Cause of loss · ransomware
Ransomware encrypts whatever it can reach. Then it hunts the fallbacks — backups, restore points — and invites you to buy your own work back. We go the other way: shadow copies it overlooked, originals abandoned in free space, snapshots, the shortcuts these strains take to stay fast. We don't pay, we don't negotiate, we don't open a channel to the gang. Not for any client.
Run the problem past an engineer
0800 6890668
| On screen | What's behind it | First move |
|---|---|---|
| Filenames all end in something new — .akira, or a random string issued to your network alone | The encryption run is over; Qilin issues a unique extension per victim | Photograph the screen, then pull the network cable |
| akira_readme.txt dropped into every folder | That's Akira's note — other builds leave powerranges.txt or fn.txt | Don't move or delete the notes |
| README-RECOVER- | Qilin's note; the name mirrors the extension you were given | Save all of them |
| RECOVER- | How the BlackCat/ALPHV strain names its notes | That's evidence — keep it |
| The desktop background swapped for a ransom message | The lock screen now points you at a Tor address | Snap the screen before doing anything else |
| No shadow copies left — the logs show vssadmin delete shadows | Restore points were destroyed so you couldn't roll Windows back | Useful — it narrows our search |
Every item gets its own case number on the day it lands here. An engineer traces the fault, gives you a plain assessment of what is realistically recoverable, and puts one fixed price in writing. The diagnosis is free, you are under no obligation, and chargeable work starts only when you say go.
Step one is isolation: anything infected comes off the network. Then every drive gets a full image, free space included — untouched originals frequently survive there. Notes, wallpapers, lock screens: nothing gets tidied away. That is your evidence.
A lot of strains copy before they lock: the duplicate gets encrypted, the original deleted. Deleted isn't gone — it sits in free space, and careful carving lifts it back. We also chase shadow copies the attack overlooked, NAS snapshots, large files scrambled in parts, and check whether a genuine free decryptor exists for your variant.
Nothing recovered goes back onto a machine that was hit. It arrives on clean media instead, with a written record solid enough for an insurer or an ICO submission.
You get the full list of recovered files first, and nothing is charged until you approve it. Data goes back on fresh media, return postage paid, and the job stays open on our side until you confirm every file opens at your end.
Saying no is now the norm: in June 2025 Sophos put the share of encrypted organisations getting data back at 97%, with payment involved in only 49% of cases. Coveware's Q3 2025 figure has payment at 23%, its lowest on record. In 2023 the British Library was asked for something near £600,000, said no, and rebuilt. Paying is not the dependable choice, and never the only one — just the noisiest.
We handle the data end: imaging the drives, pulling files back, rebuilding on clean hardware, and writing up the records an insurer or the ICO will want. Talking to attackers is not something we do, and not something we would advise.
This strain didn't encrypt in place. It copied each file, locked the copy, then deleted what it had copied — leaving the originals in free space for us to carve, plus a NAS snapshot they had missed. The firm traded again a week later. No payment, no contact.
No. UK policing bodies and the ICO say the same thing: don't pay. Your money funds the next attack, no payment guarantees the files come back, and the ICO has said outright that paying does nothing for your regulatory position. We will not handle a payment.
Frequently, in full or in part. The ways in: backups, shadow copies the attack overlooked, originals left in free space by a copy-encrypt-delete strain, NAS snapshots — or a legitimate free decryptor if one exists for that variant.
Start with No More Ransom, the legitimate archive Europol helps run. Nothing decrypts Medusa, Qilin, RansomHub, INC, or current LockBit and Akira builds — anyone offering a decryptor is selling you recovery work, not a key.
Report it to Report Fraud — formerly Action Fraud, on 0300 123 2040 — and, if you are a business, to the NCSC too. Where personal data has probably gone out of the door, UK GDPR gives 72 hours for telling the ICO.
Switch a failing device on again and you lose a little more. Open a case before you do — the diagnosis is free, whatever it finds.