The bench is open for new cases · Mon–Fri, 9am–5:30pm Need it fast? Ring 0800 6890668
EDR Exeter Data Recovery 0800 6890668 Start my case
EDR / What goes wrong / Ransomware attack

How it was lost · ransomware

Ransomware recovery for Exeter. Your files back, and not a penny to them.

Ransomware attacks lock all the files they can get at; once those are locked, they go after the 'safety net' (backups and restore points), and then they ask you to pay for your own data. We take another way: surviving shadow copies, original files in free space, snapshots and the corners these strains cut. No paying, no negotiating and no contacting the gang: we do none of it, for anyone, including Exeter.

Only pay if we recover your data, on most jobs Free diagnosis and a written quote Get a quote first, then post from anywhere in Devon

Talk it over with an engineer
0800 6890668

What the symptoms are telling you.

Not there? Head for the triage →
The errorWhat it usually meansStep one
Every file now ends in .akira — or in a random string minted for your network aloneThe encryption has already taken place at this point; a different extension is given to each victim by QilinTake a picture of it, then unplug the network cable
An akira_readme.txt sitting in each folderAkira's ransom note; some versions include powerranges.txt or fn.txt in its placeLeave all the notes there
README-RECOVER-<extension>.txtNote by Qilin: it is named after the extension Qilin assigned to youKeep them all
RECOVER-<id>-FILES.txtHow the BlackCat/ALPHV ransomware group names its notesView it as evidence
Desktop wallpaper replaced by a ransom demandLock-screen extortion with a reference to a Tor websiteTake a photo of the screen before you shut down, then reboot
Shadow copies gone — vssadmin delete shadows in the logsWindows restore points were removed as part of the attacker's effort to prevent any rollbackThis will guide us towards possible alternative places to look
Posting it to us: get a quote first, by phone or with the form, then please use a traceable (tracked) and insured postal delivery method to send your device to our intake lab in Bristol; the return is paid for by us. Alternatively you can drop your item off there yourself, Monday to Friday, 9am to 5:30pm, with no appointment needed. An engineer will talk you through how to pack your unit when you call to obtain the quote. More information about sending your items can be found on the contact page.

What's attacking UK networks, 2025–26.

QilinThe most active cybercrime group of 2025, responsible for attacks against over a thousand named victims, Synnovis among them: the June 2024 attack on London's National Health Service (NHS) pathology that brought it to a standstill. There are no free decryption tools available to unlock files encrypted by this group.
AkiraIn November 2025, the Cybersecurity and Infrastructure Security Agency (CISA), along with the Federal Bureau of Investigation (FBI), issued an advisory declaring this threat to be "imminent". A free decryptor is available to help users who were attacked using the 2023 build alone; all versions developed after that time remain unbroken and cannot currently be decrypted.
Life after LockBitThe NCA-led takedown in February 2024 took down LockBit and released keys to some of LockBit's previous victims; the other groups filling the gap continue on a smaller scale.
Free decryptors, honestlyIf there is an actual free tool out there (that you can use), No More Ransom will host it. Qilin, Medusa, INC, RansomHub and the current Akira do not have one, and the “universal decryptors” sold around the web are neither universal nor decryptors.

Ransomware recovery, one stage at a time.

Read the latest cases →
01

Booked in, assessed for nothing Free

Your device will be logged under its own case number on the day it comes into our lab. The engineer who works on your device identifies the problem with it, clearly states what we think has a good chance of coming back and provides you with one fixed quote. There are no charges for this assessment; there is no obligation for you to do anything; and paid work does not begin until you authorise us to start.

The look is freeA single quote, in writingNo obligation
02

Cut it off, preserve everything

The first job: infected computers are removed from the network. Then each drive is fully imaged, including the free space as well, because intact originals of the encrypted files are often sitting in that free space. Ransom notes, wallpapers and locked screens are left as they are; those are your evidence.

Forensic image of the full diskFree space captured too
03

Hunt down the survivors

Many ransomware variants are copy-first variants. The first step is to create an encrypted copy (duplicate) of the data, then delete or "bin" the original. When the original file is binned, its content goes into free space on the disk, and after that, patient carving will bring those contents back out. In addition to looking for shadow copies that the attackers missed, we'll look at NAS snapshot backups and large files with only some parts of them scrambled; then we need to determine if there is indeed a free decryptor for this particular variant.

Deleted originals carved backDecryptor checked for your strain
04

Fresh media, full paper trail

Recovered data is never restored back onto a compromised system; it is sent to you on new media, with documentation that can be used in support of an insurance claim or as part of an ICO report.

Fresh media every timePaperwork ready for the ICO
05

Watched back, verified, returned

You have access to a complete list of every item recovered from your device, which you approve prior to any fees being applied. The files will be returned via new media (brand new) with the return postage paid by us, and the case remains open for as long as it takes to confirm that all the files open properly on your own machine.

