Ransomware encrypts your files and demands payment, but paying is rarely the only way out, and it is often the worst one. We work out which strain you have been hit by, recover everything that can be recovered (decryptable variants, shadow copies, backups and data that was never encrypted) and keep all of it intact for your insurer and investigators. It starts with a free assessment of exactly what can be restored, before you even think about paying.
As soon as ransomware shows itself, isolate the affected machines immediately (off the network and away from any backups) so it cannot spread. Nothing should be reformatted, rebuilt or deleted, and don’t rush into paying a ransom: payment does not provide a guarantee of receiving a working decryption tool, and it also funds further criminal activity. Save the ransom note, along with a few examples of encrypted files, and contact us. We identify the strain first, and a few strains can be decrypted for nothing.
Today’s ransomware attacks go well beyond scrambling a small number of files: they move across drives, look for backup copies and target the systems your business depends on. These are the cases we see most often.
Before we touch anything else, we identify the exact family and variant from the ransom note and a few encrypted samples. Some strains have a free or known decryptor, while the biggest current families use encryption that simply cannot be broken, so recovery comes instead from shadow copies, backups and data that escaped encryption.
Identifying the strain always comes first — we check the No More Ransom project, run by Europol and police forces to publish free decryptors, alongside our own tooling. Whatever the family, you’re told honestly what’s recoverable before any work starts.
We recover ransomware-hit data on every major operating system, server and NAS platform, including Windows, macOS and Linux, and the virtual environments running on them. If ransomware has reached it, chances are we can help.
Desktops, laptops and workstations; physical and virtual servers; NAS and SAN systems; current and older Windows, macOS and Linux releases.
One principle governs everything we do: your files come back without a single penny going to the criminals. Before anyone touches a byte, we identify the family behind the attack, and we refuse to gamble on a blind payment. From there, the work is deliberately methodical. The originals are preserved as evidence, every operation is performed on cloned copies, and we work through each avenue of recovery in turn: unencrypted leftovers, offline and versioned backups, Windows shadow copies and any decryptor that genuinely exists.
Talk us through what happened. Using the ransom note and a few encrypted sample files, our engineers identify which family is responsible and then check whether a working decryptor is already available for it.
Every affected disk is captured as a write-blocked forensic image. Your original drives are kept untouched as evidence, and all subsequent work is carried out on the clones.
We rank each avenue by how much it is likely to recover, then work down the list: deleted originals carved straight from unallocated space; temporary and partly encrypted files; transaction logs inside your databases; cloud and offline backups; shadow copies the malware failed to delete; and, last of all, any legitimate published decryptor.
If a strain has a working decryptor, either because of its age or because of a flaw, we use it. Modern ransomware families are different. BlackCat, Akira, LockBit and the like encrypt each file with AES-256 wrapped in an RSA or ECC key, which nobody can break (our lab included), and we don’t pretend otherwise. So we work around the encryption rather than through it: originals the malware copied and then ignored, shadow copies, and the many partly scrambled files that fast strains leave behind (many only encrypt the first few megabytes, or every Nth block), as well as anything else on the platter that is still readable.
Files, databases and virtual machines are extracted and reconstructed, and the work is ordered so that priority is given to whatever you most need running again.
A full list of restored data is provided to you for verification, and once you have confirmed it, everything is copied onto a clean external drive.
The complete set of restored data is returned to you on new storage media (or, for smaller amounts of data, by encrypted transfer), ready for you to rebuild your systems from.
We bring back encrypted data from workstations, virtual machines, RAID arrays, NAS boxes and servers, naming the family first, protecting the evidence throughout the process and pursuing every available recovery path until there are none left.
Tell us what happened and we’ll get back to you, usually within a working day.
A reply is on its way to you soon. Anything urgent, our line is 01483 901310.
Before any work starts, we provide a written quotation: no hidden charges and no pressure.
A few recent ransomware recoveries across servers, NAS systems and workstations. Details that could identify anyone have been removed, and specifics are kept deliberately vague. Full write-ups: LockBit on an HP Omen with no backup.
This particular ransomware family had a documented flaw. Using read-only images of each drive, we were able to deploy a decryptor and restore the databases and file shares intact.
