Ransomware Data Recovery

Attingo data recovery can help you after crypto-trojans and ransomware attacks

As a data recovery expert, Attingo regularly helps to restore data and systems if they have been encrypted or deleted by ransomware attacks. Attingo reconstructs data from complex RAID systems, virtualized servers, backup NAS systems, client PCs or hard drives from blackmailed companies. Often a partly restoration of data is enough to be able to act again.

Can professional data recovery help with ransomware?

The honest answer to this question is: It is possible, but it‘s heavily dependent on various factors and the specific case. Attingo has been able to solve a variety of cases in the past few months and years where networks have been infected by malware such as ransomware and crypto-Trojans.

Based on this experience, Attingo has developed special tools and procedures that can enable data recovery in specific scenarios even after a ransomware encryption. For a successful data recovery of encrypted data, a multitude of factors is decisive for the chances of the data being restored and the quality of the result.

Crucial factors for data recovery with ransomware:

• Which type of ransomware? Knowing the responsible ransomware campaign and the Trojans used is crucial in order to be able to provide an assessment of a potential data recovery. Behind every ransomware and every attack there are different perpetrators, who act completely differently and attack networks with different combinations of malware. Knowledge of these already allows initial conclusions to be drawn.
• When was the ransomware attack noticed? The sooner the cyber attack gets noticed, the higher the chances of data recovery. Experience has shown that the perpetrators take their time while probing company networks. They analyze extensively which servers, systems and data represent potential targets and encrypt them. If the ransom note already appeared, it can be assumed that the perpetrators have had more than enough time to encrypt all data sufficiently.

Important: If you discover a ransomware attack, switch off all devices immediately and cut off all network connections (disconnect cables) and any access to the Internet. Isolation of the infected computers and servers is extremely important. The malware shall no longer communicate with the perpetrators' servers.

• What data has been encrypted and should be recovered? As with any data recovery, the data or file types are also a decisive factor for ransomware. Attingo has experienced that some ransomware encrypts smaller file types and deletes large files as well as unknown file formats.
• Is there a blackmail deadline? In the past few years, Attingo has thwarted the plans of some ransomware blackmailers and restored data for those affected. The perpetrators know about the possibilities of a professional data recovery company and try to prevent the commissioning of an analysis. Experience has shown that this often results in a deadline with drastic consequences: If you do not pay until the deadline, the perpetrators threaten to destroy all data or the ransom to be paid increases when the deadline expires.

Important: The comprehensive analysis of affected servers, NAS and computers can take a long time. The perpetrators know this and are trying to prevent data recovery companies from being commissioned and data from being retrieved by exerting pressure. Since a cyber attack always means data theft, extortionists of Maze and Sodinobiki now threaten to publish sensitive company data or offer it to the competition to buy, in order to put further pressure on those affected.

• What has already been tried to save data? Experience shows that everything is done in a panic to get the systems and servers up and running again. The problem is that this can significantly reduce the chances of data recovery. In many cases, the ransomware also affects backups, backup-files and even snapshots
• Which systems have been infected? Most of the time, central infrastructures are attacked in order to make existing backups useless. Subsequently, the different topologies are used depending on the existing topology. Relevant factors are: which server operating system are you using, are you using virtualization solutions like VMware or Hyper-V, are there Veeam or Altaro backups on a NAS? Are there any old backup copies on (hardware-)defective media or offline backups on tape drives or tapes?

Ransomware: Data recovery is often possible

Attingo can also help you. In the past few years, we have stood by many customers who have been exposed to the consequences of cyber attacks, ransomware attacks and crypto-Trojans. In many of these cases, our technicians and engineers were able to restore data in detailed analyzes and investigations of the affected systems. We are happy to help you that you can get your data back as soon as possible.

Contact us and tell us the facts: We provide you with an offer for a ransomware analysis of your RAID servers, NAS and hard drives in our laboratory in order to recover your data.

Whether Emotet, QLocker, TrickBot, Ryuk, Sodinokibi (REvil), WannaCry or GandCrab; we offer you our help! We cannot promise you a solution; But what we promise you : We will do everything in our power and do everything technically feasible to find a possible solution.