When you arrive at work or home, every file has an odd-looking extension and every folder contains a demand note stating that the only way of getting your data back is the hackers' decryptor. The drives usually know better. We examine encrypted PCs, servers and NAS devices from York businesses and households for all possible legal methods of recovery. Handing over money to the attackers has never made it onto our checklist.
We diagnose all ransomware jobs for free. Before we even lift a screwdriver to start fixing anything, we send you a fixed price in writing.
In most cases you only pay if we recover your data. Chip level, electronic and mechanical repair is charged at 50% at start-up, and the other 50% only upon successful recovery of your data; all BitLocker, ransomware, forensic and CCTV/DVR recoveries are charged at start-up when you accept our fixed quote. More information can be found on the data recovery cost page.
The first thing we do with each new ransomware job is match the symptoms with the cause. After two decades, these 25 account for nearly everything that comes through our door.
All folders under a single user encrypted in one night's run; the most typical form of single-PC ransomware attack, and the shape most cases arrive in.
NAS boxes connected directly to the internet make excellent targets. The snapshot trees underneath many of the share directories tend to survive the purge more often than attackers intend.
Hypervisor attacks will work through a datastore's VMDK files one by one to take down all virtual machines in one single strike.
Speed-optimised families will only encrypt the first part of larger files. Any remaining parts of those files will be kept intact and available for use. This includes databases and archives.
vssadmin has run prior to the encryption process taking place. Even so, deleted shadow copies may occasionally be recoverable from unallocated disk space.
Plugged in meant it could be accessed, and accessible meant encrypted. Older versions and remnants of its files still count for plenty.
Double extortion attacks steal your data, then encrypt it and threaten to publish what was stolen. What left the network is scoped for insurers and the ICO.
Locked boot devices will give up their drives, which are imaged and analysed beneath the lock, where all the files exist.
SQL or Exchange files caught mid-write will typically be left partially encrypted. Salvaging them against the captured data is performed on a page-by-page basis.
Any NAS (Network Attached Storage) unit that re-encrypts on every restore attempt is still compromised. Isolate the system first. After that, recover data only from disk images, never from the live unit.
The unknown malware strain gets run through a database of known families and any weaknesses that have been published that can be exploited legally.
Fake ransomware leaves a ransom note on files that were never altered. Some real ransomware crashes early. A check on our rig determines whether it was fright or actual loss.
The big-name crews run deletion passes that are thorough but imperfect. Recovery exploits those imperfections, and we know where they tend to occur.
A popular strain with home users. Many older offline-key versions have a free public decryptor, which we apply lawfully whenever it fits.
Some ransomware families will encrypt a copy of the data and then delete the source file, leaving the deleted original on disk (carvable). An obvious oversight in their design.
Exposed RDP remains an open door into systems, with encryption following several hours after entry. Logs show who entered and when, to the minute.
OneDrive dutifully swapped good files for encrypted ones. We check the version history and any remnants at both ends of the sync.
Encrypted VHDX files take down every guest at once. The quirks of partial encryption often leave those guests rebuildable.
Nothing was locked, everything was copied off the system, and now a leak is being threatened. Recovery has turned into forensic scoping and the type of questions being asked are changing.
Only one of the disks was connected when attacked, and it took the damage. Off-rotation sets, along with remnants carved from the damaged disk, fill the gap it left.
Scheduled tasks and services can run the malware again weeks later, in the middle of a restore. All images are scanned for potential footholds before any rebuild goes live.
There are some "recovery specialists" who discreetly pay the ransom demand to the criminals and then refer to this act as expertise. We recover from evidence, explain what is possible and do not carry messages to any criminals.
Modern crews remove the safety net before they pull the trigger. Repository (or backup) files often keep their recoverable structure all the same.
A few strains will wipe clean without there being any route for decryption. We identify these quickly and say so plainly; recovery then works from whatever remnants and copies exist.
ESXiArgs-type attacks encrypt small configuration files but miss the large amounts of flat data behind them. The entire machine can be restored by rebuilding from the unencrypted data.
