By the time the ransom note is on your screen, the attacker has already finished. Your systems, though, will continue to be automated until you stop them, and the difference between having a bad week and a disastrous one may depend entirely upon what your automated processes do to themselves over the next few hours.
When your attacker finished encrypting, their clock stopped. Yours carried on, and it will keep running for as long as anything on your systems copies data on a schedule: the nightly backup job, the hourly snapshot, the replication link to the second site, the folder sync running quietly on every desktop. These same systems cannot determine if the changes made to files are valid or malicious. They see that files have been modified and they treat them in exactly the way they were configured to, which means pushing the modified version over the last good copy and then retiring the older version underneath.
The very first thing to do is not to isolate, although that can be a very appealing option. Immediately stop all of the scheduled backups, snapshots, replication tasks and sync clients that are under your control, including the ones you had forgotten about. This represents by far the most expensive mistake which reaches this bench, and in the vast majority of these cases it was not anyone's fault: the job simply ran exactly as designed, on schedule, and traded the last clean copies for encrypted ones. Freeze the lot, and work out afterwards what survived.
Then contain it. Unplug the network cables and disable the wireless on the affected machines; however, leave their power on wherever practical, as in many cases volatile memory still holds process and key material which is lost the instant the power goes. Take a photo of the ransom note. Keep one encrypted file and, if you can locate one anywhere, an untouched copy of the same file from before the attack, since that pair of files is often what identifies the strain. Record what time it was noticed, as surprisingly enough the gap between the run starting and the first person noticing it turns out to matter to almost every question raised later.
Before you start building any plan, take two minutes to look at the No More Ransom project. Law enforcement agencies and security researchers have broken a considerable number of strains over the years, either by finding flaws in how they were implemented or by seizing key material during a takedown, and the decryptors that result are published free. Upload the ransom note and one locked file and the identification service will check whether yours is among them. Once in a while it closes an incident within the course of an afternoon, at no cost.
No one can provide a method to break the encryption itself once it has been done competently. The modern strains use standard and widely tested algorithms, with each file's own key then wrapped in a public key held only by the attacker, and no laboratory anywhere in the world can crack that. Any firm claiming otherwise is describing a sales pitch instead of mathematics. Everything useful that follows comes from somewhere else entirely.
The first is whatever the run did not finish encrypting. Encrypting an estate takes time, makes noise and can be stopped at any point: someone notices it, a laptop goes to sleep, a share disconnects or a service crashes while it is in progress. Partially encrypted files are very common: headers that are scrambled while the rest of the file reads perfectly, whole directories skipped over, a server that was powered down for the evening and has been untouched since. This is why the first truly valuable document produced on one of these jobs is an inventory that separates the files which really have been encrypted from the far larger number that simply look as though they were.
The second is the deleted originals, and this is where most of the good news comes from. A lot of strains don't overwrite your original files in place. Instead, they read them, create an encrypted copy alongside under a different name, and then delete the original. When a file is deleted, its pointer is cleared but the actual content remains sitting in unallocated space until something needs to reuse that room. Reading the disks properly at sector level can often bring back a substantial share of the pre-attack files intact. That process doesn't involve any cryptography; rather, it is ordinary recovery work applied to an unusual cause, which is exactly why it is priced like ordinary recovery work.
The third is anything the attack could not reach. A disk rotated into a safe, an archive tape, or the external drive somebody unplugged in March and never connected back up: whatever was disconnected during the run will normally be clean, and that is the whole argument for keeping at least one copy of your data that does not live permanently attached to the network. Many cloud services also hold versioned copies of your files; however, this only lasts for a fixed retention window, so establish how long that window is before building a plan on it. Windows shadow copies are worth checking for the same reason, although many strains delete them on the way through, and even then a deleted shadow copy leaves its blocks on the disk in the same way a deleted file does.
Some laboratories will pay the ransom for you, put the decrypted files on a disk and bill the whole thing as data recovery. This does happen in this trade, but it is not on offer here, and the reasons are practical well before they are ethical. Decryptors handed over after payment are frequently defective or only partly useful, and quite often they fail to turn up at all. When you pay, you mark yourself as a victim who pays, and repeat attacks against the same victims are well documented. Several of these groups operate under sanctions regimes, which then makes the decision to pay a legal one for you and not for them. And each payment helps fund the next round of attacks.
It is just as important to be plain about what this bench is. It is not an incident response retainer and it is not a negotiator. It reads storage. For commercial work, what it adds is documentation: a record of custody for each disk from the moment it arrives, so you can give an insurer, a regulator or a solicitor a clear account of where the media has been, and a non-disclosure agreement whenever you want one. If you would also like to establish how the attacker got in or what they took out, then that is a forensic investigation with a full written report costing £800 + VAT, which is a service you ask for on purpose. It is never tacked onto a recovery quietly, and most businesses getting back on their feet after an attack have no use for it.
The pricing follows the hardware, exactly as it does for every other job on this site. An individual encrypted drive is £300 + VAT. Servers, NAS boxes and arrays are from £500 + VAT, with the cost increasing with the number of member disks and the condition in which they arrive. Ransomware work is paid upfront once you accept the fixed quote. It is not priced as though it were a forensic investigation, whatever you may have been quoted elsewhere: the fact that the cause was criminal does not change what the bench physically has to do to the disks.
First get a quote over the phone on 0800 689 0668 or use our free online diagnostic, then send storage, not furniture. From a server or array, send the disks themselves, each labelled with the bay it came out of; from a NAS, the disks labelled the same way if you can remove them, otherwise the NAS itself; and a single external drive goes whole, in its enclosure, with its cable and power supply. Pack it so nothing moves during transit and post it tracked and insured to Guildford Data Recovery, Building 2, Ground Floor, Guildford Business Park, Guildford, GU2 8XH. From the estates off the A329(M) or anywhere along the M4 it is close enough to be a lunchtime run if somebody wants to drive it (about forty minutes and eighteen miles from Bracknell via the A322 and the A3), and you can drop it off at the lab Monday to Friday, 9am to 5:30pm, without an appointment. There is no collection service anywhere on this network, so nothing in the job hangs on a driver being free.
Get a quote first: phone 0800 689 0668 or use the free online diagnostic before the parcel leaves, describe what the attack has stopped the business doing, and we then flag the job ahead of its arrival. The assessment is completely free of charge and closes 2 working days after booking in. It comes back with four things: an itemised inventory of what has actually been encrypted, a rough estimate of how much may be recovered from the deleted originals, a yes or no on whether a publicly available decryptor exists for your particular strain, and one fixed price.
For the first hour after an attack, nothing you own is more dangerous than your own schedule. Backups, snapshots, replication and sync services are all unable to distinguish malicious changes from legitimate ones, and if they are allowed to continue running they will happily overwrite the last good copies of the data with encrypted versions. Stop each and every one of them before you touch anything else.
Free diagnostic completed within 2 working days of booking in your device, then one fixed written quote, and for ransomware work that quote is paid upfront once you accept it (on our other services, in most cases you only pay if we recover your data). Cards and USB sticks £250 + VAT, and any single drive or SSD £300 + VAT.