Every folder now has a ransom demand in it, all your documents have picked up extensions you've never seen before, and the criminals tell you they are the only ones who can get you access again. It's normally only half the story. We examine encrypted PCs, servers and NAS units for Sheffield homes and businesses and pursue every honest route to your data, and we never pay ransoms.
Free diagnostic on every ransomware job. We will always provide a fixed price quote in writing before commencing any work.
On most jobs, you only pay if we recover your data. For electronic, mechanical and chip-level work, we'll take half up front and the rest only if we're able to recover your data. Jobs involving BitLocker, ransomware, forensic or CCTV/DVR work are paid upfront once you accept the fixed quote. Complete pricing can be found on the data recovery cost page.
Every ransomware case begins by matching the symptoms to the fault, and these ten symptom and fault combinations cover virtually everything that reaches our bench.
Every document, photo and desktop file renamed and locked in a single overnight run on a single machine (the classic attack we see most).
Internet-exposed NAS boxes are a favourite target, but snapshots and remnants beneath the encrypted shares often survive the sweep.
Hypervisor attacks sweep the VMFS datastore and lock every VMDK within it, taking down an entire virtual estate in one pass.
Speed-tuned strains only encrypt the beginning blocks of large database and archive files, and in many cases the untouched remainder of the file is still usable.
Most strains use vssadmin to remove restore points prior to encrypting, but in some cases we can carve the deleted copies back from free space.
Any USB backup drive or backup share that was attached and reachable at the time of the attack will have been hit too, but earlier versions and remnants are still worth chasing.
Your data was stolen before it was locked and publication is being threatened, so we document what was taken off the network for insurers and ICO reporting.
The PC boots directly into a ransom screen instead of Windows, so the drive is removed, imaged, and the file system is analysed underneath the lock.
SQL and Exchange stores that were active during writes end up part-encrypted and part-corrupt, and they are salvaged page by page from the image where they survive.
A live infection keeps re-locking any data you restore, so we isolate first, then recover from images rather than on the infected computer.
An extension and a ransom note that no search engine recognises. Samples are fingerprinted to determine which family they belong to and whether any weaknesses have been published for it.
In some cases, scareware plants the note without doing any real encryption, or the encryption run was interrupted and failed partway. A quick lab check can turn panic into relief.
Ransomware attacks your stored files one by one. Each file is encrypted using strong, industry-standard encryption. Typically this is AES for the files themselves, and those AES keys are then wrapped in an RSA or elliptic-curve key that only the attacker has. The file name extensions you see (.lockbit, .akira, .medusa and hundreds more) show which strain of ransomware was used. Once all your files have been encrypted and renamed, the ransomware generates the note left in each folder as it completes its run. Many capable strains also remove Volume Shadow Copies so you cannot restore your files from an earlier point in time. They look for backup drives and try to encrypt anything the infected user's account can reach across the network. This is what makes the note sound so confident. What it never mentions is everything the attack missed.
When a ransomware strain's encryption is built properly and the keys are beyond anyone's reach, no lab on Earth will be able to brute-force the contents of the files, and anyone who says they can is selling false hope. Real recoveries come from whatever the attack failed to finish: shadow copies and NAS snapshots that survived the deletion pass, backups the malware could not reach, deleted originals left on disk where a strain encrypted a duplicate and then deleted the source file, unencrypted remnants and temporary files recovered from free space, damaged NAS and RAID volumes rebuilt so the intact data beneath them becomes readable again, and (for the minority of strains with a published flaw) a free public decryptor applied lawfully. The diagnostic determines which of those routes exist in your case before you commit to anything.
We will never pay a ransom or encourage you to do so. The money funds future attacks, does not guarantee anything, and the decryption tools criminals provide are notoriously slow, buggy and incomplete. Our job is to pursue every possible technical route first and then set out in writing exactly what is and isn't coming back. We cannot promise to recover data encrypted by a strain with no known weakness, because nobody honestly can. If a business with insurers and regulators involved ultimately chooses to negotiate, that decision rests with the business and its advisers; what you will have from us is a recovered copy of everything recoverable and a straight account of the rest.
Ransomware jobs are treated as forensic cases from day one, with all affected media immediately isolated, imaged and documented:
All media that contains encrypted data is worked on at an isolated workstation that cannot communicate with the lab network, so nothing can spread, contact remote command servers or start encrypting again while we work on recovering your data.
Each drive from the incident is imaged read-only before any analysis begins. The recovery itself takes place solely on the copies, so your original drives leave exactly as they arrived.
Deleted Volume Shadow Copies and NAS snapshots are sought out throughout unallocated space and reconstructed wherever the malware's deletion pass left them intact.
The ransom note and sample encrypted files are matched against strain databases, then checked against reputable public decryptors (No More Ransom and vendor releases) for a lawful way in.
Unencrypted originals, temporary files and partial copies are carved out of free disk space: the debris left behind by an encryption run that moved quickly through the system.
The strain, the scope of the damage and exactly what was recovered are documented at every step, giving you the paperwork insurers, the ICO and your own post-incident review will ask for.
Two points stated plainly at the start. First, if there are no known weaknesses in a particular ransomware strain, we can't promise anything, because properly implemented encryption can't be broken without the key. Second, we will never pay ransom demands or act as a go-between with attackers. Ransomware is classed as forensic work: the cost is quoted after the free diagnostic, and the price is paid upfront once you accept the fixed quote.
Before posting anything, unplug the infected machines from the network and leave them exactly as they are (do not reinstall, run an antivirus cleanup or format), since each of these destroys the remnants we need to recover from. Keep the ransom note and set aside two or three samples of the encrypted files. Then get a quote first by calling 0800 689 0668 or using our free online diagnostic, and we will agree exactly what to send: the drives, not the machines. Everything is imaged on an isolated bench and all work is done on copies only.
Our customers get a quote first, before sending their media to us, either by telephone on 0800 689 0668 or by completing our free online diagnostic. Once a customer has their quote, they post their media to us, tracked and insured.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the hard drive or SSD from your machine and send us just the drive; we do not offer an internal drive-removal service. If you have a server or RAID system, please send us every disk, each clearly labelled with its bay. We cannot recover data from storage that is soldered directly onto the motherboard (for example Apple Silicon Macs and some thin laptops), so we need removable drives to be sent to us. If you are unsure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark your package for the attention of Leeds Data Recovery and we will contact you as soon as we have diagnosed your media.
Unsure about what to send? Call us first on 0800 689 0668 or complete our free online diagnostic.
Receive a free, no-obligation diagnostic and a fixed price quote for your ransomware issue. The price is taken upfront when you agree to proceed. Get started now or call our freephone.