Ransomware encrypts your files and demands payment for the key. The reality of all currently popular strains of ransomware is that once encrypted, there is no way (at least with today's technology) to "break" the encryption. However, we can recover the data ransomware frequently overlooks, which includes: shadow copies, unencrypted remnants of files, files located on unaffected drives and anything left behind by a partial or failed encryption. Prior to charging you, we will give you our honest in-house assessment as to whether we believe your case has potential.
Isolate infected computer(s) from the network as soon as possible to prevent further attacks. Do not wipe/reformat the infected machine(s). Many ransomware programs leave behind some form of shadow copy or unencrypted piece of data. Also, many times the attacker will not encrypt all of the files on the computer. In addition, if an attacker partially encrypts a file/data set and fails to complete the encryption process then some parts of that data set/file may remain readable. If you wipe/reformat the infected machine(s), you run the risk of losing these recoverable pieces of data. Take pictures of the ransom demand message, and save several pieces of encrypted files/samples. These items will assist us in identifying the type of ransomware used to infect your machine. Then talk to us.
While ransomware may encrypt your files/documents/photos/etc., it also does other things to your system which allow for recovery opportunities. Below is a list detailing what typically occurs during an attack and where your data may reside even though it is currently inaccessible.
First, we determine whether we know exactly the type of ransomware variant and its version from the ransom demand message and two encrypted files. Older variants of ransomware exist where a free or known decrypter has been identified. Most modern ransomware families' encryption methods have become virtually unbreakable, therefore our efforts shift to finding shadow copies, backups and un-encrypted files instead. We will honestly let you know immediately after completing your evaluation which of these options apply to your situation.
Windows PC/laptop, Macs; external & portable drives; NAS/network share; physical/virtual server
Ransomware will almost always reach beyond the first device, therefore we operate on whatever it has reached: PC/laptop/external drives/NAS/servers etc.
Workstation/desktop PC/laptop. Servers (physical & virtual). SAN/NAS storage. Windows/macOS/Linux. Old releases/new releases.
Our ransomware recovery process is based on honesty and evidence. We determine the strain of malware. We image all files as read-only. We recover from each and every direction possible without using encryption-breaking techniques, since with the majority of malware strains this is not feasible.
Send us your ransom note. And send us some sample encrypted data. We can then determine the strain of malware and inform you clearly whether or not we can recover anything prior to charging you.
We image all of the original data (drives) as "read-only" in an offline environment; this ensures the malware will not be able to spread and no alterations made to the original data will occur.
For some types of ransomware there is a valid free or well-known decryptor available. If such exists for your type of ransomware, we will utilise it; however, under no circumstances do we make ransom payments.
We search for any remaining backup locations which may have been created via Windows shadow copies ("Previous Versions") and/or local backup methods which were attempted to be deleted by the malware.
Additionally, where the malware was unable to encrypt completely, many files remain unaltered and can be recovered. Furthermore, we can recover clean versions of those files on the drives that the malware missed.
When necessary, we will restore file system functionality and confirm that all items that were restored will open properly.
The scanned clean data that has been restored to new media is now ready to restore from.
We use our tools to recover data left behind by ransomware across PCs, servers, NAS & external drives, including shadow copies, backups and un-encrypted data, always from read-only images, and give an honest account of what can be recovered and what cannot.
Please provide an explanation of how things went wrong and one of our engineers will contact you, usually by the end of the next working day.
We will get back to you soon. If it is urgent, call 028 9002 0144.
This process begins with a free assessment and a fixed written quote. Drive pricing varies per drive, starting at £950 + VAT for a one-disk system, while bigger and multi-disk systems are quoted case by case. In most cases you will only pay if we recover your data. We never pay ransoms ourselves and do not recommend or encourage customers to pay any ransom.
Examples of several ransomware attacks on multiple systems, including the type of system affected (with customer names removed) and an indication of the level of recovery possible without cracking the encryption.
The attackers used unbreakable encryption; however, they failed to delete the shadow copies of the data. As such we were able to restore most of the data from these backup copies.
They had disconnected their NAS before the attack was complete. In addition to restoring all of the unencrypted shares, we also restored earlier versions of other shares.
There was a legitimate decryption tool available specifically for this version of ransomware. We made an image of the infected drive and were able to decrypt the files without making any payments.
What our actual customers say about recovering their business from a ransomware attack.
