Once infected, there is no reason to continue to walk through the "crime scene" that has been created by the malware on your system. The malware may have changed locations (hidden) of your files/folders, mixed up file names and possibly even removed items at its discretion. Additionally, the malware could still be in memory (resident) waiting for you to plug another device into the infected computer or connect to a network share. The most proper method of handling an infected computer involves treating the storage devices attached to the system as contaminated evidence; imaging the drives/containers, quarantining them so that they cannot infect others again and then extracting the clean information/data from those images without allowing the original infection to execute or load onto other systems again.
Data is damaged in three different ways by infections. Vandalism includes setting all attributes to "system" invisibility (or hiding folders), or rearranging file name order to create panic. The files themselves have not been harmed; the data simply has no way of being located due to attribute changes. Parasitism damages data it touches while spreading. This may be an executable bloated with passenger code, or a document that you can't open. A wiper, on the other hand, will actually damage the data it finds. It will either delete it or replace it completely, which turns the job into deleted-file recovery of whatever the malware's schedule left behind. Therefore, before we can begin fixing the problem we need to determine how the infection affected your computer, as each pattern needs a different plan.
And if the "virus" has left a ransom note this is an entirely different area: see ransomware recovery. Paying is never the plan.
Recovery images are made from an infected device by using a write blocker, and it will never be booted again (all work to recover data happens on the image within a controlled environment in which there is no chance for the malware to run or access a network). Your files are extracted and scanned/verified as clean before you ever receive them; live infections are "sealed" in the recovery image much like bugs trapped in amber. We would not follow the normal corner-shop practice of scanning your original media with an anti-virus program: doing this causes all carriers of the infection to be deleted and, sometimes, your documents are also the carrier of infection.
Once the data has been safely recovered, the drive will be returned to you (the customer), in its original state or with all contents wiped for reuse: that decision is yours.
The end state is a clean dataset on new media that can easily be transferred to a freshly installed "clean" system (the only truly safe base of operations after a breach). Any items discovered to be malicious or suspicious will be flagged as such. The type of malware that appears to have been present in the infected dataset will be noted. Lastly, all security related issues should be addressed prior to returning the recovered data into a production environment.
If one single drive is affected it costs a fixed £300 + VAT regardless of the type or extent of failure. The rare chip-level exception is quoted in writing first. We offer a free diagnostic before any work begins and quote all costs in writing before proceeding. Most jobs will cost nothing if your files don't come back. There are no hourly rates, evaluation fees, or percentages of file value charged.
If the files have been encrypted instead of being deleted, then ransomware data recovery services would be the right option, and their first step is never to pay ransom demands.
It is very likely that "AV" has removed infected files as part of its "quarantine and delete" process, and where the malware was embedded into documents, those documents will be removed too. These removals are recoverable in the same way a deleted file would be recoverable (assuming the hard disk/flash/etc. was stopped from being overwritten) at this point. First check the AV's quarantine folder for possibly recoverable items before imaging and recovering anything that was thrown away during cleaning.
Classic hider pattern: attributes are set to hidden/system (sometimes decoy shortcuts left). The space used tells us your data still exists. This is very easy to reverse from an image. The only way to lose is when a drive that was never empty gets panic-formatted.
Yes, completely: as infected media, all infected items will be treated as contaminated by default. This means they will be write blocked, imaged and analysed separately from other drives, with no execution or networking with any other drives. Treating suspected infectious items here is business as usual. Just label them as suspected infectious items and we'll treat them accordingly upon arrival.
To a useful degree, yes: although the malware may have wiped or modified some of your files, the evidence has been preserved in the image. We will identify the family where possible and describe what appears to have been destroyed or altered. If you require formal forensic attribution reporting for legal or HR proceedings then that's the forensic service built on the preserved image provided during the recovery process.
Before you drop your device off or post it, please get a quote from us by phone or using the form first. Then there are two honest routes for dropping off and delivery. No vans. Hand in the device at Tay House, 300 Bath Street (right at Charing Cross, two minutes off the M8) Monday to Friday, 9am–5:30pm, without need of an appointment. Or wrap the device well and send by insured, tracked post from anywhere in the UK. All work is done in-house by our own engineers. We have documentation of the complete chain of custody and your data never leaves the UK.
Every single boot-up is a new opportunity for the malware to make changes (deletions) and build its layers of deletion on top of what came before. Virus and malware data recovery for Glasgow is done by imaging the affected drive, quarantining it, and returning your data clean. You can send us the drive either via drop-off at Tay House in Glasgow or by clearly-labelled insured post after we give you a quote.