You open a folder and the files have strange extensions, won’t open, and there is a note telling you to pay to get them back. Ransomware attacks are stressful and move quickly, and decisions made in the first hour affect both how much data you get back and what evidence survives. This guide sets out practical first steps for individuals and small businesses.
First: contain it
- Disconnect affected computers from the network – unplug the network cable and turn off Wi-Fi. Ransomware often spreads to shared drives, NAS boxes and other machines.
- Disconnect backup drives and stop any sync services such as OneDrive, Dropbox or Google Drive, so encrypted files don’t overwrite good copies.
- Don’t wipe or reinstall anything yet. Reinstalling destroys evidence and can remove data that might otherwise be recovered.
- Whether to shut a machine down or leave it running depends on the situation; if you’re unsure, isolate it from the network and get advice before powering it off.
Write down what you see
Take photos of the ransom note and of any changed file names or extensions. Note the time you first noticed the problem and which machines and drives are affected. This information helps identify the ransomware variant, which affects what recovery options exist, and is useful if you report the incident.
Report it
In the UK you can report ransomware to Action Fraud (or Police Scotland in Scotland). If you run a business and personal data may have been accessed, you may also need to consider your obligations to report to the ICO. The National Cyber Security Centre publishes guidance for organisations dealing with ransomware.
Check what you can recover without paying
- Offline and cloud backups – check them on a clean computer, and check the version history: many cloud services can restore files to an earlier version.
- Shadow copies and snapshots – Windows shadow copies are often deleted by ransomware, but NAS snapshots taken on a schedule frequently survive.
- Known decryptors – for some older or flawed strains, free decryptors have been released by security researchers.
How a data recovery lab can help
Ransomware doesn’t always encrypt everything perfectly. Depending on the strain, it may only encrypt part of each large file, or leave behind the original data in unallocated space after writing the encrypted copy. Virtual machine disks and databases are often recoverable in large part for this reason. We image the affected drives first, so the originals are preserved, and work only on the copies.
See our ransomware recovery, database recovery and cyber security snapshot pages, or call 020 7394 2525 for advice on what to do next.