Every document renamed, a ransom note in each folder, and the backup NAS encrypted alongside everything else because it was mapped as a drive letter. Then the machine was left running for two days while the business decided what to do.
← All case files · £300 + VAT, flat
A business found every document renamed with an unfamiliar extension and a ransom note dropped in each folder. Their backup was a NAS on the same network, mapped as a drive letter, and it had been encrypted along with everything else.
The machine had been left powered for two days while they decided what to do — partly to avoid destroying evidence, which is a reasonable instinct, and partly because nobody wanted to make the decision.
Current families encrypt file contents with an established symmetric cipher and protect the symmetric key with asymmetric cryptography. There is no flaw to exploit. These are the same primitives protecting online banking, implemented from the same libraries.
A unique key encrypts your files and is immediately wrapped with the attacker’s public key. The wrapped copy is what gets left behind, often appended to each file or written into the note. Unwrapping it needs a private key that has never been on the network.
Where researchers or law enforcement have seized keys or found an implementation error, tools get published — the No More Ransom project collects them. They cover specific older families, they are always worth checking against the note and file extension, and they will not cover a current one.
Either they have identified an old flawed strain, or they intend to pay the ransom on your behalf and add a margin. Both are worth establishing before you engage them.
Files it never got to. Encryption takes time and the process works through directories in an order determined by the code, not by what matters to you. Anything not yet reached when the run was stopped or completed is untouched.
The parts of files it deliberately skipped. This one surprises people. Encrypting terabytes is slow, and slow means detected, so most current families use intermittent encryption — scrambling only the opening portion of each file, or fixed-size chunks at intervals through it, rather than every byte. The file is unusable and the ransom works. But for formats where the damaged region is bounded and the structure is well understood, a meaningful proportion of the content behind it is intact and extractable.
Original content in unallocated space. Usually the richest source. Many families encrypt to a new file and delete the original rather than rewriting in place, because it is faster and simpler to implement. The deleted original remains physically present until something overwrites it — which is exactly the situation ordinary file recovery addresses.
Shadow copies. Most families delete these deliberately as an early step. That deletion is itself a deletion: the shadow storage frequently remains recoverable from unallocated space even after the service reports it gone.
Anything it could not authenticate to. Systems on different credentials, offline media, and cloud storage with versioning the compromised account could not reach.
Both halves of that heading cost data, and the second is the one nobody expects.
The delay. The most recoverable material in a ransomware incident is the deleted originals sitting in unallocated space. A running Windows machine writes constantly without being asked — updates, event logs, temporary files, search indexing, telemetry, page file activity — and every one of those writes lands somewhere. Two days of that is two days of the most valuable recoverable content being progressively overwritten by a machine doing nothing in particular.
The NVMe. This is the harder point. On a mechanical hard disk a deleted file’s contents remain on the platters indefinitely until something writes over that exact location, and recovery windows are measured in weeks. On an SSD with TRIM enabled — which is every modern Windows machine by default — the file system tells the drive which blocks are no longer in use, and the controller erases them during garbage collection. Not marks them free: physically erases the cells.
So the ransomware deleting each original after encrypting it does not leave those originals sitting there for weeks. It issues a stream of discards, and the controller works through them in the background over minutes and hours. Every additional hour powered on gives garbage collection more opportunity to finish the job the ransomware started.
On a hard disk this incident would very likely have returned a higher proportion. On NVMe, two days powered is the difference between most of it and 81%.
The machine was imaged read-only through a write blocker before anything else, and every subsequent operation ran against the image. That preserves the forensic position at no extra cost and delays nothing.
The strain was identified from the note, the appended extension and the structure of the encrypted files, and checked against the published decryptor catalogues — not because we expected a hit on a current family, but because it costs ten minutes and occasionally saves the entire job.
Recovery then ran along all four routes in parallel. Unallocated space was carved by file signature for surviving originals. The NTFS master file table and its journal were parsed for records of deleted entries, which frequently gives names and sizes even where content is gone, so the client gets a list of what was lost rather than a silence. Shadow storage was searched for in unallocated space. And where the encryption had been intermittent, the surviving portions of larger files were extracted and reassembled where the format allowed it.
Everything recovered was opened rather than counted. A partially-encrypted file that yields readable content is only useful if somebody has confirmed the content is actually readable.
A mapped network drive is not a backup. Ransomware enumerates drive letters and network shares deliberately. Storage the infected machine can write to is storage the attack will encrypt. A backup means at least one copy the compromised system cannot reach using its own credentials — offline media, or immutable storage that cannot be altered for a fixed retention period.
Power it down. The correct action is uncomfortable but simple: disconnect from the network to stop lateral movement, then shut down. Not sleep, not hibernate — off. Preserving evidence and preserving data point the same direction here, because a forensic image taken from a powered-down machine captures both.
And start the clock on the reporting obligation. Where personal data is involved this is likely a reportable breach with 72 hours attached to it. Imaging first supports that assessment rather than obstructing it.
Ransomware recovery is from £500 +VAT after a free 48-hour diagnostic, and we will tell you honestly at that point what proportion looks realistic. We do not broker ransom payments.
Drop the drive at our Oxford Street reception, or post it to us — it costs nothing to find out what happened. You get a written figure from the fixed bands before any work begins.