Ransomware and data recovery
Hit by ransomware or lost critical data? We get it back.
We contain the attack, decrypt or rebuild your files and databases, and show you exactly how it happened.
- Confidential, NDA on request
- Written investigation report
Incident first aid
First hour of an attack: do this
Disconnect
Take affected devices off the network. Leave them switched on.
Don’t engage
Don’t pay, reply to or negotiate with the attackers yet.
Don’t wipe
Don’t delete, restore over or reinstall anything. The evidence is there.
Call us
We guide the next steps on the phone.
Services
Six ways back from a data incident
From the first hour of an attack to the fix that stops it happening again.
Ransomware recovery
Decrypt or rebuild data locked by ransomware.
Deleted data recovery
Bring back files, mailboxes and records that were deleted.
Digital forensics
What happened, when, how and by whom — in writing.
Database and file recovery
Repair corrupted databases, files and virtual machines.
Cloud and SaaS recovery
Recover Microsoft 365, Google Workspace and cloud storage data.
Post-incident hardening
Close the gap and make backups attack-proof.
1Decrypt
Known decryptors where they exist, and our own analysis of the strain.
2Rebuild
Our own tools reconstruct files and databases from what remains, with integrity checks.
Process
Contain. Investigate. Recover. Harden.
Every case moves through the same four stages, in this order.
Contain
Stop the spread and protect what is still clean.
Investigate
Find out how they got in and what they touched.
Recover
Decrypt, or rebuild from what remains.
Harden
Close the gap and make backups survive the next attack.
Commitments
What you can count on
Confidential by default
Only the analysts on your case see your data. NDA on request.
Evidence preserved
We work on copies and log a chain of custody, so findings hold up.
A written report
A timeline of what happened, what we found and what we did.
Price agreed first
Scope and cost are settled before recovery work begins.