Every file has a new extension. There’s a text file on the desktop with a payment demand in it. The photos, the documents, the QuickBooks file — all there, all unreadable.
Let me be clear about the central fact before anything else: no data recovery lab can decrypt modern ransomware. The encryption is the same strength that protects banks. If someone offers to break it for a fee, that is a scam, and a common one.
But decryption isn’t the only way files come back, and the other avenues are worth working through before you conclude anything.
First: disconnect, don’t wipe
Disconnect the machine from the network — unplug the ethernet, turn off the Wi-Fi. Ransomware spreads to network shares, mapped drives, and connected backups, and encryption may still be in progress.
Unplug external drives and backup drives. If a backup drive is attached and hasn’t been touched yet, disconnecting it right now may be the most valuable thing you do all week.
Leave the machine powered on but isolated, at least initially. Some ransomware families keep key material in memory, and a small number of cases have been solved from a memory capture. Rebooting definitely destroys that; leaving it running only might.
Don’t reformat or reinstall yet. That’s the instinct, and it forecloses every option below.
Avenue 1: the originals the malware deleted
This is the one most people don’t know about, and it’s genuinely the best hope.
Many ransomware families don’t encrypt files in place. They read the original, write a new encrypted file, then delete the original. It’s faster and less likely to corrupt things mid-run.
Which means the original files were deleted, not overwritten — and deletion removes the pointer, not the data. Those originals may still be sitting in unallocated space, fully intact and fully readable.
Two things determine whether this works:
How much has been written since. Every hour the machine runs, every reboot, every Windows update writes to disk and may land on top of your originals. This is why “power it down and stop using it” matters as much here as in any other recovery.
Whether it’s an SSD. On an SSD with TRIM enabled, deleted blocks get purged by the drive itself, often within minutes. On a spinning hard drive, deleted data persists far longer. This is a real and unfortunate asymmetry, and it’s covered more fully in the SSD article.
Not every family behaves this way — some do encrypt in place. But it costs nothing to check, and I’ve seen it work.
Avenue 2: Volume Shadow Copies
Windows keeps automatic snapshots of files through the Volume Shadow Copy Service. Most ransomware deletes these deliberately as one of its first actions, using vssadmin.
Deliberately deleted, though, is still deleted — and shadow copy data can sometimes be recovered from unallocated space the same way ordinary files can. Worth checking, and occasionally it produces a clean version of everything from a few days before the attack.
Free evaluation. Firm quote before any work begins.
Avenue 3: a free decryptor may already exist
Before spending anything, check No More Ransom, a joint project of Europol and several security vendors. You upload a sample encrypted file and the ransom note, and it identifies the family and tells you whether a free decryptor exists.
Decryptors exist for a meaningful number of older and defunct families — sometimes because keys were seized in a law enforcement operation, sometimes because the implementation had a flaw. It’s free, it takes five minutes, and it occasionally solves the entire problem.
Avenue 4: backups the malware couldn’t reach
Check everything: cloud storage with version history (OneDrive, Google Drive, and Dropbox all keep previous versions and can roll back), a backup drive that happened to be unplugged, an old backup in a drawer, email attachments, a phone that synced the photos.
Offline and versioned backups are the actual answer to ransomware. If you have one, this becomes an inconvenience rather than a disaster.
On paying
I’m not going to tell you what to do — if it’s your business and your livelihood, that’s your call to make and I’m not the one carrying the consequences.
What I’ll offer is the factual part: payment doesn’t reliably work. Decryptors provided by attackers are often buggy and slow, some files come back corrupted, and a meaningful share of victims who pay get nothing. Law enforcement discourages it because it funds the next attack, and in some cases payment to sanctioned groups carries its own legal exposure.
Report it either way. In the US that’s IC3, and for a business it’s worth involving your insurer early — cyber policies often cover response costs and sometimes require notification within a specific window.
What I can and can’t do
Can: image the drive, hunt for deleted originals and shadow copy remnants, identify the family, and pull back whatever is genuinely recoverable. For a small business that’s down, I’ll prioritize the files you actually need to operate.
Can’t: decrypt anything. And I’ll tell you that on day one rather than billing you to discover it.
Honest expectation setting: sometimes the answer after imaging is that the originals were overwritten and there’s nothing to retrieve. That’s a real outcome and you won’t pay me for it.
The bottom line
The encryption is unbreakable, but that’s not the only question. The originals the malware deleted are frequently recoverable if the machine stops writing to disk soon enough — which means the most useful thing you can do right now is disconnect it from the network, unplug your backup drives, and stop using it.
Hit by ransomware? Start a case — include the extension appended to your files and the ransom note filename. Those identify the family, which tells me whether the originals were likely deleted rather than overwritten, and whether a free decryptor already exists.