When do you need this service?
- A file server whose documents were encrypted and renamed
- Backups reached by the attack along with the production data
- An attack still spreading across the network right now
- A decryption key already paid for that is not working as promised
- Suspicion that the attackers took data before encrypting
Technical process
- Immediate containment: isolating the affected equipment from the network before the attack reaches anything else
- Identification of the variant and of how far the encryption actually got. This evaluation has a cost.
- A technical report and a quotation covering the lab hours and specialists the case requires
- A forensic-grade image of the affected systems before any attempt at restoration
- Recovery from shadow copies, from surviving backups, or from what the encryption process left behind
- Verification of the restored data and return of the system to production
Frequently asked questions
Should we pay the ransom?
That is your decision and it is not one to take blind. Paying does not guarantee a working key, and it does not remove the attacker's access. We tell you first what can be recovered without paying, so that the decision is an informed one.
Can every ransomware variant be reversed?
No, and anyone who says otherwise is not being straight with you. Modern variants are properly implemented and cannot be broken. What can often be recovered is what the process did not manage to encrypt, plus shadow copies and surviving backups.
What should we do in the first few minutes?
Disconnect the affected machines from the network without switching them off, and do not delete the ransom note: it identifies the variant. Then get in touch.
What does the initial evaluation cost?
The technical evaluation has a cost, because it involves specialist diagnostic time. The report and quotation that follow it cover the lab hours and personnel your case requires.
Did the attackers take our data?
That is common: before encrypting, many attacks copy the data so they can later threaten to publish it. We can confirm it with a forensic analysis: we examine the system logs to reconstruct what happened, from where and when. Recovering the data does not undo that leak, but knowing it is the basis for the decisions your company has to make.
Have your files just been encrypted?
Write to us and we will get back to you straight away, 24/7/365.
We answer in English by email and WhatsApp. Phone calls are answered in Spanish.
Related services
Is this for you or for your organisation? For businesses and institutions we work with a signed confidentiality agreement, formal invoicing and priority 24/7 support.