The instinct is to do something. Most of what can be done in that first hour makes things worse. Isolate the infected devices from the network. Leave the infected systems on power since some encryption keys or other artefacts may still be stored in memory. Rebooting the system could remove those items. Don't run the ransomware's own decryption utility. Do not let anyone reinstall Windows over the top. Above all, make sure to disable (stop) any automatic backups, snapshots or cloud syncing immediately. This would ensure that if one runs automatically at a later time it won't overwrite your last good copy with the encrypted rubbish version.
Write down everything that you know about the ransomware attack as soon as possible: at what time did someone notice the problem; on which computers or servers do you see evidence of an encryption attack; what is the name of the ransom demand letter that has been sent; and in what way have the attackers modified the names of the files by appending some sort of suffix? The type of suffix added to each encrypted file identifies the ransomware family, which will determine if there exists a known solution (i.e., a published decryption tool) for restoring access to those files. Take a picture of the ransom demand letter rather than deleting it. If your company carries cyber insurance, inform the cyber-insurance provider prior to making any changes to how your systems function, because policies usually require the scene to be left intact.
Backups the malware could not reach. Anything that was offline at the time of the attack. Any data which cannot be changed (immutable). All systems the attackers didn't have credentials for. Most modern ransomware attacks first target backups and delete what they find, so the backups that remain intact will typically be either write locked or off-line. Check your backups: restore a sample somewhere in isolation as a test prior to trusting them again, because a backup that no one has ever used to restore from is nothing more than an assumption and does not qualify as a true backup.
Volume shadow copies and snapshots. Typically deleted, however, they are not always removed in total, and a lot of times remain as recoverable remnants on the disk. It's bench type work rather than something to try on the live system. That's also one of the reasons why you should not format/reinstall these drives.
The originals left behind by the encryption. Most people are unaware that many types of ransomware will write an encrypted copy and then delete the original, instead of overwriting the original in place. On a spinning hard drive the original will frequently remain entirely intact until something else writes over it. An image taken from the hard drive may then yield genuine, unencrypted versions of your files. The same does not apply as much with SSDs because TRIM will quickly erase the blocks containing deleted data. Finally, this method will not work at all if the computer has remained running and busy for a full week. So again, timing during the first hour is everything.
No. Not because of a moral viewpoint anyone needs to hear about, but because this transaction is generally very bad value. The money will be paid to a crook who has promised something, in a currency which cannot be recovered. Many of the decryptors may fail completely, partially succeed, or damage large files when they appear to have been successful. Paying marks your firm as one that pays ransoms, and repeat attacks on the same organisation are common. In fact, many times the attackers simply steal the data before encrypting it, and therefore the payment merely gets you a decryption key, but gives you no control over the version that they stole.
Firstly, check if the family has already been beaten. The No More Ransom project, which is run with Europol and a group of security companies, publishes free decryptors for a long list of families, and identifying yours by the file extension takes just minutes. It will not cost you to look and on occasion it will stop all of this on the spot. We will not arrange a ransom payment or negotiate on your behalf, and we will tell you honestly if your only route back is a clean rebuild from a backup.
Ransomware work is forensic-classed here, so it is quoted and billed upfront in full prior to the commencement of services, and it is not covered by our usual terms, where in most cases you only pay if we recover your data. We feel that this policy should be clearly identified versus being obfuscated, since forensic work can be a time-consuming process. Manual processes are employed to attempt to recover data; therefore, there are no assurances regarding the successful recovery of data, and we do not believe it would be honest to suggest otherwise. A free diagnostic remains available to determine what has survived an incident. No charges will be incurred to identify surviving content, and that assessment is finished within 2 working days of the media arriving.
Get a quote first by phone or with our free online diagnostic tool and then send in the drives themselves (not servers, not machines). Pull the disks from each bay, label each one to indicate which bay it came from and post them tracked and insured, or use your own courier that you book and pay for yourself, or deliver them in person to the counter at Edinburgh Data Recovery, 4 Redheughs Rigg, Westpoint, South Gyle, Edinburgh EH12 9DQ, open Monday to Friday, 9am to 5:30pm, with no appointment needed. We do not pick up anything from your premises; there is no such service here. Every disk is read-only imaged so that the evidential state of your media will be preserved for insurers and for anyone who wants to look at it later. Please call us on 0800 689 0668 to flag the job before the parcel arrives.
The major expense of most breaches is not the encryption, but the scheduled backup that runs four hours after an attack and copies the mess over the latest clean set. Immediately halt all automated backups, snapshots and syncs as soon as a breach is suspected: do this before you do anything else, and before anyone reboots anything. This single action has likely helped save more north-east businesses than any other product they have purchased since.
The diagnosis is free and takes 2 working days once your disk arrives at our premises. The figure quoted is fixed and given to you in writing, and on logical work, in most cases you only pay if we recover your data. Begin online today or call us.