Let’s be straightforward from the start, because this is where a lot of people get misled. The biggest misconception with modern ransomware attacks is that they are ‘decryptable’. They aren’t. That’s what makes them so effective. Anyone who tells you otherwise and will decrypt something for money is usually just paying the attackers behind your back and making a profit at your expense. A true recovery lab doesn’t decrypt data; we find ways around the encryption: snapshots and backups the attacker missed, unencrypted remnants, deleted originals, and known weaknesses in specific variants. We assess ransomware cases honestly for businesses and individuals across the UK, and tell you plainly what can and can’t be recovered.
Strong encryption cannot be broken. Recovery from ransomware attacks means recovering the copies, snapshots and fragments (remnants) that were missed by the ransomware attack.
Ransomware uses powerful encryption (the same kind used for online banking) to lock up your files. Then, the cybercriminal will demand money from you to unlock them. Breaking this type of encryption directly is virtually impossible (if it were possible there would be no ransomware). Therefore, when an organisation guarantees to “decrypt” your files as part of their “recovery” services, be extremely cautious of these organisations. In most cases, the “recovery” company is actually secretly negotiating with the ransomware attackers and paying them the demanded amount. Once they have obtained the decryption key, they charge you a premium for this service without telling you. This is not recovery. And by paying the “recovery” companies you are financing future attacks.
Legitimate ransomware recovery is very different, and more honest. Legitimate ransomware recovery seeks out all avenues to restore access to your data that don’t involve using the decryption key provided by the attackers. These include: the previous versions of your files stored on snapshots or shadow copies that the attackers did not delete; backups that remained intact and unaffected; unencrypted remnants and temporary copies of data left behind after the attack; and deleted original files often left behind after a ransomware infection. Some ransomware families also contain a known weakness that results in the availability of a free decryption tool. Legitimate ransomware recovery may be able to restore all of your data, some of your data or, honestly, very little. Regardless, we always provide you with a straight assessment of which avenues are viable for your situation.
We image everything first. We do this before we ever touch anything. Forensic images are taken of all disks that have been attacked, and thus preserve any evidence and how things currently stand, as well as what routes might exist to get back into the data. All work is done on a non-live system.
We hunt for snapshots and shadow copies. Many ransomware attacks will attempt to remove all Windows Volume Shadow Copy files and snapshot files for NAS or VM systems, however they do not always succeed. When there are still valid snapshot files available (on a NAS, a virtual machine or a server), these can provide an entire route back to your original files.
We recover deleted data (originals & remnants). A good number of ransomware attacks work in this way: the attacker encrypts a copy of the file(s) and deletes the unencrypted version, or leaves partially-encrypted files and temporary copies behind. When a ransomware attack has been completed, many times those deleted originals and remnants are still on the disk and can be recovered.
We check for known decryptors. Certain ransomware types contain bugs, or their decryption keys have been identified by security researchers (including those on the No More Ransom project) and made public. We identify the strain and check whether a legitimate, free decryptor has been developed for that particular type, and if so we will use it.
We reconstruct from backups. Where there are surviving backups (even ones you’d forgotten, or that were partially hit), we will restore and rebuild using them, saving as much of the most up-to-date information as possible.
Let’s get real for a moment: no one can break strong encryption, no matter how skilled they are. If the only copy of a file had been encrypted, and we have determined that there isn’t a previous snapshot, backup, remnant or decryptor for the particular strain of ransomware used against you, then that file may not be recoverable. We’ll give you that answer honestly rather than take your money to chase the impossible. Other than that, here are a few things to do and not to do while you make up your mind about what you want to do next:
Don’t pay the ransom. Paying a ransom will fund organised crime, identify you as someone who has paid a ransom and may encourage future attacks by criminals. The key that unlocks your data after paying a ransom does not always work or may not ever be provided. The National Cyber Security Centre and law enforcement agencies have stated publicly that payment of ransoms is discouraged.
Never wipe, reset, reinstall or restore over an affected system before creating an image of it. Every possible path for recovering your files (including snapshot copies, remnants and deleted originals) exists on those hard drives, and destroying those paths with a “wipe” or similar action removes all options for file recovery.
Do isolate affected computers from your network to prevent further spread; however, leave them powered and otherwise untouched. Do report this incident to Action Fraud (or to the Gardaí in the Republic of Ireland) and, for businesses, also to the NCSC. Once you have reported the incident, allow experts to assess the disks before any drastic measures are taken.
