This South Yorkshire office had its house largely in order. "Our office network was infected with ransomware a few weeks ago", and "We were able to recover all our main data via a backup system" — yet "the drive on one pc has been encrypted", and that machine holds mail which never lived on the servers. Their request is narrow and sensible — "recover at least the e-mails from this drive" — an Outlook store on a drive now pulled from the PC. Ransomware encryption isn't a recovery problem in the usual sense: the data is intact but mathematically sealed, so the case turns on which of three genuine routes reaches that Outlook file — and on being straight that brute force is not one of them.
| Media | Single desktop drive encrypted by ransomware, removed from its PC — the wider network restored from backup, this machine's local Outlook data store the outstanding loss |
| Reported situation | Network-wide ransomware infection weeks prior · main data successfully restored from a backup system · one PC's drive left encrypted and unrestored · Outlook mailbox the recovery priority · drive isolated from the machine and available for examination |
| Fault class | Malicious file encryption on an otherwise healthy drive, with recovery contingent on shadow copies, incompletely encrypted regions, or a known flaw in the specific ransomware family, never on defeating sound cryptography |
| Equipment used | Drive imaged under a hardware write-blocker before anything, preserving the crime scene exactly · ransomware family identified from encrypted extensions, ransom note and file headers · Volume Shadow Copy remnants and unallocated space swept in X-Ways Forensics for pre-encryption versions · partially-encrypted files examined at hex level, since many strains encrypt only a file's opening portion · Outlook store parsed and mail extracted from any clean copy found, integrity verified |
Modern ransomware uses the same cryptography that protects banks, and that fact sets the honest boundary. Where a strain is implemented correctly, encrypted files cannot be reversed without the criminals' key — no laboratory, and no amount of computing, brute-forces it. Any service promising guaranteed decryption of arbitrary ransomware is selling a fiction, and the first duty here is to say so plainly.
What a laboratory legitimately does is exploit the gaps, not the mathematics. Real recoveries in these cases come from three places: shadow copies the malware failed to purge, files it encrypted only partially, and implementation flaws in specific families that researchers have already broken. None of these attacks the cipher — they find the data the encryption missed, or the mistakes its authors made.
The single-drive Outlook store is a genuinely favourable target. Many strains encrypt only the first portion of each file for speed — enough to make it unusable, but leaving the bulk of a large file untouched. An Outlook data store is typically very large, so a partial-encryption strain may have sealed only its opening while the mail archive beyond survives in the clear, extractable message by message.
Identifying the family is the step that decides the odds. The encrypted file extensions, the ransom note's wording, and the byte patterns at file headers fingerprint the strain — and public research databases record which families were poorly built or have had keys released. That the network backups restored cleanly is separately useful: it may mean this machine holds the only unique data, which focuses the whole effort on one file.
Imaging first preserves options that a repair attempt would burn. Everything is done against a write-blocked image so the encrypted originals stay pristine — decryption tools, if a family break exists, get applied to copies, and nothing forecloses a future solution should keys for that strain surface later. Running decryptors or cleaners on the live drive is how partial recoveries become total losses.
You get an honest range before we begin, not after. In the best case, shadow copies or partial encryption mean the emails come back intact. In the worst case, where the strain was implemented correctly and no shadow copies remain, they stay sealed and out of reach, and that is delivered to you as a finding rather than discovered by you after a bill.
Under a hardware write-blocker, an exact image of the drive's encrypted state was captured. By analysing this image, the ransomware family was identified from its file extensions, note and headers, and compared against public research. Shadow copy remnants and unallocated space were swept in X-Ways Forensics for pre-encryption versions of files, partially encrypted files were examined in hex to locate surviving bodies, and the Outlook store was analysed to extract emails from the cleanest copy found. Integrity was verified for everything recovered.
A crime scene image was taken of the drive and the strain was fingerprinted. Shadow copy remnants and partially encrypted file remains were searched in X-Ways Forensics, and the email was extracted from the areas the encryption missed. A free assessment and one fixed written quote, plus VAT; for ransomware work it is paid upfront once you accept the fixed quote. The decode: ransomware locks data using real cryptography, so no honest person can guarantee to crack it. Recovery happens in the gaps: shadow copies that were forgotten, files only half-sealed, flaws left behind by its authors. Your large Outlook file is typically where those gaps pay off.
Stop using the affected drive immediately and isolate it. Do not run decryptors, cleaners or recovery programs against the original, since these destroy the shadow copies and partial-encryption remnants that are your real chance of getting the files back. Do not pay for a service promising to break the encryption: sound ransomware cannot be brute-forced, and the honest work is finding what it missed. Keep the ransom note and a sample encrypted file so the family can be identified, and leave the drive alone as it is, on the chance that keys for this strain are released later.
Our case files are written up from genuine enquiries our lab has handled for customers across Sheffield and South Yorkshire, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.
A free diagnostic and a single fixed quote. In most cases you won't be charged unless we successfully recover your data. Start now or call our freephone.