Most malware will hide, scramble or remove links to your original data rather than genuinely erasing it, so in the majority of cases it is all still sitting on the disk. We make an image copy of the affected SSD, hard drive, card or USB stick in isolation, pull the files from this image and deliver them to you clean: the malware never runs once while we do the recovery.
Every hour an infected drive keeps running gives the malware more opportunity to damage or delete your files, and more chance of spreading to other equipment you plug in. Repeated scans by your antivirus software are just as risky, as they may quarantine or destroy the very files you are trying to recover. Shut the device down, keep it away from your other computers, and contact us: we recover your data from an isolated image of your storage media without the malware ever executing.
When a drive won’t open its files, the files have almost never genuinely gone. What has usually happened is damage to the file structures, missing pointers or flipped attributes. Show us it’s yours, and here is the sort of trouble we untangle most weeks.
Regardless of what device your files are on (and who made it), virus and malware jobs are ones we can almost always handle: as long as your files are on it, we can help.
The disks inside laptops, PCs and Macs; standalone SSDs and hard drives; external and portable units; and flash of every kind — USB sticks, SD, microSD and CF.
One rule applies to the whole process: the infection never runs. First we copy your device in isolation, second we extract your data from that copy, and third we clean it and hand it back, in that order, every time.
Talk us through what happened, and we establish exactly what the malware did to your data (whether it was corrupted, hidden or deleted) and provide you with a written quote, usually within 48 hours.
We make a read-only image of your device on a write-blocked, air-gapped rig, so at no time can the infection execute, reach the network or spread to anything else.
With the malware frozen, hidden and system flags are removed, directory entries are rebuilt and any data that was deleted is carved back out of unallocated space.
A damaged $MFT, cross-linked clusters or a lost partition table: we repair them, or rebuild them from the volume’s own spare copies, until your data becomes accessible again.
All recovered data is scanned against current signatures and cleared, then opened and checksum-matched, so that nothing infected or broken is returned alongside your files.
Your data comes back on new media, organised and ready to go.
It is posted back to you on an external drive, or downloaded using our free download service for up to 75GB, whichever you prefer.
All types of infected storage devices can be recovered, including laptop and PC drives, SSDs, hard drives, external units, USB sticks and memory cards. Your files are recovered from a sealed-off copy and handed back clean, without the infection ever being allowed to run.
Tell us what happened and we will get back to you, usually within one working day.
We’ll be in touch shortly. Anything urgent, call 01483 901310.
No surprises and no hard sell: you will receive a free diagnostic and a written quote before we do any work on your infected device.
Some examples of recent virus and malware recoveries across different devices. Names have been withheld and results confirmed.
A classic hidden-attribute infection. After imaging the stick in isolation, the real files were made visible and the whole set was recovered and returned scanned clean.
The Windows files on this laptop were badly damaged, but none of the customer’s data was affected. We read everything directly from the disk and returned it to the customer free from infection.
Antivirus software had swept up important files. Using a forensic image of the drive, we were able to recover them because they still existed in its free space.
Send us your device for a free diagnostic and give us as much information as you can about what happened. One of our engineers will review it and confirm your exact quote in writing before any work is carried out.
The first step to getting your data back is sending the device to us. Pack it safely, put your contact details inside the package and send it in. Once we have completed the free diagnostic, we will confirm the exact cost in writing before any work starts.
Sending it by post? We’d recommend a tracked, insured service. Dropping it in? No problem: Monday to Friday, 9am to 5:30pm. Please package the device as described above first.
Would you like more information first? Complete the form with further details about your issue, and one of our engineers will review it and send you a tailored quote.
We’ll be in touch shortly. For anything urgent, call 01483 901310.
Questions people commonly ask before sending in a virus or malware infected drive.
Almost always. A virus does most of its damage to the pipes rather than the water itself: it corrupts file-system structures such as the $MFT on NTFS and the FAT tables on flash, or rewrites headers, while the actual file contents stay put. Working on an isolated copy, we repair or rebuild the plumbing, recover deleted files from free space and return everything with the infection removed.
Not at all. This particular pest, which you catch from USB sticks and memory cards, merely flags your files as hidden and system and creates .lnk shortcuts (plus an autorun.inf) over the top. It never deletes your files. Once you reset the attributes and remove the shortcuts, your files are exactly where they were before the infection.
No, they will not. Our recovery takes place in a sealed-off environment and the results are scanned before they leave us, so when you plug the recovered data back in, you will not reintroduce anything to your machines.
Rarely. A damaged boot chain (the MBR, boot configuration, registry and the system files Windows relies on) prevents the machine from booting without affecting any of your documents. We bypass the operating system completely, create an image of your disk and then retrieve your files directly from that image.
Often. When an antivirus program quarantines a file, it actually places an encoded copy of the file in its vault and unlinks the original. A straight deletion just leaves the blocks in place until something else is written over them. Either way, there is a good chance of recovering the file from either location (the vault or unallocated space), provided the drive is not used in the meantime. Stop using it and call us.
What we do is pull your data off and hand it back to you clean. The infected system is never booted during our process (your files are taken from an image and scanned in isolation), so the copy you receive will not contain any malware. However, cleaning and rebuilding the original machine is a different job altogether.
The cost of a logical recovery starts at £300 + VAT. The diagnostic beforehand is free, and in most cases you only pay if we recover your data. If, in addition to the malware, your hardware also turns out to be failing, we will give you any higher figure in writing before proceeding.
Practically anything that stores files: the internal drives in laptops, PCs and Macs, standalone hard drives and SSDs, external and portable units, and flash of every kind, from USB sticks to SD, microSD and CF cards.
Most recoveries take one to three working days, and often less. Our free diagnostic is usually completed within 48 hours. If time is of the essence, please let us know and we will try to move it up our queue.
There are two ways to get it to us: bring it to our Guildford premises on a weekday between 9am and 5:30pm, or post it fully insured. Seal the package securely and include your contact details inside (name, address, phone and email) so that we can log it. The free diagnostic and a written quote follow before we touch anything.
A free diagnostic, and in most cases you only pay if we recover your data. We pull your files clean off any drive, stick or memory card that a virus has hit. Start your recovery now.