The majority of malware do not seek to wipe out your documents. They are seeking credentials or resources. Files often get lost during an infection. The culprit is normally the cleanup process. These are typically quarantined by antivirus, deleted by a removal tool or rolled back by a system restore. The first one can be reversed at no cost.
Reinstalling is normal. Reinstalling will eliminate the forensic evidence you might want to use with an insurer; for the ICO; or simply to see if something was taken off-site.
A painful discovery — which is why we ask about tools previously used.
Malware rarely intentionally wipes out your documents. Malware seeks credentials; mines cryptocurrency; displays advertisements; and sits idle waiting for commands — none of these processes require deletion of your documents. When files truly go missing, the cause is generally the cleaning process as opposed to the infection. This is because antivirus can quarantine infected documents wholesale, a cleanup tool can delete anything it could not clean, and a system restore can roll the computer back past work that had not been backed up.
This is important because you can usually get back your files that have been placed in the "quarantine" — they were just moved to a safe location instead of being permanently removed, and many antivirus programs allow you to restore those files. Look at the quarantine before making this into a recovery project. This is free and can resolve a good portion of these.
Each type has its own cause and chance for recovery.
Recovering infected data onto a working system is how you end up having to recover from malware twice.
Do not restart the infected machine again to recover from it. Instead, the drive is imaged read-only on isolated equipment.
Anything that you recover will be checked against current definitions before anything gets placed on your working computers.
Your documents, images, email, databases & other stuff like that come back. Your programs & your operating system files do not; they are reloaded from scratch using fresh copies.
After recovering your data, perform a "clean" installation. That way the original data will still exist; otherwise the data may be lost forever along with the evidence of what happened.
If the problem has not already been resolved by the quarantined files.
The cost for one single infected drive is from £300 +VAT. After a free 48-hour diagnostic, if the recovery fails you normally won't have to pay for anything. Servers and arrays from £500 +VAT.
Before doing much of anything else check the antivirus quarantine — if your files are located here it should only take a couple of clicks to release them. If your files have been encrypted by ransomware rather than missing, it is handled differently. The free assessment will let you know what type of problem you have.
Send the device in with an initial report of what has occurred to it. The diagnosis is at no charge and commits you to nothing, and the subsequent fee is written as a firm price prior to opening anything.
This is the only step that requires input from you and nothing else can happen until the device is on our bench. Package your item properly and include all the information we require about you and your item(s), then ship them to us. Then comes a no-cost diagnostic, followed by a written quote.
Posting it? Use a tracked and insured service. The value of what is on the drive far exceeds the cost of postage. Bringing it in? Weekdays from 9am to 5:30pm, and it still needs packing as described above for the journey.
Tell us about the item in question, tell us how it has been behaving lately, and let us know if there is anything you have done as far as troubleshooting goes so that our engineers may provide a realistic estimate of success and a probable cost range prior to sending your items off.
We’ll be in touch shortly. For anything urgent, call 0161 871 0788.
Most of what people generally want to know before sending in their infected hard drive.
Most of the time. First and foremost, look at the antivirus quarantine. Many antivirus programs store suspect items in a "quarantine" or "vault", so it may take just a few clicks to retrieve your files. When files have been deleted due to an infection, normal data recovery techniques apply — i.e., don't use the computer until you've had the opportunity to recover as many files as possible.
Not until after the data has been removed. If you reinstall your operating system it will write over everything you're looking for in order to recover and destroy any artefacts that may show how this occurred. First, you must recover; secondly, rebuild — and the rebuild should be done only after the data is safely stored.
No. Ransomware encrypts your files and asks for money. Most other types of malware either steal your passwords or use up your computer's resources, but they rarely intend to harm your data on purpose — when files disappear after an infection, it is usually because someone cleaned them out while cleaning up the mess caused by the malware itself.
Recovered files are run through scanners using current definition information before they are returned, and we return file types such as document, image, database, e-mail etc., not executable program files or system files which should be installed again from a clean source.
You simply open the quarantine or vault within the antivirus application and restore what you want/need. Files that are placed in quarantine are moved, not deleted. This resolves many of the questions that we receive regarding virus problems, and does so without requiring payment from anyone.
From £300 plus VAT for one drive after the free 48-hour diagnostic; or from £500 plus VAT for servers and arrays. Check the quarantine folder as it is free and often resolves the issue.
Free diagnostics; most jobs have no charge if it doesn't work and your files recovered off the infected drive, memory stick or card. Move your recovery forward now.