Files Given a .sorry Extension: Stop the Bleeding First, Then Assess What Can Be Recovered
When files are renamed with a .sorry extension and a ransom note appears, the first priority is isolation and preserving evidence rather than hunting for a decryption tool; this article lays out the first-hours response order, how to identify the family and judge decryptability, which recovery paths are still worth inventorying without backups, and the re-encryption risks from leaked credentials and unpatched entry points.
Files Still Being Encrypted After Disconnecting the Network: How to Halt It Urgently and Whether Recovery Is Still Possible
Pulling the network cable only cuts off external communication and LAN spread but cannot stop encryption threads already running in memory; this article first gives methods to forcibly freeze disk writes by device type (physical machines, ESXi/Hyper-V virtual machines, laptops), explains why you must never click "shut down" or "restart," then covers post-halt preservation red lines, imaging order, and how to evaluate recovery paths such as family identification, decryptors, backups, and residual data.
