Ransomware: data recovery
Files renamed and encrypted, with a ransom note on screen? Before you pay or wipe anything, talk to us – there may be other ways back.
What can be done
Depending on the strain, we may recover data from shadow copies, NAS snapshots, unencrypted file remnants, backups or synced cloud versions. Some older ransomware strains also have public decryptors.
First steps
Disconnect affected devices from the network and internet, but do not switch servers off if you can avoid it. Do not reinstall or reset anything.
Common questions
Should we pay the ransom?
That is your decision, but payment does not guarantee recovery. Speak to us and report it to Action Fraud first.
Can you help secure our systems afterwards?
Yes. We can help rebuild, patch and set up proper backups.
How long does a recovery take?
Straightforward cases take a few days; clean-room and RAID work can take longer.
Related pages
Deleted FilesEmptied the Recycle Bin or Trash, or deleted the wrong folder? On hard drives and memory cards, deleted files…
Formatted & Wiped DrivesFormatted the wrong drive, reinstalled Windows over your files or accepted a “format this disk” prompt? Quick…
Clicking & Beeping DrivesA clicking, beeping or grinding drive is a mechanical failure. Switch it off now – it is usually recoverable…
Water & Fire DamageFlood, spill or fire? Water and smoke damage can often be cleaned from drives and boards before the data is…
Failed RAID RebuildsThe rebuild stopped part-way, a second drive failed, or the array is now marked as crashed? Do not try again…
BitLocker & Encrypted DrivesEncrypted drives can be recovered when they fail – as long as you still have the password or recovery key. We…
Drive Not DetectedDrive not showing in File Explorer, Disk Management or Finder? It could be a cable, a board, firmware or a…
Photo & Video RecoveryFamily photos, wedding shoots and drone footage lost from a phone backup, card, drive or computer? We recover…
Dropped Drives & LaptopsDropped a portable drive or laptop while it was running? Knocks during operation are the classic cause of…
Get a price from a technician
Tell us the make, the model and what has gone wrong. A technician replies with a price and the quickest way to sort it – normally the same working day.
020 7237 6805 Creative IT workshopUnit 1, 80 Willow Walk, London SE1 5SY
Monday to Saturday, 9am–6pm