All files with extensions that are unfamiliar to you. The identical "demand" note inserted into all folders. Plus, a claim by the attackers that their own decryptor is your only means of getting back in. Quite often, the disks say otherwise. Here, we check for all possible legal ways back on your PCs, servers and NAS units. Paying those that committed the crime has never been one of our options.
Any ransomware job is always no cost to diagnose. The fixed amount will be sent to you in writing first, before anything else happens.
In most cases you only pay if we recover your data. The exceptions are electronic/mechanical failures, chip level work, DVR and forensic jobs. All pricing information can be found on the data recovery cost page.
The initial step in resolving a ransomware issue is to match the symptoms of the malware to the cause of the problem. After twenty-odd years, these twenty-five cover nearly every case that ends up on this bench.
All files within every user folder were encrypted during one pass without anyone looking at the screen. This describes the typical single-system attack, and how most cases get to us. What matters next is that the machine stays off.
A system that can be reached via the internet makes an ideal victim. In general, snapshot trees below the network shares survive the purge much more frequently than the attacker intends.
Ransomware strains that aim for hypervisors work their way through datastores one virtual disk at a time until they bring all virtual systems down. Guest VMs can often be rebuilt because partial encryption patterns leave behind enough data.
Families that are optimised for speed will encrypt the beginning portion of each large file, then move on. Databases and archives generally have enough remaining unencrypted portions (which count for more than you might realise) to make it worthwhile to attempt to recover them.
Attackers routinely delete all the shadow copies before they begin encrypting; however, deleted shadow copies can frequently be carved back out of free space after they are deleted.
Being plugged in made it accessible. Accessible made it a target. The older versions on that drive, as well as the remaining fragments surrounding those versions, continue to hold significant value when the drive is imaged.
Stealing data combined with encrypting the data along with a threat to release the stolen data constitutes double extortion. Any piece of information leaving the network will be evaluated for your insurers and (if applicable) for the ICO.
Although a boot-locked computer does not allow access to any files or drives at the time of the lock, it is possible to image the drives and examine the contents below the lock. Your files remain intact and unchanged throughout this process and were not altered in any way by whatever appeared on the screen.
When caught during the middle of writing, SQL and Exchange files may end up half encrypted and half unencrypted. To salvage these files, recovery occurs on a page-by-page basis using the captured image and never the live file.
If a NAS device re-encrypts every restore attempt, it is still someone else's device. First isolate the device. Then recovery only uses images and never the device itself.
We find out what the unknown strain is through comparing its fingerprints against the databases, looking for a family name and for any published weaknesses that the law permits us to use against this particular family. Since we then know what family has infected your computer, we will also know what it typically fails to erase when deleting information.
Files no one has touched (and now have ransom notes scattered among them because of scareware), as well as genuine encryption runs that crashed early, both arrive here. The bench check in the free diagnostic will identify if you've suffered a "genuine" loss or just been frightened.
The home PC standard arrives with pirated software. There is a free public decryptor available for older offline-key versions, and if the sample matches the type we can legally use it to decrypt the files.
Some families create a copy of each file and encrypt that, then they delete the original version of the file. The deleted original remains in unallocated space, and in many cases carving retrieves the deleted original file. This is a design oversight that we love.
When remote desktop access was left accessible, it remains an open door, and encryption follows a few hours after the entry. Logs date the entry time down to the minute, which is crucial for insurers.
The files that appear to be encrypted in your computer are synced back to your cloud storage service as fast as they appear, replacing the good ones. The version history of those files is then checked, along with remnants, at both ends of that sync.
Scheduled tasks and services can cause malware to be set off again several weeks later, usually in the middle of a restore operation. Therefore we will be scanning all the images for possible entry points for malware prior to proceeding with any production rebuilds.
There are firms that advertise their ability to help with recovery but in fact they quietly pay the ransom and call that "expertise". We recover from the evidence, tell you what is achievable, and communicate with criminals for no one.
Modern attack crews are experienced at pulling the trigger after taking away the safety net. Often repository files will have enough recoverable structure regardless of what the console says about them.
There are some malware strains which totally wipe out systems without there being any known method of decrypting your data, whatever their ransom note promises. We determine this early on and let you know plainly. In these cases, restoration relies upon remaining bits of information and/or copies.
Files stored as immutable or object-locked copies can survive attacks that result in loss of all other files because the attackers' credentials could not delete them. Whether such a copy exists will affect the whole project. As a result, determining if an immutable/locked copy exists will need to occur during the assessment phase prior to starting the carve process.
Plenty of businesses have paid before contacting anybody, and found the tool they bought was too slow, crashed when working with larger data files, or corrupted anything it worked with. A faulty decryption tool creates its own recovery issue, so the first thing to do is to take images of everything prior to running that tool again.
Encryption on a local computer does not reach mailboxes stored in the cloud. Deletion by an attacker using the legitimate login credentials certainly does, and inside your tenant the retention and recovery windows are limited and already running down, therefore this should be addressed immediately.
The virtualisation host may be encrypted underneath guest systems still running in memory. Power the guests off and you complete the attacker's work on their behalf. There is an ordered process for doing this properly, and following that process can save your environment.
