You come in to find all of your documents with an unusual extension and a ransom demand in each folder, with the criminals claiming their decryptor is the only way out. The drives usually say otherwise. Drives from encrypted PCs, servers and NAS devices in Swindon and Royal Wootton Bassett are examined here for all the lawful routes to recovery, and paying money to the attackers will never be one of them.
We provide a free diagnostic on every ransomware job. Every job gets one fixed quote in writing before the work starts.
In most cases you only pay if we recover your data. Electronic and mechanical failures and chip-level work are 50% upfront, with the balance only if we recover your data, while BitLocker, ransomware, DVR and forensic jobs are paid upfront once you accept the fixed quote. You'll find full pricing on the data recovery cost page.
Each ransomware job begins with matching the symptoms to what caused the issue, and these twenty cover almost everything that passes through our doors.
Every user folder was locked in one overnight run, which is the single-machine attack that keeps a constant flow of jobs coming onto our intake shelf.
Synology and QNAP boxes connected to the internet are popular with attackers, but the snapshots underneath the shares tend to survive the attack.
Hypervisor strains encrypt the datastore one VMDK at a time, which means a whole virtual estate goes offline at once from the same attack.
Some families are built for speed, so they only encrypt the front portion of each large file, and the remaining portions of databases and archives can still be used.
Before encrypting, the malware runs vssadmin, and deleted restore points can sometimes be carved back out of free space.
The USB 'backup' was plugged in at the time, so it could be reached and it got encrypted too, but earlier versions and remnants still count.
Data theft happened before the files were locked and publication is being threatened. As such, we scope what left the network for the insurers and the ICO.
A ransom screen is shown instead of Windows, so the drive is removed and imaged, and the data is examined beneath the lock.
SQL and Exchange files that were caught mid write end up partially encrypted, and salvage then works page by page from the captured image.
If a NAS re-encrypts every restore, the device is still under the attacker's control, so it's isolated first and recovery then happens from images only.
The unknown extension is fingerprinted against the strain databases to find the family it belongs to and any published weakness.
Scareware displays ransom demands over files that are still intact, and some runs crash early, so a bench check works out whether you have suffered an actual loss or just a fright.
The current heavyweights of corporate attacks run thorough deletion passes that still don't remove everything.
It gets in through cracked downloads, and where an older offline key variant is involved, there is a free decryptor that is applied lawfully.
Some ransomware families make a duplicate copy of your files and then delete your original, which leaves the original sitting in free space, ready to be carved out.
Dharma and Phobos still get in through exposed Remote Desktop, and the encryption follows within hours of the login.
OneDrive and Drive dutifully synced the encrypted data over the good data, so version history and remnant data are checked at both ends.
Host-based VHDX encryption takes all of the guests down at once, but due to quirks in partial encryption, the guests can often still be rebuilt.
Nothing is actually locked, but all the data has been copied and there is extortion by threat of a leak, so forensic scoping becomes the focus rather than recovery.
The single disk that was connected on the night of the attack was the one that got hit. The sets that were out of rotation, along with carved remnants of data, fill the gap.
The malware worked through your storage encrypting the files one after another using entirely standard encryption. AES was used to encrypt the content of each file, and the AES keys were then sealed under an asymmetric key, with the private half staying with the attackers. The odd extension is the signature added by that particular strain, and a note is left once the run is complete. Serious families will also search for shadow copies, reachable backups and any shares the compromised account could get to, hence the smug tone of the demand. What it never admits is what the run missed, and there is almost always something.
There is no lab anywhere in the world that can brute force properly built encryption, so if any firm tells you otherwise, they are selling you a story. Realistic work looks for where the attack fell short. That could be snapshots and shadow copies the purge missed, backups the malware couldn't get to, originals that were deleted rather than encrypted when the strain worked on a copy, temporary files and fragments recovered from slack and free space, broken NAS or RAID structures rebuilt until clean data shows through, and the small number of families with published flaws that let a free decryptor be applied lawfully. Your free assessment will show which of these ways out apply in your situation.
We do not pay ransoms, we don't pass messages to attackers, and we will never encourage a client to pay. Giving an attacker money pays for their next campaign, guarantees you nothing, and criminal decryptors have a habit of wrecking the very files they claim to release. What we give you is every technical route tried, along with a written record of what came back and what stayed lost. If insurers and advisers later push a company towards negotiating, that decision is up to them. Our role was to make sure the technical answer came first.
Every ransomware case we handle is treated as a forensic incident from the first minute, which means it is isolated, imaged and documented:
Media from an incident is kept completely off the lab network and worked on at an isolated bench, so it can't spread, phone home or carry on encrypting data.
All incident drives are captured behind write-blockers before they are examined; all recovery is done on the copies and the original drives stay sealed.
Free space is searched for remaining shadow copies and also NAS snapshot data which the purge missed, and if anything is found, it is rebuilt into usable restore points.
From the ransom note and a couple of samples, the family is identified and then checked against reputable public decryptor sources (such as No More Ransom and vendor releases) to see if there is a lawful key available.
Unencrypted originals, temporary files and partial copies are carved out of free space: the debris every fast encryption run leaves behind.
Strain, blast radius and results are logged throughout, giving you the paperwork that insurers, regulators and your own post-incident review will all ask for.
Two commitments in writing before any work starts: no lab on earth can brute-force a strain that has no published weakness, ours included, and no ransom is ever paid or passed on through us. Ransomware falls into the forensic class of work: a free assessment first, then one fixed quote, paid upfront once you accept the fixed quote.
Before anything is posted, unplug the network leads and leave the affected machines alone: no antivirus scans, no reinstalling and no formatting, because each of these wears away the remnants that recovery depends on. Save the ransom note and a couple of encrypted sample files so the strain can be identified, then phone 0800 689 0668 for a quote first and to agree what should be sent. Capture is done on the isolated bench, and recovery only ever works on the copies.
Most customers get a quote first, by phone or with the free online diagnostic, and then post or courier their media to us.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive (from a server, every disk, each labelled with its bay), as we don't offer a drive-removal service. We don't recover storage soldered to a motherboard (for example T2 and Apple Silicon Macs and some thin laptops), only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll ring you as soon as we've diagnosed your media.
Not sure what to send? Ring 0800 689 0668 first or use the free online diagnostic.
Free diagnostic and a fixed quote, with ransomware work paid upfront once you accept it. Start now or call the freephone.