No matter what type of system ransomware infects, each type has its own paths to recovery. When ransomware encrypts servers or virtual machines, sometimes the host-level snapshots or the underlying storage could provide access to your data again. NAS boxes have been popular targets for ransomware, and their built-in snapshots are often able to survive even when the box itself has been encrypted. In addition, if ransomware encrypts SQL and Exchange databases in place, we can restore them from previous versions, backup files or fragments. And then there are plain old PCs and laptops that have been infected by ransomware. The first places we go looking on those are the deleted originals and shadow copies. Whatever type of system was impacted, we will help determine the specific options available to you.
We begin with a free, confidential assessment. During this time we will: identify the strain of ransomware, make an image of all impacted systems and honestly identify the realistic pathways for recovering your data (snapshots, backups, remnants, deleted originals or a known decryptor) prior to providing a fixed written quote. Since most attacks on businesses stop operations completely, we provide a priority and emergency service, with NDAs and confidential handling as standard. Our pricing model is based upon a per case basis. We would also like to point out that we do not consider paying a ransom as part of the “recovery” process. We can recover your data directly off the original drives or through images, and we support both businesses and individuals throughout the UK and Ireland.
Almost never directly. Be very suspicious of claims of direct decryption by anyone. Modern ransomware uses advanced encryption algorithms that cannot be broken, therefore most “recovery” services that guarantee they can decrypt files are actually secretly paying the ransom for you and will charge you even more than what was paid to the hacker. There are some alternative ways we can recover your files without needing the hackers’ key; those include recovering from surviving backups/snapshots, using any leftover unencrypted remnants, finding deleted originals, and using free decryptors that are designed specifically for strains of ransomware with known flaws. We’ll tell you honestly which of these apply to your case.
No. This is also the view of law enforcement and the National Cyber Security Centre. Paying funds organised crime: if you pay criminals to unlock your encrypted data, then you become another ‘payer’ who they are more likely to attack again, and there’s no assurance that the key (if it comes) will work. Only consider paying the ransom as a genuine last resort, if ever, when all other recovery options have been assessed. Let us look at what can be recovered first.
Often, yes: it’s well worth assessing before taking any extreme action. Many servers, NAS units and virtual machines have snapshots that attackers were unable to remove, and there could be older versions of your data, backups or remnants stored on the disk. Do not wipe, reset or restore over the systems until they are fully imaged. The reason is that this will erase the potential paths for us to follow. Isolate them completely; leave them alone; allow us to assess.
Sometimes. There are a number of types of ransomware that have been cracked or had keys released. In addition to this, there are also some free legitimate decryption tools that were created by security researchers and made available on the No More Ransom project. One of the first things we will do is find out exactly what type of ransomware attacked your computer and then determine if a valid decryption tool exists; all of these tools are free in cases where they apply.
Not before the systems are imaged. If your backups are known-good and complete, restoring from them is often the right end result, but when you wipe the original system first, you lose all other paths such as snapshots, remnants and deleted originals. After wiping the original system, your only path to recovery would be the backups themselves. If those backups were incomplete or also affected by the malware, your other chances of recovery would have been eliminated. In short, image the systems first, then check the backups to see if they are good and complete. Only after verifying them can you start restoring the systems. This is the difference between having only one choice versus multiple choices.
Yes to both questions. Our lab is located in Belfast; however, our ransomware recovery services are carried out either via post or from images (we do not collect), so we support businesses and private individuals throughout the UK and Ireland, with NDAs and strict confidentiality as standard, which matters for incidents such as these. Please contact us and we will deal with your matter discreetly and quickly.
The cost depends on what has been preserved (shadow copies, snapshots, backups or carvable data), so this process begins like all jobs here: free diagnostics to determine feasibility, and a fixed written quote prior to making any commitments. A single laptop or PC drive fits into our standard drive bands from £300 + VAT. Encrypted servers and NAS units start from £500 + VAT. Whatever your quoted price is going to be, it’s going to be a fraction of your ransom demand, and paying that is the one thing we will always talk you out of.
Isolate infected systems. Leave them alone. Get in touch. We’ll analyse the malware type, create an exact disk image of each system, and advise you plainly on which recovery options are viable. We will provide a fixed quote based upon our analysis prior to charging you for any work. We also offer a priority service, and there are no decrypt-for-a-fee games.