A decryptor someone has already written. Security researchers and the No More Ransom initiative publish free tools for every family that gets cracked. Work out which family hit you (the wording of the note and the suffix on the renamed files will identify it), then check whether it has been broken. What you must never do is send money to an anonymous 'guaranteed decryption' site: the honest ones are middlemen paying the criminals and adding a markup, and the rest are simply thieves.

Whatever the encryption never reached. Encrypting a company's storage takes hours, and plenty of attacks die early, cut short by a reboot, an alert administrator or their own bugs. Bench work on real incidents turns up secondary volumes that were never visited, older versions of files sitting in unallocated space, VM snapshots the malware treated as opaque blobs, database dumps it didn't understand, and files damaged only in their opening blocks. Finding it all is methodical rather than magical: image every disk, then audit the images file by file.

The ransom question, answered once

We don't pay ransoms, we don't negotiate with the people behind an attack, and we won't do either on a client's behalf. The stance is as practical as it is principled: plenty of payers get a broken decryptor or nothing at all; paying marks your firm as willing for the next gang; official UK advice is not to pay; and where a sanctioned group wrote the strain, the payment itself can be unlawful. Every hour and every pound is better spent on the three routes above, which in most of the incidents we see return more than the victim thought possible on day one.

Report the crime to Action Fraud, and don't throw away the encrypted disks. Ransomware families do get cracked long after their attacks, and a preserved drive costs you nothing but shelf space, whereas a discarded one closes the door for good.

Sending a ransomware job to us

Get a quote first, by phone or with the free online diagnostic, then post or courier in the affected storage. Take the disks out of servers, RAID and SAN systems and label each one with its bay, and don't send the enclosure or controller (a NAS whose disks won't come out can be sent whole). Every disk is imaged before any analysis begins, so no original is ever worked on. You'll then receive a written statement of what's recoverable through all three routes, along with one fixed quote. Ransomware is treated as forensic work on our tariff, so it's paid upfront once you accept the fixed quote, before bench work begins. If the attack is still under way, ring 0800 689 0668 and tell us; live incidents go to the front of the queue.

The ransomware data recovery service page has the full detail, and the hardware most business data lives on has pages of its own: RAID recovery, NAS recovery and SAN and virtual machine recovery.