Instinct tells us that after an attack we should "rebuild" as quickly as possible and be back in business, trading etc. However, this rebuild can fall very heavily on those things that may yet have some recoverable elements. If you think your data might matter, pull the disks and put them aside from all else immediately. A few hours of waiting around has saved entire businesses.
Nothing special about this one. The malware went through the storage encrypting it file by file, using what was basically normal encryption. AES over the content. Then each of those keys was encrypted again using a second key (the second key being asymmetric). The private half of that asymmetric pair remained with whoever sent the malware. The unique extension name tells us which strain we are dealing with. And the final note is appended at the very end of the run. Better-organised groups have methods beyond simple encryption. They will clean up shadow copies as well as find any backups they can get to via the network, and in general, cover all shares that were writable by the compromised account. This is why their ransom notes read so positively and confidently. It is also why the note stays quiet regarding anything the malware didn't actually get to, and a careful search almost always finds some of it.
There isn't a lab on this planet that can brute-force an implementation of proper encryption. Any company claiming they can do this (or potentially hinting that they may) is simply marketing a story. In many cases, what companies market as decryption is actually simply negotiating with the criminals involved and then selling the results back to victims at some sort of profit margin. Legitimate efforts are focused on finding anything that the attackers missed. Such things include snapshots that still exist after the purge; shadow copies of files that existed but were inaccessible during the time frame of the attack; backups that had been taken offline prior to the attack or were otherwise out of reach; original versions of files that the strain deleted instead of encrypting them, because it worked on copies. Additionally, legitimate efforts will often seek temporary artefacts such as deleted file fragments carved from slack and/or unallocated space. Also, legitimate efforts will also attempt to recover data from NAS/RAID structures broken by the attack. Wherever a particular strain has a documented public implementation issue, legitimate efforts will use a free decryptor (properly applied) to assist in recovery. After conducting a complimentary assessment, we determine which one of these potential avenues is available in your specific situation. Finally, if no viable avenue exists, our complimentary assessment provides this information clearly.
There are no payments made; there is never a communication sent to an adversary in the name of a customer. No one at this firm urges anyone else into settlement negotiations. Rather than being driven by morality, the reason for these restrictions is due to the practicality of the situation: paying the money would fund the next campaign, the attackers' promises can't be enforced, and criminal decrypters have shown poor results in restoring the encrypted data they do decrypt. In place of that, all the technical routes that were attempted to their fullest extent are provided along with a detailed write-up describing which attempts succeeded or failed. Whether or not companies, their insurers and advisers later choose to negotiate is entirely up to them. Our role was to ensure that the technical answers arrived first.
Once ransomware activity starts, we treat it as a forensics incident from the opening minute. Isolate, image, document, and don't start recovery until those three are done:
All media gathered during an incident will never be allowed to connect to a network. All analysis of evidence will be performed on an isolated workstation. Any code on the workstation cannot spread, contact the attackers for additional instructions, or continue encryption at the point it left off.
Drives from an attack are captured behind physical write blocking before anyone has access to look at them. When there is a copy (and there is), recovery can be done on it, while the original remains sealed.
We go through free space to find any shadow copies or remnants of snapshots that the purge overlooked; we rebuild these into usable restore points that can actually restore data.
If there is evidence (via a ransom note along with a few samples) identifying what type of malware was used (the "family") we check that against whatever trustworthy public source(s) exist to determine if a legal decryption tool exists.
All non-encrypted originals, temporary copies, partially encrypted files etc., are extracted from free space since every hasty encryption attempt leaves such debris behind.
The strain, its spread and the outcome are recorded as the work proceeds. This documentation will eventually be requested by your insurance company, the regulator, and yourself during your post-mortem.
Before any work is done there are two written undertakings. If there are no documented weaknesses for a given strain then this lab and everybody else's labs do not try to brute force it. Also, no money will be paid by us to the criminals at the other end of any ransom demands that might have been sent, and no message at all goes to them. Ransomware belongs to the category of forensic recovery, i.e., first we'll assess your loss for nothing, next we'll give you a single fixed price quote, and finally you pay us before we start working rather than under our normal conditions, where in most cases you only pay if we recover your data.
Don't worry about parcel tape. First, pull all of your network cables off the machines impacted and leave them standing as they are. Do nothing else: don't do an AV scan, don't reinstall anything, and don't format anything. All of these actions destroy the remnants that recovery uses. Save the ransom note. Save two or three of the encrypted files so that we know which type of malware this is, as this is how the strain is identified. Call us on 0800 689 0668 first to get a quote for the work required, and we will settle what needs to be sent. Media goes tracked and insured, via a courier service booked by you, or is delivered to us in person at our Edinburgh lab. The lab is open Monday to Friday, 9am to 5:30pm, and you need make no appointment. The capture process takes place on our air-gapped system. We never touch the original copy.
Get a quote first by telephone or use our free online diagnostic. Most of what you see on this bench will then be delivered via tracked, insured post. This is one of the safest ways to move a failing drive and packages handed in at a North-East post office are normally delivered here the next working day.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Free diagnosis, one fixed price quoted in writing, and in most cases you only pay if we recover your data. Start online or phone it in.