Most ransomware does not encrypt everything, and most environments have more left than the ransom note implies. We take a forensic image first, then work through shadow copies, backup remnants, partially encrypted files and untouched volumes to establish what is recoverable without a key.
An honest scoping matters more here than anywhere else, because the wrong first move destroys the evidence and the data together.
Machines come offline and every affected volume is imaged read-only. Nothing is analysed on live media.
The strain determines whether a free decryptor exists, whether the crypto is flawed, and what the malware skipped.
Many strains delete VSS copies badly, leaving recoverable fragments. NAS and hypervisor snapshots often survive entirely.
Some strains encrypt a copy and delete the original rather than overwriting it, so the original is still on disk.
Large files are often encrypted only at the head to save time, so databases and mail stores can be repaired around it.
You get a written list of what is recoverable and what is not, before any invoice exists.
Evaluation and quotation are free. You pay only after we show you a verified list of what was recovered, and only if you approve it. Nothing recovered means nothing invoiced.
Every case follows the same audited path. You get a case ID at step one and can ask for status at any point.
An engineer, not a call centre, works out what failed and whether the media should be powered on again at all.
We collect the device from your location, logged and sealed, or you send it in by courier.
A full diagnostic report: the fault, the recoverable scope, the turnaround time and a fixed price.
Sector-level imaging in a Class 100 environment, then reconstruction from the image. The original is never written to.
Online or on site, you check the recovered files before any invoice is raised.
Data is delivered on fresh encrypted media. Our working copies are sanitised to standard and the NDA stands permanently.
We do not break modern encryption, and no lab honestly can. What we recover is everything the attack failed to reach, which in most cases is a great deal more than the victim expects.
The first hour decides how much is recoverable.
Only in specific cases: a strain with a published flaw, a leaked or recovered key, or an available free decryptor. Where the encryption is sound, no lab can break it, and anyone promising otherwise is not being straight with you. What we do instead is recover everything the attack did not reach.
That is your decision and we do not handle payments. What we can do is tell you what is recoverable without paying, before you decide, so the choice is made on facts. Many organisations find enough survives that payment is unnecessary.
Disconnect them from the network but do not wipe or reimage anything, and do not run cleanup tools over the affected volumes. Evidence and recoverable remnants live in the same place, and cleanup destroys both.
No. Work is done on forensic images with chain of custody logged throughout, which is what insurers and regulators ask for. The original media stays untouched and available.
Free consultation, free pickup, a fixed quote before any work starts, and an invoice only if you get your data back.
Data Recovery Lab