Ransomware data recovery
Files, servers or a NAS encrypted by ransomware? We look for every recoverable copy of your data and tell you honestly what can come back, before you pay anyone anything.
- Free assessment of sample files
- We never contact or pay the attackers
- Fixed quote before any work
Do this first
Disconnect
Unplug the network cable or turn off Wi-Fi on every affected machine, so the encryption can't spread to shares and backups.
Don't restart or wipe
Leave servers and computers as they are. Restarting, reinstalling or running clean-up tools can destroy the copies we recover from.
Keep the evidence
Photograph the ransom note and note the new file extensions. Don't delete encrypted files or the note.
Protect your backups
Unplug any USB backup drives and stop cloud or NAS sync jobs, so clean copies aren't overwritten.
Call us
Before paying, call 020 7064 4996 (out of hours 020 7237 6805). We'll guide you through it.
Recovering data without the ransom key
Ransomware is built to make you believe paying is the only option. Often it isn't. Attackers work fast and cut corners, and that leaves data behind that a specialist lab can recover.
Where we find your data
- Partly encrypted files. Many ransomware families only encrypt the start of large files to save time. Databases, virtual machine disks and mailbox stores can often be rebuilt from the untouched part.
- Deleted originals. Ransomware usually writes an encrypted copy and deletes the original. Until that space is overwritten, the original can be recovered from the disk.
- Snapshots and shadow copies. NAS snapshots, Windows shadow copies and hypervisor snapshots that the attackers missed or only partly deleted.
- Known decryptors. We identify the ransomware family from the note and sample files, and check whether a working decryptor exists.
- Backups that were hit too. Backup files and drives that were partly encrypted, or whose catalogue was destroyed.
What we work on
- Windows and Linux servers, including domain controllers and file servers
- Synology, QNAP, WD and other NAS boxes
- VMware and Hyper-V virtual machines (VMDK, VHDX)
- SQL Server, Exchange, Sage, QuickBooks and other business databases
- Laptops, desktops and external drives
- RAID arrays, including ones that also have failed disks
How we work
We start with a free assessment of a few encrypted sample files and the ransom note. If recovery looks possible, the affected drives come to our London lab, by courier from anywhere in the UK or dropped off. We make a full image of every drive and work only on those copies, so nothing is made worse. You get a list of what we can recover and a fixed price before any recovery work starts.
We never contact, negotiate with or pay the attackers. If you're thinking about paying, talk to us first: a decryptor bought from criminals often fails on large files, and we may be able to get the data back without it.
Encrypted
- Accounts-2026.xlsx.locked
- Clients.mdf.locked
- Server01.vhdx.locked
- Contracts.pdf.locked
- README_RESTORE.txt
Recovered
- Accounts-2026.xlsx
- Clients.mdf
- Server01.vhdx
- Contracts.pdf
- Checked and opened
| First consultation | Free | Phone advice on what to do now |
|---|---|---|
| Sample file assessment | Free | Ransomware identified, decryptors checked, honest view of what's possible |
| Recovery | Fixed quote | Depends on the number of drives, servers and file types. Agreed before work starts. |
Who you should tell
- Action Fraud: report the attack at actionfraud.police.uk (Police Scotland if you're in Scotland).
- The NCSC: organisations can report cyber incidents to the National Cyber Security Centre at report.ncsc.gov.uk.
- The ICO: if personal data may have been accessed or lost, you may need to report it to the Information Commissioner's Office within 72 hours.
- Your insurer: if you have cyber insurance, tell them early. Many policies have their own response process.
We can give you a written report of what was affected and what we recovered, for your insurer or records.
Common questions
Should we pay the ransom?
Not before talking to us. Paying doesn't guarantee a working key, decryptors supplied by attackers often damage large files, and payments can carry legal risk if the group is under sanctions. In many cases we can recover the data another way, so get an assessment first.
Can you decrypt the files without the key?
Sometimes. Some ransomware families have known flaws or published decryptors, and we check for those first. More often we recover data a different way: from parts of files the ransomware didn't encrypt, from deleted originals, from snapshots and shadow copies, or from backups the attackers missed.
Which files have the best chance?
Large files often do best, because many ransomware families only encrypt the start of big files to work faster. Virtual machine disks, SQL and Exchange databases, Sage and QuickBooks files, and NAS volumes with snapshots are often partly or fully recoverable.
How fast can you start?
Call us and we'll talk you through the first steps straight away. Send a few encrypted sample files and the ransom note and we'll usually tell you what's possible the same working day. Business-critical cases can be worked on out of hours.
Is our data kept confidential?
Yes. Drives and images stay in our London lab, we never upload your files to third-party services, and we're happy to sign your NDA. We never contact or negotiate with the attackers.
Should we switch the server off?
Disconnect it from the network first, so the encryption can't spread. Then leave it as it is and call us before you restart, reinstall or run any clean-up tools: restarting can trigger more encryption and clean-up tools can delete what we need.
Ready to send it in? Book your job online
Already know you want us to recover your data? Book the job directly and you'll get an email confirmation with your job number straight away. Then post or courier the device to us, or drop it off at the lab.
Hit by ransomware? Talk to us now
The first conversation is free. Tell us what you're seeing and we'll walk you through the first steps, then tell you how to send us a few sample files for a same-day assessment.
- General enquiries, Mon–Sat 9am–6pm020 7064 4996
- Emergency line, outside business hours020 7237 6805
- Email, usually answered within the hour during opening timessupport@physicaldatarecovery.co.uk
Disconnect affected machines from the network now. Don't restart, reinstall or run clean-up tools until we've spoken.