You arrive to find every document wearing an extension you have never seen, and a demand note in folder after folder stating that the attackers' own decryptor is the only route back home. The disks often disagree. PCs, servers and NAS devices from Norfolk businesses and households are gone through here for every legal way back, and paying the people responsible has never once been on that list.
Every ransomware job is diagnosed free. The quote is written and fixed before a screwdriver is picked up.
In most cases you only pay if we recover your data. Electronic, mechanical, chip-level and physical work is charged at 50% upfront. Ransomware, forensic, BitLocker and CCTV/DVR jobs are charged 100% upfront on acceptance of our fixed quotation. Please refer to the data recovery cost page for full details on costs.
The first job on every ransomware case is matching the symptom to the fault, and after over twenty years, these thirty account for almost everything that walks in the door.
Every user folder encrypted in one overnight run. This is the classic single-machine attack, and the way most cases arrive in our shop.
Internet-accessible boxes are the preferred targets. The snapshot trees under the shares survive the wipe more often than the attackers plan.
Hypervisor-focused strains go through the datastore one virtual disk at a time and bring down the entire virtual estate together.
Ransomware families designed for speed encrypt the first stretch of each large file and then skip straight on to the next one. Databases and archives usually keep usable remainders, which matters more than it sounds.
Shadow copies are erased before the encryption begins, as a matter of routine. Even then, deleted shadow copies can often be recovered from the free space.
"Plugged in" meant reachable; reachable meant encrypted. Old versions on it, and remnants, still count for a great deal.
In double-extortion attacks, the theft and the encryption both take place, and the attacker threatens to publish the stolen data. Whatever has left the network is scoped for the insurers and, where it applies, for the ICO.
Machines locked at boot can still give up their drives. These are imaged and examined under the boot lock, where the files have been all along.
SQL and Exchange files caught while being written end up partly encrypted and partly not. Salvage works page by page against the captured image.
A NAS that re-encrypts every restore attempt is still owned by somebody else. First, isolate it; then recover only from images.
Unknown strains are compared against the databases to identify a family, and any published weakness that can lawfully be used.
Some scareware puts ransom notes over files it never touched, and some genuine ransomware runs crash early. A bench check tells fright from actual loss during the free diagnostic.
The big names run deletion passes that are thorough but also imperfect. All recovery lives in the imperfect areas, and we have a good idea of where these tend to be.
The typical home PC case, arriving with pirated software. Older offline key variants have a free public decryptor, which is applied legally whenever it matches the sample.
Some families encrypt a copy and then delete the original, which leaves that original in free space where it can be carved. It's a design flaw we are very fond of.
Exposed remote desktop is still an open door, and encryption typically follows some hours after entry. The logs date that entry to the minute.
Cloud sync replaced good files with encrypted ones just as quickly as they appeared. Version histories and remnants are checked at both ends of that pipe.
Encrypted virtual disk files bring down every guest at once. Partial encryption habits often leave those guests rebuildable.
Nothing locked, everything copied, and a leak threatened. The task changes from recovery to forensic scoping, and the questions change accordingly.
The one disk that happened to be connected on the night took the hit. Off-rotation sets and carved remnants bridge the gap it leaves.
Scheduled tasks and services can run the malware again weeks later, normally in the middle of a restore. All images are swept for footholds before any rebuild is allowed to go live.
Some companies advertising recovery quietly pay the ransom, then present it as an example of their expertise. We recover from evidence, we tell you what is possible, and we don't carry any messages to criminals on anyone's behalf.
Newer crews remove the safety net before pulling the trigger, and they are very good at it. In many cases repository files keep a recoverable structure even so.
Some strains destroy without any decryption route existing, whatever the note says. This can be identified quickly and stated plainly, and then recovery works from leftovers and copies.
Some runs only encrypt small configuration files and ignore the large flat data behind them. Rebuilding from what they skipped restores whole machines.
Object-locked and immutable copies survive attacks that take everything else, because the attacker's own credentials couldn't delete them. When such a copy exists, it changes the whole job, and part of our assessment is finding out whether one does before anyone starts carving.
Some organisations pay the ransom before ringing anyone, and receive a tool that is slow to run, crashes on larger files, or corrupts whatever it touches. Files damaged by a faulty decryptor are their own recovery problem, so it's worth capturing everything before running it a second time.
