Ransomware Recovery

Ransomware encrypts your files and demands payment for the key. For most businesses, the fastest route back is not paying: it is recovering what the attackers missed, restoring what can be restored, and rebuilding the rest safely. Our ransomware recovery lab in Los Angeles works on encrypted servers, virtual machines, NAS units and workstations for businesses across the US, Canada and Latin America.

How we get data back without the attackers

• Recovering data from the parts of files and disks the ransomware didn’t encrypt. Many strains only encrypt part of each large file to work faster, which leaves databases, virtual disks and mailboxes recoverable
• Restoring from backups, snapshots and shadow copies the attackers missed or only partly deleted
• Rebuilding virtual machines from damaged VMware and Hyper-V datastores
• Recovering deleted originals from the disk where the ransomware wrote encrypted copies
• Using free decryptors where one exists for the strain that hit you

What we work on

• Windows and Linux servers, file servers and domain controllers
• VMware ESXi and Hyper-V hosts (see servers and VMware)
• SQL Server, Exchange, QuickBooks and line-of-business databases
• Synology and QNAP NAS (see NAS ransomware)
• Workstations, laptops and backup drives

After the recovery

We help you rebuild cleanly so the attackers can’t walk back in: resetting credentials, closing the entry point, and setting up backups that ransomware can’t reach. See ransomware protection.

Questions we get asked

Should we pay the ransom?

Talk to us first. Paying doesn’t guarantee a working key, can be illegal if the group is sanctioned, and marks you as a business that pays. Many businesses recover without paying. Read should you pay?

Do you work with our insurer and lawyers?

Yes. We can work alongside your cyber insurer, breach counsel and any incident response firm, and provide reports of what was recovered.

How quickly can you start?

Call us. For businesses in Los Angeles, the Inland Empire and Ventura County we can be on site. Elsewhere, we work remotely and with drives shipped overnight.