What it is
Ransomware encrypts your files and databases and demands payment for the key. Decryption is our first goal: we test every known decryptor for the strain and analyse its encryption for weaknesses we can use.
When no decryption path exists, the work continues. Our own tools reconstruct files and databases from the data the attack left behind, and every recovered item passes an integrity check before it is handed back.
Signs you need this
- Files renamed with an unfamiliar extension that will not open
- A ransom note in folders, on screens or on printers
- Servers, virtual machines or NAS shares encrypted at the same time
- Backups deleted, encrypted or tampered with
- A database or business application suddenly down
What we do
Contain and preserve
Isolate affected systems, protect clean backups and capture evidence.
Identify the strain
Analyse samples and the ransom note to pin down the ransomware family and version.
Decrypt
Apply known decryptors, or decryption built from our own analysis of the strain.
Reconstruct
If decryption is not possible, rebuild files and databases from what remains, checking every item.
Advise
Support on the ransom decision and on reporting the incident to the authorities.
What you get
- Your database and files restored correctly and reliably — complete, or with only a small portion missing
- An integrity report listing what was recovered and how
- The identified strain and how the attackers got in
- Guidance on the ransom decision and regulatory reporting
What we need from you
- The ransom note and a few encrypted sample files
- Access to the affected systems, or copies of them
- When the attack was noticed and what has changed since
- Whether backups exist, and where they are
Questions
Can you decrypt our files without paying?
Often. Some strains have public decryptors, and some implement encryption badly enough to be broken. After analysing samples we tell you which case you are in.
What if decryption is impossible?
We move to reconstruction. Ransomware rarely destroys everything, and our tools rebuild files and database records from what remains, verifying each one.
Do we have to report the attack?
In many sectors, yes. We help you understand your obligations and prepare what authorities and insurers will ask for.