Encryption on the desktop doesn't reach a hosted mailbox, but an attacker who took the login details can certainly delete from it. The retention and recovery windows in the tenant are limited and they are ticking, so that thread gets pulled early.
Sometimes virtualisation hosts are encrypted underneath machines that are still running happily in memory. Shut those guests down and you complete the attackers' job for them. There is an order to do it in, and getting it right can save the estate.
After an attack, the instinct is to rebuild quickly and start trading again, and the rebuild lands on top of everything that could have been recovered. If there is any chance the data matters, take the disks out and put them somewhere safe first. It costs an afternoon, and it has saved entire businesses.
The malware went through the storage encrypting one file after another using standard methods: AES on the data, and those keys then encrypted with an asymmetric key, and the private half of that key stays with those who sent it. That strange extension is the strain's signature, and when the run is complete, it writes out the note. Capable ransomware families will also delete shadow copies, chase down whatever backups they can reach, and sweep every share the compromised account had access to. This is why the ransom demand is written in such confident terms. It says nothing at all about what the run failed to reach, and a careful look almost always finds something.
No laboratory anywhere brute-forces properly implemented encryption, and a company that hints it might is selling you a story, not a service. Most of what gets advertised as decryption turns out to be negotiation with the attackers, resold at a markup. The honest version goes mining for the mistakes the attack made. Snapshots and shadow copies the purge missed. Backups that were offline, or just out of reach. Files deleted rather than encrypted, because the strain worked on duplicates. Temporary artefacts and fragments carved from slack space and unallocated space. NAS and RAID structures broken by the attack and rebuilt until readable data appears underneath. For the handful of families whose implementation flaws are public, a free decryptor applied properly. Which of these doors exists in your case is what the free assessment establishes, and it tells you plainly when the answer is none of them.
No money is ever paid from this bench, no messages are delivered to attackers for clients, and no one is pushed towards settling. The money goes to financing the next campaign, guarantees nothing, and criminal decryptors have been known to wreck the very files they were meant to release. Instead, you get every technical avenue followed to its end, and a written account of everything that did or didn't come back. If insurers or advisers later take the company down the negotiation path, that decision is theirs to own; our part was making sure the technical answer got there first.
Ransomware cases are run as forensic incidents from the first minute: isolated, imaged, documented, and only then recovered:
Incident media never goes back onto the network, and everything is examined on an isolated rig, so there is no way anything can spread, call home, or start encrypting again where it left off.
Attacked drives are captured behind physical write-blocking before anyone examines them. Recovery then works on the copies while the originals stay sealed.
Free space is scanned for remnants of shadow copies and snapshots that were missed during the purge, which are then rebuilt into restore points that actually restore.
The note and a few samples identify the family. That family is then checked against the public sources worth trusting for any lawful decryptor that exists.
Unencrypted originals, temporary copies and half-finished files pulled out of free space: the debris that each rushed encryption run leaves behind.
Strain, spread and outcome are documented as the work goes on, which is the paperwork that insurers, regulators and your own post-mortem all end up wanting.
Two written commitments before any work begins. If a strain has no published weakness, it won't be brute forced, not in this lab or anywhere else. And we don't pay ransoms, nor do we carry messages to the people holding your data. Ransomware is in the forensic class. Free assessment first, one fixed quote, paid upfront once you accept the fixed quote.
Before you even think about the parcel tape: pull the network leads out of the affected computers and leave them exactly as they are. Do not run antivirus scans, do not reinstall anything and do not format anything, because every one of those wipes away the fragments recovery depends on. Keep the ransom note and two or three encrypted sample files so that the strain can be identified, then call 0800 689 0668 and we will agree between us what should travel. Media comes tracked and insured, with your own courier, or in person to reception at our Cambridge location. Capture happens on the air-gapped bench and recovery only ever works on copies.
Most items arrive at this bench by insured and tracked post. We recommend getting a quote first, either by telephone or using our free online diagnostic, and once you have received your quote, simply post the item. Post is the steadiest way to move a poorly drive, and a parcel sent from Norfolk typically arrives on the bench within a working day.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Free diagnosis, one fixed figure written down, and in most cases you only pay if we recover your data. Start online or ring us.