Overnight, each document was given an unusual file extension, and each folder had a request for money. The attackers claim that only their decrypter can help get you back into your files. In reality, the drives usually show there are other ways to get back to your data. Drives from encrypted computers, servers and NAS systems across Swansea are checked here for all legal methods of getting back to the information on those drives, and paying the ransom is never one of them.
Free diagnosis for all ransomware jobs. We will give you one fixed quote in writing prior to commencing on your data recovery job.
Ransomware recovery is classed as forensic work, so it is paid upfront once you accept the fixed quote. On our other services, in most cases you only pay if we recover your data. This is true of all of them except for failure of electrical/mechanical components, chip level repairs, DVRs and forensic analysis. Our full price list can be seen at the cost of data recovery page.
All ransomware jobs begin with matching symptoms to faults, and these fifteen cover almost everything that reaches the bench.
In one overnight pass, all of the files in each of your folders have been locked. This is the single-machine attack, and it is the one we see coming through to the lab most often.
Internet-exposed QNAP boxes (Synology too) are prime targets; the snapshots below often survive a sweep.
Hypervisor strains lock every VMDK in the datastore and down an entire virtual estate with one pass.
Speed-optimised strains encrypt only the beginning (leading) blocks of massive databases and archives, and the remaining areas are often available to use.
Before the encryption, vssadmin will run on the system; in some cases, the deleted restore points can be carved back out of free space.
The attached external USB "backup" drive was accessible as well, therefore all data on the device was encrypted along with the rest of the devices' data, but earlier versions and remnants still count.
Stolen data prior to being encrypted, threat of publishing: we determine which data left the network for insurance purposes and for the ICO.
A ransom screen that appears instead of Windows; the drive is removed, imaged, and examined under the lock.
SQL and Exchange stores end up with some parts encrypted and other parts left unencrypted (rescued with each page recovered from the image).
A NAS that will re-encrypt every file you restore is still infected, so isolate it first, then use images as the only source of recovery.
Unknown file types/extensions and unknown notes are fingerprinted against strain databases to identify if they match a known family and/or published flaw.
Scareware may plant notes on top of files that have been left untouched, or the ransomware crashed before finishing its job, and a quick bench check can tell which one happened.
Current major players of the business attack, with extremely aggressive deletion passes that are still rarely completed.
The infection occurs through cracked versions of software that were downloaded. Older offline-key variants are decryptable for free using legitimate decryptors, which we apply lawfully.
Those strains which will create a duplicate file and then delete the original still allow carving of the original file from free space.
A typical ransomware run will walk your disk, encrypting file after file with a robust, standard encryption scheme: AES is used to lock down the content. However, the AES keys used for this process will be encrypted using an additional layer of security that is asymmetrical in nature. The private portion of the key used in this second layer will remain in the hands of the attacker at all times. The odd extension added to the files is the strain's identifier, and the ransom note is put out once the run has been completed. More sophisticated ransomware families will also remove Volume Shadow Copies from your system, hunt down any attached backups and sweep through every share the account could reach. This is the reason the note reads so confidently. What it fails to disclose is everything the run missed, and there is almost always something.
Brute-force attacks do not happen against well-implemented encryption. No laboratory that claims they have done so is being honest. Realistic recovery efforts are based upon identifying how an attacker failed: shadow copies and NAS snapshots (the deletion pass missed), backups out of the reach of the malware, originals deleted but not encrypted when the threat targeted a copy, unencrypted temporary files and fragments extracted from unused sectors, damaged RAID and NAS configurations rebuilt to reveal the original, intact data underneath them, and a small number of known-flawed strains where there are free, legal decryptors available. The free diagnostic will determine which of these "escape routes" apply to your specific situation.
We do not ever make ransom payments; we will not act as an intermediary or negotiator in your dealings with the attacker, and we will not try to get you to agree to payment. Payment does finance the next wave, has no guarantee of successful decryption, and decryptors offered by criminals have a well-documented history of being destructive when used (i.e. corrupting the very files they unlock). Instead, we exhaust all technical avenues available and provide a written document detailing what was recovered and what was not. Ultimately if an insurance company or adviser decides to take a business down the path of negotiations, this decision is their own. Our role is to ensure that the technical answer arrived first, before any decision to negotiate.
Each ransomware case is treated as a forensic incident from the very first minute, isolated, imaged, and documented:
Media from an incident never touches our lab's network: it sits alone on an air-gapped imaging bench. That way nothing can spread, call out, or pick up encrypting where it left off.
Incident drives are copied to an image using hardware write blockers before any examination. All recovery work is done on these images so the original drives remain unchanged as received.
All unallocated (free) space is scanned for the shadow copies and NAS snapshots the malware's purge missed; those remaining items are rebuilt back into usable restore points.
Once the strain has been identified from the note and a few samples, that identification is checked against the reputable, publicly available decryptor sources (No More Ransom, vendor releases etc.) in case a lawful key exists.
Unencrypted versions of original data, temp files and partial copies are carved out from the free space on media, the "debris" a rapid encryption run always leaves behind.
Logging occurs with every action taken in this process: the strain, the potential "blast radius", and exactly what was returned, creating the forensic record that your own internal review, insurers and regulators will each ask to see.
Two positions stated plainly and in writing: a strain with no published weakness cannot be brute-forced by us or anyone else, and we never pay a ransom, nor do we carry any messages between you and the attacker. As ransomware is a form of forensic work, our first step will always be a free diagnostic followed by one fixed quote for recovery, with payment upfront rather than only if we recover your data.
Prior to posting: pull all network cables and leave the computers in the same state, so do not run an AV sweep, reinstall, format, etc., because you will be destroying what little remains of the compromised system that recovery can feed on. Set aside the ransomware note(s) with two or three encrypted sample files for strain identification and contact 0800 689 0668 to obtain your quote and agree which drives to send: we require the drives, not the computers. All media is copied onto the isolated workbench; only the copy(ies) will be worked on.
First get a quote over the telephone or use our free on-line diagnostic. The majority of customers then have their media sent to us via post, this is tracked and insured.
Do you want to send a drive from your computer, laptop, MacBook, iMac, CCTV / DVR or server? Please do not send the complete unit of computer or device with a hard disk drive (HDD) or solid state drive (SSD) inside. Please remove it and only send the drive itself. For a server, please remove all disks and label them by their bay. We will also not perform removal of internal drives from devices in order to access data. Also, we will not extract data from devices where storage is soldered onto the motherboard (such as T2 and Apple Silicon Macs and some thin laptops). Additionally, we do not recover data from phones and tablets, only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Clearly mark the parcel with the name Bristol Data Recovery, and when your media has been diagnosed we will call you immediately.
If unsure about what to post, please call us first on 0800 689 0668 (the free phone number), or complete a free online diagnostic.
Diagnostic provided at no charge. Fixed quote, and as this is forensic-class work it is paid upfront. Start now or call the freephone.