You approve the file listReturned on new mediaWe pay return postage

Opening checks at the bench

  • vssadmin delete shadows /all /quiet: this command is the almost universal first action taken, as it removes all the restore points that are stored by Windows. If the log shows this command was executed, then the playbook for this attacker is clear and we can move on with our search.
  • Copy-encrypt-delete has a flaw: the original file does not disappear when deleted; instead it remains in free space, and with enough careful carving of the free space the entire original file can be retrieved.
  • Strains tuned for speed do not encrypt everything: large files are encrypted in segments, while the untouched sections of the file often remain readable.
  • The law is moving too: in July 2025 the UK Government stated that it would prohibit public authorities and critical national infrastructure from making ransom payments to hackers. It does not take long to figure out how this ends.

Refusing to pay is normal now: in June 2025, Sophos was reporting that 97% of organisations that were encrypted were able to recover their data; however, only 49% had actually paid. The cases handled by Coveware indicate a record-low rate of payment, 23% by Q3 2025. In 2023 the British Library refused a demand of approximately £600,000 and then rebuilt its systems from scratch. Paying a ransom is neither the reliable route nor the only one; there are other options than paying, and it is just the loudest voice.

Mid-incident? Report it here

  • Report Fraud (formerly Action Fraud), known as the national cyber crime line, is available on 0300 123 2040. It operates around the clock during a live attack.
  • NCSC: inform the National Cyber Security Centre about what has occurred, and then continue to follow its ransomware guidelines step by step.
  • ICO, within 72 hours: if it looks likely that personal data has been affected by this incident, UK GDPR requires that the ICO be notified without undue delay, and no later than 72 hours.
  • No More Ransom: nomoreransom.org, run jointly with Europol, is the website that contains all of the legitimate free decryptors. Before trusting any alternative offer, check this site first.

Our part is the data: we image drives, recover files from them, build back a clean copy of your data and provide all the necessary documentation that the insurers and the ICO are looking for. We do not negotiate with hackers, nor would we ever suggest doing so.

Fresh from the casebook.

EX · EDR-2026-2638VERIFIED ✓

A builders' merchant in Devon, encrypted while they slept

Rather than encrypting in place, this ransomware variant copied all of an infected system's files, locked the copies and deleted the originals. In doing so, it left behind unencrypted versions of those files in free space, from which we could recover them through carving. Additionally, a backup snapshot on one of their network-attached storage (NAS) devices had been overlooked by the attackers. Seven days later the firm was back trading; nobody paid, and nobody spoke to them.

Back within the weekNothing handed back

Before it leaves your hands.

Do

  • Take a photo of each ransom note and lock screen before doing anything else
  • Disconnect the network cable from all affected computers (but leave them powered on)
  • Save every single log; delete none until further notice
  • You need to report to both Report Fraud and the NCSC and, if there may have been any exposure of personal data, to the ICO within 72 hours

Steer clear

  • Talking to the criminals, haggling with them or sending them money
  • Placing your data backups onto machines no one has cleaned yet
  • Buying into anything sold as a "universal decryptor"
  • Switching a locked NAS back on before everything it shows has been photographed and recorded

Straight answers from the bench.

Should we pay the ransom?

No. Both the ICO and UK law enforcement agencies advise against paying. Money will fund the next wave of attacks. There are no assurances that your data will be returned. The ICO has stated that making payments to attackers will not improve your regulatory position. Arranging payment is something we simply will not do.

Can files be recovered without paying the ransom?

Often, yes, either wholly or partially. The ways this can happen include backups, shadow copies that were missed by the attacker, originals that still exist in unallocated space where a copy-encrypt-delete type of malware left them, snapshots of NAS devices, or a legitimate free decryptor that actually works on your particular variant, where one exists.

Does a free decryptor exist for my strain?

First go to No More Ransom, which is a legitimate archive run alongside Europol. There are currently no working decryptors for Medusa, Qilin, RansomHub, INC, or the current build versions of LockBit and Akira. Anyone who claims there is one is selling recovery services, not a key.

Do I have to report it?

Businesses should report this to Report Fraud on 0300 123 2040 (formerly Action Fraud), as well as to the NCSC. If it's likely that personal data has been exposed, UK GDPR gives you 72 hours to contact the Information Commissioner's Office (ICO).

More like this in the casebook.

NAS boxes → Servers & RAID 5 → Deleted & missing files → What we take in →

Whatever the fault, leave the power off.

Every time a failing hardware component is powered back up, there is additional lost data. First open a case with us: the inspection (look over) is always at no cost, whichever way it goes.

0800 6890668

Get a free diagnosis Sending a device in