Everything has been encrypted
Locking down an entire network in one night is a rush, and a rush leads to carelessness. That carelessness is where your files come from: a snapshot left on the NAS, a shadow copy the attack never came close to reaching, deleted originals still in free space, or a large file only partly encrypted. Work reaches this bench from Plymouth, west Devon and Cornwall. We handle the data. No one here will have any contact with whoever did this.
You will be talking to an engineer
0800 6890668
| The behaviour | What that points to | Where to start |
|---|---|---|
| Each filename now has a new suffix: .akira, or a string of characters issued to you alone | The encryption has finished. Qilin gives every victim a different extension | Photograph it, then pull the network lead |
| akira_readme.txt in every single folder | Akira's note. Others go with fn.txt or powerranges.txt | Do not touch a single one |
| README-RECOVER-<extension>.txt | Qilin again; the note is named for your extension | Keep the lot |
| RECOVER-<id>-FILES.txt | That is how BlackCat/ALPHV names its notes | Evidence. Do not delete it |
| A demand in place of the desktop wallpaper | The conversation is meant to happen over a Tor link | Photograph the whole screen |
| All shadow copies removed, and vssadmin delete shadows has appeared in the log | Rollback is finished; Windows has nothing further to restore from | Oddly it helps us; it says where to begin |
Whatever is delivered is booked in using a unique reference (case number) on the date it arrives at the bench. The engineer will identify the actual fault at no charge. This gives a straightforward answer on what can be recovered from the drive and what cannot, plus one written quotation. There will be no further activity until you have read and accepted the quotation.
Anything infected is removed from the network before anything else is done with it. Each disk then receives a full image, free space included, because the untouched originals typically remain on the disk. Nothing is cleaned up. The ransom notes, the changed wallpaper and the lock screen are all added to the case file.
Most strains do not encrypt the file in place. Instead they read the file, write an encrypted copy next to it and then delete the original, and deleting removes only the reference to the file. The original bytes stay on the disk until another file takes that space, so carving them out whole is routine. The same effort goes into every other route as well: shadow copies the run missed, snapshots on the NAS, large files encrypted only in patches and, where one has been published for that strain, a genuine decryptor.
Nothing is put back onto equipment the attack reached. Your files come back on media purchased for the job, with a written record of the work that will stand up for an insurer or the ICO.
Give yourself time to consider it. It costs you nothing. We list all of the files we recover for you before sending out an invoice, and we only ask for payment once you have authorised it. We also buy media specifically for your recovery and send it back to you, with the return postage paid by us. The case stays here on our bench until we have your confirmation that the files open properly on your own machine.
It is becoming normal to refuse: according to a Sophos survey in June 2025, 97% of organisations were able to recover their data, with 49% having paid for it. Coveware found that the payment rate for Q3 2025 was 23%, the lowest it has ever recorded. The British Library was asked for almost £600,000 in 2023, refused to pay, and rebuilt its systems. Paying guarantees nothing, and it was never the only way to recover from an attack, just the only option offered by the people who locked you out of your own data.
The data is our part: images from each disk, recovery of whatever can be recovered, everything returned on hardware we know to be clean, and the work written up the way an insurer or the ICO would expect. We do not make contact with the attackers, and we advise you not to either.
The encryption was performed on copies of the data. Each file was read, an encrypted copy created, and the original deleted, so the originals stayed in unallocated space until they could be carved out. The rest of the data was in a NAS snapshot that nobody had checked. The business was trading again inside one week, without making a ransom payment and without responding to the attackers.
No, and we won't act as an intermediary either. Both police advice and the ICO advise against making payments. A payment helps fund the next attack on someone else. There is no requirement for the criminals to provide working keys once paid. And according to the ICO, making a payment gives no help whatsoever when a breach is being assessed.
Frequently most of it, whole or in part. Generally it comes from five places: a backup you already have, a shadow copy that the script did not find, a snapshot still saved on the NAS, deleted original files sitting in free space, and occasionally a legitimate free decryption tool for your specific build.
No More Ransom is where to go. It is sponsored by Europol and the site is realistic about what each listing can provide. Currently there is no known decryptor for Medusa, RansomHub, INC or Qilin. Decryptors are also unavailable for the Akira and LockBit builds being distributed right now. Anybody charging for a key to one of these is simply selling recovery services under a different name.
If you've suffered cyber crime, report it to Report Fraud on 0300 123 2040; it is the same service, renamed from Action Fraud. Businesses should also report it to the NCSC. Where personal data has been involved, UK GDPR requires the ICO to be notified within 72 hours.
Diagnosis costs nothing. We give you a report listing which files can be read, which cannot, and what is needed to get them off. Do not connect the drive until then.