A ransom demand for money, files changed to have an unusual file name extension, and a business or home user locked out of their own information overnight. A ransomware attack can be frightening, but it's most likely not as complete as the ransom demand claims. We are able to assist households and businesses across Staines and Surrey with recovering what the encryption left behind.
Each ransomware job gets a free diagnostic. Before we begin working, each job has one fixed price quoted in writing.
In most cases you only pay if we recover your data. For all electronic and mechanical work, including chip-level repairs, 50% is required upfront, with the balance only payable if we recover your data. For BitLocker, ransomware, CCTV/DVR and forensic jobs, full payment is made upfront once you accept the fixed quote. Full details regarding our costs can be found on the data recovery cost page.
Each ransomware job begins by matching the symptoms to the problem. These twelve represent the vast majority of jobs brought into our lab.
Your documents and photos now include a unique file name extension (e.g. .lockbit, .phobos, .djvu), and they cannot be opened. This is usually indicative of an encryption process running.
A readme.txt, .hta or on-screen message appears right across the system, stating that the attacker demands cryptocurrency payment for access to your files.
The malware executed vssadmin to remove all Volume Shadow Copy backups, which may be recoverable from unallocated space.
All attached backup devices, and any network shares, were attacked during this same event; therefore, even if there is a "backup," it will also be locked.
Any information available to the compromised account, including network shares, mapped drives, sync folders, etc., was encrypted simultaneously with the local hard drive(s).
Exposed NAS devices and servers attacked and encrypted via the network, often with damage to the volume structure as well.
ESXiArgs-type attacks encrypt VMFS datastores and VMDK files, causing entire virtual estates to go down at once.
Some malware strains create a duplicate of the file and then remove the original. In many cases the unencrypted originals remain recoverable, where the freed space survives.
Ransomware designed around speed will only encrypt the initial section of large files, such as databases and PSTs, often leaving the end portion untouched and usable.
A quick reinstall of the OS on the "clean" computer wrote over previously recoverable data. Where possible, we work from a disk image taken prior to any additional writes.
STOP/Djvu, along with some Phobos and older ransomware strains, have known published flaws or free decryptors available for lawful access to the encrypted files.
In addition to encryption, the victim's data was exfiltrated. Forensic logs help to identify what data was removed, which aids in providing information for insurers and ICO reporting requirements.
Modern ransomware doesn't randomly scramble files: it uses strong standard cryptography, with a fast symmetric cipher (AES) to encrypt the files and a public key cipher (RSA or elliptic curve) to lock the AES keys, so only the attacker holds the means to restore them. Additionally, well-built strains seek out and delete Windows shadow copies, local backups and connected NAS shares first, solely to make restoring difficult. That's why the honest starting point matters: when the cryptography is implemented correctly and the key(s) are gone, there is no practical way to 'crack' the encrypted files.
We will tell you the truth: we don't advise paying the ransom. Paying does nothing to fix the technical problem caused by the attack. It just gives money to the attackers, and when they do answer back, the decryptor is often broken or doesn't restore all of your original files. The only real solution after an attack is through the holes the attack leaves open: restore using Volume Shadow Copies or backups that the malware could not access; recover your deleted original files where it encrypted a copy and then deleted the source; carve unencrypted remnants and temporary files off the disk; rebuild damaged RAID and NAS volumes so the intact data underneath can be read; and finally use a free, published decryptor, where one already exists, specifically for that particular strain. Before we quote anything, we will first determine what route(s) your case actually has available.
The moment you spot an attack, disconnect the affected machine from both the local network and the internet and leave it powered as it is. Don't wipe anything. Don't reinstall the operating system. And don't run cleanup programs that overwrite the remnants recovery depends on. Save the ransom note and a couple of sample encrypted files. That will help us figure out which strain it is. Once you have done this, contact us. Our process uses forensic images exclusively. This means your original files will not be altered while we look for a way back.
Recovery from ransomware is a methodical, isolated and evidence-aware approach: it is never a gamble with the attacker. We designed our lab to support this:
Infected media is assessed on an air-gapped bench that does not connect to any live network. This prevents anything spreading, as well as preventing re-encryption while we work out how best to recover your files.
Every affected drive goes through a write-blocker before a sector-by-sector image of it is created. All recovery operations then run on this image; no original files will ever be modified.
Volume Shadow Copies, NAS snapshots and source files the malware attempted to delete are carved back from unallocated space wherever they survive.
Ransom notes and sample files are compared to known strain databases, as well as to reputable published decryptors (e.g. No More Ransom and vendor tools), to lawfully decrypt files when a decryption key or a flaw within the strain's implementation exists.
Many times encrypted servers also contain corrupted array structures. In such cases, the volume is rebuilt, and the intact and remnant data beneath the structure is made readable again.
A document outlining the strain, the entry point (where evident), and exactly what was and wasn't recovered will be produced. It's valuable for insurance companies, ICO reporting and internal review.
Where a strain's encryption method is properly implemented and there are no longer valid keys, the encrypted files cannot be brute-forced. Reputable restoration methods include recovering from shadow copies, backups and deleted original files, rebuilding RAID/NAS arrays, and decrypting files only where a legitimate, published decryptor exists. We don't advise paying the ransom, and we work exclusively from forensic images so nothing is made worse.
Has ransomware struck? Cut off the affected computers from both your local network and the internet. Leave them turned on as they are; don't wipe, reinstall or run cleanup tools, because these actions overwrite the very remnants recovery depends on. Save the ransom note and a couple of sample encrypted files (these help us identify the strain), then call us on 0800 689 0668 or use the free online diagnostic to get a quote before sending anything in.
Before sending anything, get a quote from us either by telephone or using our free online diagnostic. Then post your hardware to us (tracked and insured), or drop it off at our Guildford laboratory in person.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV/DVR or server? You will need to remove the internal hard drive or SSD and send us just the drive, as we are unable to remove the drive for you. We also cannot recover storage soldered onto a motherboard, such as in Apple Silicon Macs and some thin laptops. Only drives that can be removed from a machine and sent to us can be recovered. If you are unsure whether your device has a removable drive, please call us before sending. RAID, server and SAN drives need to be removed from their enclosure and labelled by bay. For a NAS, send the disks themselves if they are removable, otherwise the entire NAS device. An external single drive should come to us whole, along with its cable and power supply.
↓ Print the booking-in & shipping form (PDF)
Please mark the package for the attention of Guildford Data Recovery, and we will call you as soon as we have diagnosed your media.
Unsure as to how to proceed with sending the item in for recovery? Then simply call 0800 689 0668, or complete the free online diagnostic prior to dispatching the item to obtain your price quotation.
Free diagnostic, fixed quote, and in most cases you only pay if we recover your data. Start now or call the freephone.