Ransomware encrypts files on a computer or server and demands a ransom for the key. Attacks affect private users as well as companies, and not every attack can be fully reversed. The sooner you act, the better the chances.
What to do immediately: disconnect the affected computer from the network and from all external drives, do not delete anything and do not reinstall the operating system. Every change to the system can destroy traces that are needed for recovery.
The first step in the laboratory is a sector-by-sector image of the affected drive. All further work is done on this copy. Depending on the ransomware family, a decryption tool may exist; in other cases, unencrypted copies, older file versions or deleted original files can sometimes be recovered from the drive. Unfortunately this is not always successful, and paying the ransom does not guarantee that you get your data back either.
The best protection against future attacks is regular backups stored offline, plus a careful check after recovery to make sure that no traces of the malware remain.
Data recovery process
Be vigilant and do not attempt to salvage the data on the device yourself. This can make recovery impossible.
Data recovery from storage media from all manufacturers
All orders are processed exclusively in our Berlin laboratory. The data recovery from mechanically defective hard drives takes place within a dust-free environment of our clean room workbench of clean room class 100.
Frequently asked questions about data recovery after ransomware
Yes. Many ransomware variants also send data to the attackers or give them remote access to the computer.
Yes, it can be. Companies should check whether the attack has to be reported under the GDPR.
Yes. Ransomware can encrypt connected external drives as well as shared drives and other devices in the local network.
Sometimes. It depends on the type of ransomware. For some variants decryption tools exist; in other cases parts of the data can be recovered from unencrypted remnants on the drive.
The cost depends on the type of ransomware and the effort required. The diagnosis is free of charge. Details: Prices.