Data Recovery after Ransomware
We analyse drives, NAS and servers attacked by ransomware to recover whatever is possible: files that were left unencrypted, deleted originals and backups that survived. Each attack is different and only the analysis in the laboratory tells what can be recovered. Our own laboratory in Carcavelos, recovering data since 2004, certified to ISO 9001 and ISO 27001.
Free collection request
Advanced Diagnosis in 2 to 15 days* and free collection in mainland Portugal.
"*" indicates required fields
In short
Disconnect the affected computers from the network, do not pay the ransom and do not delete the encrypted files. Fill in the online request and send us the whole drive (not just the files): collection is free in mainland Portugal. Ransomware always needs an Advanced Diagnosis, which takes 2 to 15 days and tells you what can be recovered.
Data recovery after a ransomware attack
Ransomware encrypts the files and demands a ransom in exchange for the key. Each variant is different: in some there is a way to recover part of the data, in others there is not. Only the analysis of the drive in the laboratory can tell.
In the Advanced Diagnosis we check, among other things, whether there is a public decryptor for the variant, whether the attack left flaws or files unencrypted, whether the deleted originals can still be recovered from the drive and whether any system backups survived. We are the only data recovery laboratory certified to ISO 9001 and ISO 27001 in Portugal.
What happened and what to do
| What happened | What to do |
|---|---|
| The files will not open and have a strange extension | Disconnect the computer from the network (cable and Wi-Fi) and do not restart it. |
| A note demanding a ransom has appeared | Do not pay and do not contact the attackers. Photograph the note and keep it. |
| The NAS or the server was attacked | Disconnect them from the network. Do not delete or reinstall anything. |
| There are several computers on the same network | Check the others and disconnect from the network those that have altered files. |
| The files contain personal data of customers or employees | Assess notifying the CNPD, which has a deadline of 72 hours. |
| You want to file a complaint | You can do so with the Polícia Judiciária. Keep the ransom note and the encrypted files. |
What you should never do
The attack can spread to other computers, to the NAS and to the backups.
Keep them as they are: sometimes keys appear later, and without the files there is nothing to recover.
It erases the traces and the originals that could still be recovered from the drive.
How much it costs
* The diagnosis takes 2 to 15 days, in order of arrival and within opening hours. The Advanced Diagnosis is not refunded. Learn more about the Technical Diagnosis.
Other devices
How it works, in 7 steps
- Online request
- Sending the device
- Diagnosis
in 2 to 15 days* - Final quote
- Recovery and file list
- Payment
- Data delivery
The recovery only starts after you accept the quote. See the full process
Frequently asked questions
Do you always recover the files from a ransomware attack?
No. Each variant is different: in some, part of the data can be recovered, in others the encryption is complete and there is no way around it. Only the analysis of the drive in the laboratory can tell.
Should I pay the ransom?
No. Paying does not guarantee the key, it funds the attackers and can make you a target for new attacks.
How much does the diagnosis cost?
In ransomware attacks an Advanced Diagnosis is always needed: 369 EUR VAT included, paid in advance. It is deducted if you accept the quote and there is recovery, and it is not refunded in any other case.
How long does it take?
The diagnosis takes 2 to 15 days, in order of arrival and within opening hours. The timeframe for the recovery is in the final quote.
Do I send only the encrypted files?
No: send the whole drive, or the drives from the NAS or the server. It is on the drive that the deleted originals and the backups that survived may be.
And if there is no key for this variant?
Keep the encrypted files as they are. From time to time the authorities and researchers publish keys for older variants, and at that point the files may open again.
Still not convinced?
See what our clients say.
Data recovery laboratory in Portugal since 2004, with a cleanroom and ISO 9001 and ISO 27001 certification. Your satisfaction is our priority, and that is what the more than 1,900 reviews from our clients say.
Start Technical Diagnosis
