The problem now is that modern ransomware cannot be decrypted by anyone but the attacker, so we get to ask the most important question first: what was saved? In other words, what still exists. What survives is usually some combination of unencrypted original data (still sitting in free space), any shadow copies created during normal operations or backup processes that were left alone, and any files the attack never reached. We will identify specifically what remains available at no charge before you do anything with respect to payment options.
Disconnect all affected systems from the network immediately. However, do not power down the systems if they are currently operational. This will ensure that any remaining shadow copies, and anything that may exist only within RAM, are not lost on a reboot. Do not format any drives. Do not reinstall any operating systems. Keep all files, including the encrypted ones. These files may be needed later in order to perform a decryption process or provide evidence that needs to be preserved. Additionally, retaining these files costs you absolutely nothing.
No longer is this simply a matter of scrambling a few documents. Families today move horizontally through networks. They search out backups deliberately. And once identified, they copy data before encrypting. All of this dramatically alters how we define recovery.
Clearly stating these issues is important since there exists a great deal of vagueness from within the industry regarding decryption.
Current ransomware families have been developed properly and are well-designed; thus the encryption used is secure and the keys are being kept by attackers. No entity can successfully decrypt these files: we cannot, a reputable firm specialising in remediation cannot, and neither can law enforcement. Companies claiming to provide decryption services for current ransomware families are either describing outdated versions of ransomware with identified vulnerabilities or they are offering to sell you a ransom payment along with a “service fee.”
If we can find a legitimate free decryptor on the web for your file, this usually comes in the form of a tool from the No More Ransom Project. However, each free decryptor has limitations as they are typically created specifically for an individual family of ransomware, which contain a particular implementation vulnerability. It is always worth checking for this first option since there is no cost associated with doing so. When you find a decryptor that works for you, great. When you do not find such a decryptor, then unfortunately, recovering your files will need to be done by finding workarounds or methods to circumvent the encryption process rather than using a decryptor.
In real life most of what gets returned after a ransomware attack was not successfully encrypted to start with.
The goal of ransomware is to delete those shadow copies and it frequently fails to remove every one (particularly on servers that store plenty of shadow copies or when deletion didn’t have sufficient privilege).
Many families will also encrypt a file and delete the original file, but the original file often lives on in unallocated space and can be pulled out completely.
Another common issue for these attacks is interrupts/permission errors/skipping certain file types/drop off partway through. Many directories are left untouched.
There may also be offline copies / immutable snapshots / cloud versioning / NAS snapshots that were not accessible from the infected network.
What was removed from the system as opposed to remaining, will be an issue when determining who needs to be notified (for example) and the evidence for this is frequently still on the system.
Ransomware attacks typically represent both a technical challenge and a non-technical problem; therefore, the technical steps taken during the response process can also cause problems with how well you address the non-technical challenges.
Generally speaking, insurers require systems which have been impacted by a cyberattack be maintained intact rather than restored, and restoring a system prior to having assessed the extent of damages to said system can negatively impact your ability to file a valid claim. If personally identifiable information may have been extracted from the compromised system(s), then under UK GDPR, you would be obligated to determine if there exists a violation of the regulations and potentially notify the Information Commissioner’s Office (ICO) within 72 hours post-discovery of such a breach. Whether or not certain items were able to leave the network will depend upon logs and/or artefacts that will be destroyed upon restoration of the compromised system.
Therefore, we take images of all impacted systems read-only before engaging in any additional remediation activities. This approach maintains your evidentiary position (regarding potential claims) while preserving access to potentially recoverable files via a decryptor (if one becomes available at a future time). Additionally, each subsequent attempted recovery operation will operate off of a “copy” of the system. The cost associated with taking these images is nothing extra, and they provide protection for possible alternatives you do not currently recognise you may need to pursue.
Your assessment is free, your quote is provided in writing, and you get to make decisions based upon the numbers being presented to you.
When we start looking at ransomware on servers, NAS units and RAID systems we charge from £500 +VAT. For an individual workstation or drive (and a single one) we can look into this from £300 +VAT. Our free 48-hour assessment will establish the strain and if there is data still available in shadow copies and/or un-encrypted areas of your system. Then you know what you may be able to realistically recover, before committing to anything.
We don’t engage in ransom negotiation or payment. We also do not charge you a % of anything. If our assessment shows there is little to no recoverable data, then we let you know without charging you to find out. See our full write up articles: Ransomware Recovery: LockBit, and No Backup.
Before we can start work on your unit you will need to send it in for a free diagnostic review and tell us briefly what happened. We then have one of our engineers review your unit & verify your exact quote in writing prior to starting any work.
Before dropping off or posting your device please request a quotation either by telephone or using our quotation form. The first step to recover your data is to get the device to us. Please ensure that you pack the device securely, include your contact information and then forward it to us. Once we have completed the free diagnostic of your device we will provide you with your exact price in writing prior to commencing any further work.
Posting it? We would suggest using a tracked and insured delivery method. Want to drop it off? That’s okay too. Monday to Friday, from 9am to 5:30pm is good; no appointment necessary: simply prepare the item as described above.
If you want a few more details first, fill out this form and let an engineer go through it and send you back a custom quote.
We’ll be in touch shortly. If it’s urgent, call 01865 593000.
The most common questions asked by people after a ransomware attack.
Not for active families. As the encryption has been successfully applied and the keys remain with the attacker, no one decrypts them, including us. Some older versions of ransomware had design errors and some free decryptors were made available via No More Ransom and we try these first, since they cost nothing.
Disconnect all computers that have been infected with ransomware from the network, but leave them powered on if they are already on, so as not to lose the “shadow copies” and other memory-based material that could potentially be lost upon restart; however, do not format/reinstall these systems at this time, since there may be some value in retaining the encrypted data (files), as it may provide evidence useful in recovering the encrypted files during/after the ransomware incident has ended.
This will depend entirely on your own judgment, and we take no part in it. However, the following information should also be considered prior to making a decision: Your ransom payment will obtain decryption software, but it does not mean that previously stolen data will be deleted. In many cases, most items of importance to individuals/businesses can be recovered via traditional recovery methods (i.e., backups, snapshots, etc.) without having to pay a ransom. Therefore, consider whether you need to pay a ransom to recover the majority of important data and/or assets.
Typically more than expected. There are many areas where data may exist after an attack. Some examples include: data that existed within “shadow copies”; files that were originally unencrypted and remain in free space on the drive; any files/data that the ransomware did not reach/access due to various reasons; and backup(s)/snapshot(s) that are located outside the area that was affected by the ransomware. The assessment provided will inform you as to which of the above mentioned areas are applicable to your situation.
If there may have been an access of or theft of personal information, then under UK GDPR, you are required to determine if there’s been a breach and potentially provide notification to the ICO by way of reporting such breaches within seventy-two (72) hours. In order to establish what has exited the network, logs and other artefacts would need to be collected before a rebuild destroys them. This is just one reason why systems should be imaged prior to their restoration.
A minimum of £500 plus VAT will be charged for server recovery; NAS recovery; RAID system recovery; etc. However, a minimum of £300 plus VAT will be charged per workstation or drive, quoted via written document once a complimentary 48-hour evaluation has occurred. We do not assist with ransom payments and we do not charge a percentage of recovered data.
We name the ransomware family; present you with documentation as to how much it will cost; and restore from workstations, NAS & servers alike, while keeping all supporting documentation available for your insurance company. Contact us now!