The malware never gained access to the snapshots stored internally on the NAS. Those protected versions, along with everything else that remained unencrypted, were recovered in full.
As direct decryption was not possible, we turned to alternative methods for the recovery: shadow copies, a dated offline backup set and the unencrypted fragments left on the disk.
Simply send your device to us for a free diagnostic and describe briefly what happened. An engineer will review it and confirm your exact quote in writing before any work begins.
The first step to getting your data back is sending the device to us. Pack it safely, put your contact details inside the package and send it in. Once we have completed the free diagnostic, we will confirm the exact cost in writing before any work starts.
Sending it by post? We’d recommend a tracked, insured service. Dropping it in? No problem: Monday to Friday, 9am to 5:30pm. Please package the device as described above first.
Would you like more information first? Complete the form with further details about your issue, and one of our engineers will review it and send you a tailored quote.
We’ll be in touch shortly. If it’s urgent, call 01483 901310.
The most common questions asked of us after a ransomware incident.
Recovery succeeds more often than people expect, although the strain sets the ceiling. While a small number of strains can be decrypted directly, for the rest we use other routes, such as remaining unencrypted data on the affected drive, cloud and offline backup sets and Windows shadow copies. The exact outcome depends on the results of our assessment.
Have it assessed first, every time, and then make your decision. Paying the ransom offers no assurance that the decryptor even works, it marks you out as an easy repeat target, and it funds the attack on the next victim. In a good many of our jobs, we return the data without a penny being paid.
At times, yes. Some older strains carry publicly available keys or well-known weaknesses, and the No More Ransom project (a free initiative run by Europol alongside police forces) has tools that can decrypt a number of them. However, with today’s major ransomware families, the encryption is intact and cannot be broken by anyone at all. Rather than pretending otherwise, we work around it and recover your data another way.
In most instances, more than you would think. Backups stored off-site or offline, NAS snapshots and shadow copies that the malware tried but failed to delete often escape it. Add database transaction logs and partially encrypted files and there is a real amount of data to rebuild from. We match all of these sources against whatever you need restored first.
It is not really a question of having a list. First we identify the ransomware family from the note and a couple of encrypted samples. Next we check whether a decryptor is available (including the free No More Ransom tools). Whatever strain you have been hit by, we evaluate every possible path for restoring your data, not just decryption.
That is a core part of what we do. Recovery of locked servers, RAID systems, NAS devices and virtual machines is familiar ground for us: each disk is imaged, the array is reconstructed when necessary, and file shares, mailboxes and databases are pulled back.
Yes, completely. These cases are handled discreetly, and we are happy to sign an NDA. Neither your data nor the fact that you were breached at all will ever leave our office.
For a single-drive machine, the price is generally a flat rate per drive from £300 + VAT. Anything larger is priced case by case, as the strain, how much data is involved and which systems were affected all change the figure. Either way, a written quote is sent to you before work starts, so there are no surprises.
You can bring the drives to our Guildford premises, open 9am to 5:30pm Monday to Friday, or post them fully insured. From servers and NAS units, remove the drives first and label each one with its bay or order number. Include your contact information so that we can log the job, and we will assess it before any work starts.
The defences are dull but effective: versioned or offline backups that the malware cannot access, systems kept patched and caution when opening attachments. Been hit already? Pull the machine off the network, don’t wipe and reinstall over your only copies, and do not be rushed into paying. Send the drives to us: shadow copies, unencrypted remnants and digging through old backups often turn up more than the ransom note admits, and the free diagnostic gives you an honest read of the situation before you commit to anything.
Yes, this is something we do routinely. Our engineers work alongside your insurer and any incident-response or breach specialists they appoint, rather than cutting across them. All of our work is done on read-only forensic images and copies, so none of it interferes with the evidence that investigators and insurers rely on, and for your claim we can document the strain, which systems were affected and exactly what was recovered. Let us know about any cyber cover as early as possible: some policies require an approved provider or specific procedures, and we will work within them.
We identify the family, put the numbers in writing and recover from workstations, servers and NAS units alike, with the evidence preserved safely for your insurer. Contact us today.