Recovering encrypted files after ransomware attacks
Have your documents, photos or work files stopped opening? We start by understanding what was affected and what you need, then define the information and material required to assess the recovery options.
Who is this service for?
For individuals and teams who need to retrieve files on a computer or a storage medium, whether or not the name of the infection is known.
What do we examine?
We review the description of the damaged files and the incident information, and define the scope of sample that helps the assessment. The discussion also covers other sources that may hold matching data or earlier versions, if they exist.
What do we need to know?
The type of device, examples of the file formats, the approximate time of the problem, and whether tools were tried or a format was carried out after the incident. Personal files do not need to be sent in the first request.
How do we assess the result?
We agree with you on samples that represent the files required, and verify that they are usable within the agreed scope. The limits of recovery are stated, including any loss of names, structure or content.
Specific questions
It may be useful information, but on its own it is not enough to estimate the result of recovering your files.
Mention the fault together with the encryption in the request. Having more than one problem may change the order of examination and the material required.
Related services
Next step
Assess my files