Ransomware data recovery: the three ways files come back — none of them a ransom

The first hour: stand still, deliberately

Disconnect all of your affected machines from the network (unplug the cable and switch off Wi-Fi) and fight the urge to keep busy. The two most expensive actions in any attack's first hour are both tidying up: wiping computers to reinstall them, and deleting the encrypted files in frustration. Do not touch any of your servers or NAS boxes until there's a plan; leave them just as they were when the attack happened. Take a picture of the ransom note. Write down whatever unusual extension has appeared at the end of each file. Most importantly, stop every single one of your scheduled backup jobs immediately: if you let them continue, the next run will copy the encrypted versions of your files over the good copies you'll be depending on later.

One piece of admin also belongs in hour one. If personal data was involved, UK GDPR could make the attack a reportable breach with a deadline attached. Therefore, you should inform whoever is responsible for compliance in your organisation today, and not wait until after things have settled down.

Where data survives an attack

Copies the malware never reached. Offline and off-site backups, obviously, but also version history in the big cloud platforms, which everyone forgets exists: SharePoint, OneDrive, Dropbox and Google Drive can all roll files back to the day before. NAS snapshots and Windows shadow copies. The majority of modern malware will hunt for snapshot and shadow copy data, however this process is imperfect, and partial survivors turn up in case after case.

A decryptor somebody has already published. When researchers crack a ransomware family, free decryption tools appear, and the No More Ransom project is the respectable clearing house. First figure out which ransomware family you were hit with. This can often be determined from the wording of the ransom note and the extension added to the names of the encrypted files. Next, check the No More Ransom website to see whether a decryptor exists for your family. Do not pay money to anyone promising you guaranteed decryption: the honest ones are quietly paying the criminals and adding a margin, and the rest are a second robbery with prettier websites.

Everything the encryption never got to. It generally takes hours to encrypt a business's entire data store, and many attacks don't complete the job. A number of them fail when a reboot occurs, someone interrupts them, or because of poor coding in the malware itself. With patience, disk images can give up secondary volumes that weren't touched during the attack, old file versions stored in unallocated space, database exports the malware ignored, virtual machine images the malware couldn't parse, and files damaged only in their opening blocks. This isn't rocket science: it is simply imaging every disk involved and auditing each image in great detail.

The ransom question, answered once and kept answered

We don't make ransom payments. We won't negotiate with those behind them. And we will never do either quietly on your behalf. Our reasoning is practical before it is moral: a significant share of payers get a broken decryption tool or nothing at all. Paying marks you as a "payer" for the next attack team. UK official guidance is against paying, and if a sanctioned group wrote the strain, the payment itself can break the law. Every pound and every hour spent on the three routes above goes further, and in most incidents that reach this bench it returns more than anyone thought possible in the first bad week.

Report the crime to Action Fraud. Keep all the encrypted drives. Ransomware families may be cracked many months or even years after their time in the sun. It costs you nothing to keep a drive on a shelf. When a drive is thrown into a skip, however, it is like closing a door forever.

Sending a ransomware job in

Get a quote first via 0800 689 0668 or the free online diagnostic, then post the affected drives (not the machines) tracked and insured. If you have a multi-bay system, label each drive by slot before posting. Every disk will be imaged prior to any form of analysis taking place, so no original is ever worked on. A written report detailing what is recoverable using all three routes will then come back, along with one fixed quote. Ransomware falls into the forensic section of our tariff, so payment is made upfront when you accept the fixed quote, before bench work starts rather than after. If the incident is still active across your network, call 0800 689 0668 and tell us; live incidents are treated at the front of the queue.

For more about the full service, see the ransomware recovery page. The equipment most business data resides on has its own pages: RAID recovery, NAS recovery and SAN and virtual machine recovery.