Skip to main content
Ransomware recovery

Ransomware data recovery: isolate it, then call.

Ransomware encrypts files and demands payment for the key. What you do in the first hour decides how much can be saved: stop it spreading, keep the evidence, and find out which backups survived. Per DriveSavers, their engineers recover data after ransomware attacks, whether or not anyone has contacted the attacker yet.

Start a case with DriveSavers Ask us first: (585) 388-8780

What to do right now

  1. Disconnect it, don't shut it down. Unplug the network cable, turn off Wi-Fi, and disconnect external and network drives so the encryption can't reach more files. Per DriveSavers, powering off can erase evidence held in memory, so only shut it down if you can't disconnect it.
  2. Don't wipe or reinstall. Reinstalling Windows destroys the encrypted files and the evidence a lab or investigator needs.
  3. Keep the ransom note and the encrypted files. Photograph the note on screen. The note and the new file extension often identify the ransomware family.
  4. Check your backups, offline. Find out which backups exist and whether they were connected when the attack happened. Don't connect a backup drive to an infected machine.
  5. Call DriveSavers before you contact the attacker. Per DriveSavers, their consultation is free and reviews options that may cost less, and take less time, than paying.
  6. Report it. Report the attack to the FBI at ic3.gov. Businesses should also contact their IT provider and their cyber insurer, if they have one.

Your options

Restore from a clean backup

The fastest route, if a backup was disconnected or protected when the attack happened. Restore onto a cleaned or rebuilt system, not the infected one.

Free decryptors

Security researchers publish free decryptors for some ransomware families. The No More Ransom project, at nomoreransom.org, lists them. If a decryptor fails or damages files, per DriveSavers they recover data corrupted by unworkable decryptors.

Lab recovery

Per DriveSavers, they repair encryption damage to critical files such as virtual disks, backup files, and databases, recover older versions of data the attack missed, and search other sources such as tape and cloud. Start a case with code DS22831 for 10% off.

Paying the ransom

The FBI does not encourage paying a ransom. Per DriveSavers, payment does not ensure you receive the decryption key, and it funds further attacks. If it is being considered, involve law enforcement and your insurer first.

For businesses

Per DriveSavers, they work alongside incident response firms, digital forensics teams, data privacy law firms, and cyber insurance carriers, and can work under privilege and report progress to your counsel. In one of their case studies, they used secure remote methods to restore a law firm's SQL Server databases, Veeam backups, and virtual machines after an attack.

Two ways to start

Path 1 · You know it's the drive

Go straight to DriveSavers

Files encrypted and no clean backup: start a case with DriveSavers and use code DS22831 for 10% off. Per DriveSavers, the consultation is free.

Start a case
Path 2 · You're not sure

Bring it to us first

Not sure it's ransomware, or just a scary pop-up? Keep it disconnected and call us. A diagnosis at our Fairport shop runs around $50, and if it is ransomware, we'll point you to DriveSavers with our code.

Call (585) 388-8780

J&N referral code

10% off your DriveSavers recovery

Give DriveSavers this code when you start your case, or use our referral link, and they'll take 10% off. Mention it up front: it can't be added once a job is already underway.

DriveSavers Data Recovery authorized reseller: get discount code
DS22831
Use our referral link

Ransomware recovery questions

Can files encrypted by ransomware be recovered?
Sometimes. A clean backup is the most reliable route, and free decryptors exist for some ransomware families. Per DriveSavers, they repair encryption damage to virtual disks, backup files, and databases, recover older versions of data the attack missed, and recover from other sources such as tape and cloud. Isolate the machine and keep the encrypted files and the ransom note in the meantime.
What should I do first after a ransomware attack?
Disconnect the machine from the network without shutting it down, don't wipe or reinstall it, photograph the ransom note, check which backups were disconnected at the time, and report the attack to the FBI at ic3.gov. Per DriveSavers, contact them as soon as possible, whether or not you've contacted the attacker.
Should I pay the ransom?
The FBI does not encourage paying a ransom. Per DriveSavers, payment does not ensure you receive the decryption key, and their free consultation reviews options that may cost less. Try backups, free decryptors, and lab recovery first, and involve law enforcement and your insurer before any decision.
Will reinstalling Windows remove ransomware?
A clean installation removes the infection from that machine, but it also destroys the encrypted files and any chance of recovering them. Preserve the encrypted data first, or send the drive to a lab.
How do I protect against ransomware next time?
Keep at least one backup that is disconnected or versioned, so ransomware on the computer cannot reach it, and test that it restores. Keep Windows and your software updated.
What does data recovery cost?
It depends on the device and what's wrong with it, so DriveSavers quotes each case after a free evaluation. Per DriveSavers, if they can't recover your data, you don't pay for the recovery. Our code takes 10% off the recovery.
How do I get the 10% off?
Give DriveSavers our referral code, DS22831, when you start your case, or start it through the referral link on this page. The discount is applied by DriveSavers, so mention the code before the job begins; it can't be added to a case that's already underway.

Other recovery guides

Clicking or dead hard driveClicking, beeping, grinding, or not spinning. SSD and NVMeNot detected, wrong capacity, or files deleted. RAID and NASFailed arrays, rebuilds, Synology and QNAP. External drives, USB, and SD cardsNot recognized, dropped, or asking to format. Phones and tabletsWon't turn on, water damage, broken. Deleted and formattedDeleted files, formatted drives, lost partitions.

Start from the main page: data recovery through DriveSavers, or data recovery in Rochester, NY.

Near Rochester Rochester Fairport Penfield Pittsford Victor Webster Gates Greece Hilton

Isolate it, then start a case.

Keep it disconnected, then start a case with DriveSavers using code DS22831 for 10% off.

Start a case with DriveSavers Call (585) 388-8780

J&N Computer Services is a DriveSavers referral partner and may receive a referral fee when you use our code or link. DriveSavers performs all recoveries and sets its own pricing, terms, and turnaround.