The malware encrypted file by file through the storage using conventional encryption methods: AES on the content, with those keys then sealed under an asymmetric key whose private half never leaves the attackers' possession. The odd extension is the strain's signature; the note is printed when the run is completed. Capable families also delete shadow copies, find any reachable backups and scan all shares that the compromised account could access. This explains why the ransom demand appears as confident as it does. It never mentions what the run failed to reach, though, and a careful look nearly always finds something it missed.
The fact is no laboratory anywhere has ever brute forced well-built encryption, and any business claiming otherwise is telling a story. A search for a ransomware decryption service in the UK will show how many "engineering" solutions are simply negotiation with the attackers, resold. Legitimate ransomware recovery takes advantage of the mistakes made during the attack instead. Snapshots and shadow copies the purge overlooked. Backups the malware couldn't reach. Originals that were deleted rather than encrypted, where the strain worked on a copy. Temporary files and remnants carved from slack and free space. Broken NAS and RAID structures rebuilt until usable data shows through. And for the relatively few ransomware families with published weaknesses, a free decryptor applied lawfully. The free assessment identifies which of these options apply to your specific incident.
We do not pay any ransom and will never send any messages to any attackers, and our clients will never be encouraged to pay: it funds the next campaign, guarantees nothing, and criminal decryptors often mangle the very files they claim to free. Instead, we use technical means to exhaust every possible method for recovering your files, and we document which files were recovered and which remain lost. If, after consulting us, you, your insurers or your advisers decide to negotiate, that decision is yours to own; our job was making sure the technical answer arrived first.
Each ransomware incident begins as a forensic investigation immediately upon discovery and remains a forensic investigation until completion. Each incident is treated as follows:
All evidence collected during an incident is kept completely separate from any other networks and/or systems. All forensic investigations are conducted on an isolated workstation where no information can spread, communicate with outside systems, or continue encrypting any files where it left off.
Before anyone examines them, attacked drives are captured behind physical write-blocking; recovery works on the copies while the originals stay sealed.
Free-space scanning is done for the remains of shadow copies (and NAS snapshots) that the purge overlooked, which can be rebuilt as restore points that actually restore.
The ransom note and samples identify the ransomware family, which is then checked against reputable public sources, such as No More Ransom and vendor releases, for any lawful decryption tool.
Unencrypted versions of the original file, temporary files and partial or incomplete copies of the encrypted data are recovered from free-space (the "debris" generated by each hurriedly conducted encryption operation).
All aspects of the effort including strain, spread and outcomes are documented throughout the process. This documentation will ultimately become necessary for your insurer, regulators and your own post-mortem review.
There are two written undertakings prior to commencing work with our company. First, strains without a published weakness cannot be "brute-forced" by us or anybody else. Second, we do not pay ransoms, and we do not carry messages to the people holding your files. Ransomware falls into the category of forensic services, i.e. a free assessment is carried out first, followed by a single fixed price quotation, paid upfront once you accept that quotation, before the work begins.
Before anything else, and certainly before any parcel tape is applied: unplug all network connections from the affected machine(s) and leave them untouched, i.e. no virus scans, no reinstalls, no formats, because each of these reduces the amount of data available for recovery. Keep a copy of the ransom note and several examples of the encrypted files, as these will be needed to identify the specific ransomware strain. Then ring 0800 689 0668 for your quote and we'll agree what needs to be posted (the drives, not the computers). Recovery is always performed from copies captured on an air-gapped system and never from the original data.
Get a quote first, by calling us on 0800 689 0668 or using our free online diagnostic tool. After receiving your quote, tracked and insured post is how nearly every job reaches us: it is the fastest and safest way to get your drive to our lab in Leeds. There's no collection service, so the parcel is yours to send, or you can hand it in at the Leeds lab's reception.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Free diagnosis, fixed written quote, and on most work you only pay if we recover your data. Start online or call our freephone.