The typical script for all ransomware strains has similar elements: identify the files they are going to hold hostage, make copies of them, encrypt the copies, remove your original files, delete the shadow copy of your files, and finally leave the ransom demand. Ransomware data recovery works by taking advantage of sloppy work in each of these phases. In order to recover your encrypted files we need to take each phase of the attack backwards, one at a time, without sending money to the attacker.
Prior to attempting any form of recovery, disconnect the infected computer(s) from the network; most ransomware will seek out and infect any connected mapped drive and/or NAS share. Resist the urge to clean up anything on the infected machine. The type of ransomware can be identified based upon the content of the ransom demand, how the files have been renamed, and the malicious program (malware) itself. Any attempts to wipe the infected system, reinstall the operating system, or allow an anti-virus program to "clean" the threat will destroy the evidence needed to help determine which type of ransomware was used, and therefore what course of action needs to be taken in order to recover your data.
Report the incident to law enforcement as well: Police Scotland can be contacted via 101. Both Police Scotland and the National Cyber Security Centre would like to receive reports. Take a photo of the screen showing the ransom demand message (if possible). Disconnect power to the infected drives, then get them to the bench along with the photo.
They created encrypted copies and removed your original(s). On hard drives especially, recovery can be time-sensitive (deleted file recovery), with original data often hidden below the surface. They wiped shadow copies. However, the wipe will often be incomplete, missed on some volumes, or completely blocked for NAS snapshots. Synology and QNAP snapshots are regularly able to survive a full-share encryption. They were in a rush. Many malware strains only encrypt the beginning portion of larger files, which provides enough information to potentially recover the remaining portions of the files, including video, database and archive types.
And they identified themselves: the ransom note as well as the extension of each file tells us what type of ransomware was used; if the researchers have already broken that version of the ransomware, there will be a free working decryptor available from organisations such as No More Ransom. Checking for a decryptor is always step one, because it turns a recovery job into a decryption job at no risk.
All of this work takes place on forensic images of the data. No recovery occurs directly on your disk(s). Some ransomware can booby-trap its own wreckage after it has completed encryption. Any action that alters the original data will make previously recoverable data unrecoverable. For businesses who have been affected by ransomware attacks across a server or RAID, each individual member disk is imaged in its entirety prior to rebuilding the virtual RAID system/array so as to allow for an assessment of the encrypted volume.
Two lines that we hold to be unbreakable. We do not pay or negotiate: payment pays for the next campaign, clearly indicates to cyber attackers that you are willing to pay, and provides a working key far less often than the ransom note promises. And we do not claim to decrypt files that cannot be decrypted: modern encryption that has been properly implemented cannot be broken, however hard anyone tries. Therefore, if you encounter an outfit that guarantees it can decrypt files when proper implementation was used, they are either lying about their ability to perform such a task or using your money to secretly pay the criminals.
All data from each "open" doorway (decryption output, undeleted original file(s), snapshot(s) / partial file(s), backups believed irretrievable) are verified; all duplicates eliminated; all data then placed on an encrypted medium and delivered along with a plain English description as to which portion originated from where, and which stayed lost. If insurers or investigators need the detail, our imaging and chain of custody will stand up to them.
The cost for single drive recovery is £300 + VAT. Servers, RAID arrays and NAS units have a starting point of £500 + VAT and are quoted to the job, as each hard disk is imaged separately first. Each project starts with a no-charge, free online diagnostic service. The quote will go in writing to you before we begin working on your project. For most projects that we complete, there is no charge to you if the data does not come back. There is no hourly rate applied by us (so it doesn't matter how long it takes), and there is no evaluation or assessment fee charged. Our fee is not based on a percentage of what the files are worth.
We would say a firm no. Paying the ransom is an uncertain process at best. In addition to the fact that your decryptor may be broken (as many are), you may also receive only partial key(s) and the threat of being extorted again by the same criminal organisation or another. Not only does this fund the criminals' next attack but, depending on the group behind the strain, potentially creates liability for you as well. Allow our free assessment to demonstrate how much data can be recovered prior to sending money to an attacker. Most victims require significantly less from the attacker than the ransom note claims.
Yes, through a legitimate decryptor created by the researchers who broke the strain. We always verify this first. If the researchers did not break the strain, no one honestly can. Modern encryption algorithms are unbreakable with brute force attacks. Therefore, we recover data from all items that were missed by the attacker, including deleted original files, intact snapshot images, partially damaged files and/or backups, which in reality provide much greater value than most victims anticipate.
Actually quite often the opposite occurs. Many NAS systems take snapshots using a technology called btrfs (on Synology) and something very similar on QNAP systems. These snapshots reside off the shares that are accessible to malware, and therefore often remain intact during the time all of your folders appear to be compromised. Shut down your NAS system, cancel any repair attempts and ship us the drives. Checking these snapshots is one of the initial steps we take in assessing your situation.
The assessment is complimentary and we fix the price we quote you in writing before performing any paid work. One encrypted drive falls into the £300 + VAT pricing bracket while servers, arrays and NAS devices are priced per job from £500 + VAT, because every disk is imaged first. No monies are ever sent to attackers and there is no fee on most jobs where no recoverable data exists.
Nationwide: when you have a quote, either drive down to Tay House on Bath Street with the drives disconnected and powered off, or send them via tracked and insured post (from anywhere in the UK). We do all of our work in house and we will never send your data out of the UK, as that tends to be important to many of the same people who worry about ransomware.
Yes, ransomware recovery services run from Glasgow nationwide using either insured post or drop-offs. We recover servers, NAS units, and individual computers; all of our work is done in house and we do not sub-contract any portion of this work or send it abroad.
It can happen, but it's always worth looking first before you ever consider paying. The recovery process can use what was left behind after the malware ran (shadow copy etc.) instead of having to get the encryption key back. There can also be un-encrypted versions of original files still sitting around in free space (un-allocated); there may also be some partially encrypted files that were processed (but not completed) and/or snapshot(s) that the attacker failed to find/encrypt.
Before you drop your device off or post it, please get a quote from us by phone or using the form first. Then there are two honest routes for dropping off and delivery. No vans. Hand in the device at Tay House, 300 Bath Street (right at Charing Cross, two minutes off the M8) Monday to Friday, 9am–5:30pm, without need of an appointment. Or wrap the device well and send by insured, tracked post from anywhere in the UK. All work is done in-house by our own engineers. We have documentation of the complete chain of custody and your data never leaves the UK.
The attack followed a pre-determined script and so does the recovery: contain, identify, image, reverse. Ransomware data recovery for Glasgow and nationwide: no ransom paid, no false promises made.