Don't worry, there are no fake reviews here! As soon as we get a new verified, named review from one of our clients based in Belfast, we'll add it to this page. Until then, please don't hesitate to give us a call and speak directly with an engineer at 028 9002 0144 for any further information regarding your specific issue.
Send or drop off your item for a free diagnostic check with a description of the issue. One of our engineers will review the item, then provide you a written quote prior to doing any repairs.
Prior to sending or dropping off your device for a diagnostic test (free), obtain a quotation from us via telephone or using the provided form. Step one: get the device to our Belfast bench. Carefully wrap the device and include your contact information inside the parcel. Then send it over. There is no charge for this diagnostic service. Once we receive it, you will be given a firm written price to confirm whether you wish to go ahead, before any work is done.
Sending it? The use of a tracked, insured delivery method would be recommended. Alternatively, dropping it off can also be done Monday to Friday, 9am–5:30pm; no prior booking required but do ensure that all items are packed accordingly.
Still waiting to send something? Please complete the form describing the failure/fault in your own words and one of our engineers will get back to you with a quotation based upon your individual circumstances.
We will get back to you soon. If it is urgent, call 028 9002 0144.
The most common questions we are asked about how to recover from a ransomware attack.
No, for the present strains of ransomware. Any organisation telling you they can is either lying or does not know what they are doing. Modern ransomware attacks utilise encryption which cannot be decrypted without having access to the decryption key. However, in cases where a legitimate decryptor still exists for earlier versions of ransomware, we will attempt to decrypt using such tools. In addition to these options, when attempting to determine what was encrypted, and what was not, we also look at data which has been backed-up prior to the time the malware ran. This includes Windows shadow copy and other backup methods, and even unencrypted data.
We would advise against paying the attackers directly. Not only do we not advocate paying them, but we never pay them on a client's behalf. As well as providing no assurances that the attackers will provide a working decryption key, paying them provides the attackers with both money and assurance that you have value to attack. Therefore, let us evaluate your situation and see how much data can be recovered without payment, sometimes a lot more than anticipated.
More times than expected. Often the strain of ransomware fails to properly remove backups and the shadow copies created by Microsoft on Windows systems. Other times partial encryption occurs before the malware stops running and/or drives that were offline or missed during the attack remain intact. All of this data can be used in the recovery process. The amount of recoverable data depends on the specific circumstances of each individual case.
Yes. In terms of how common it is for attacks to cross multiple servers, NAS boxes and network shares, that is a significant portion of the work we do. Once an attack occurs, we then take images of those affected systems as read-only, so that we may be able to recover anything that was not encrypted or deleted by the attackers.
It is impossible to provide an accurate answer to this question regarding ransomware. It will depend upon the specific strain used in the attack and what damage was done during the time the system was infected. What we promise is an honest evaluation (at no cost) prior to starting any work, and in most cases you only pay if we recover your data: if we are unable to recover any valuable data, then you would not have paid us for the services provided.
Our pricing is per disk. For single disk units, pricing starts from £950 + VAT. Larger multi-disk units and other systems will be priced separately once the free assessment has been completed. Our fixed price quote will always be made available in written form prior to commencing any work. Additionally, we do not pay ransoms; therefore, you should never expect to see any money going directly to an attacker.
We use several methods to quickly determine which type of ransomware has attacked your computer. These include the information contained within the ransom demand itself along with a couple of example files that have been encrypted. With that said, simply drop off your affected unit(s) or post them (with insurance) to our office here in Belfast, and include your name/contact information somewhere in the packaging. Do not wipe these computers, simply disconnect them from your networks.
While there are some other ways to protect yourself against ransomware (e.g., keep all systems patched and do not open suspicious emails/attachments), the best way is through the boring practice of keeping either a backup completely offline or having a “versioned” backup of everything critical to you. This way, even when you become victimised by malware, the attackers cannot access your backups and therefore cannot encrypt them. In addition, please ensure that you isolate the compromised unit from your network immediately upon discovering the infection. As stated above, do not wipe your computers until you’ve brought them into us; also, do not make rash decisions to pay out the demanded ransom. There are many instances where victims find out they had much more recoverable data (in shadow copies, backups and unencrypted remnants) than what was claimed in the ransom message. Before making any decisions regarding payment or otherwise, bring your drives into us for a complimentary evaluation.
A big enough strain on your system can render the encrypted data unbreakable (typically with "advanced" attacks), yet you may still find that you can recover shadow copies, back-ups, or unencrypted data. Isolate the affected systems, save the ransom note and contact us for a truthful evaluation at no cost. We never pay ransoms.