What to Prepare Before Contacting a Ransomware Recovery Company
Ransomware recovery cannot be priced from a single statement that files were encrypted. This article explains the five types of materials usually needed before assessment and quotation: the original ransom note, a few small non-sensitive encrypted samples with unencrypted counterparts, the affected asset and database environment, backup and snapshot status, actions already taken after the incident, and how to sample without causing secondary damage or leaking sensitive data.
ESXi VM Encrypted with No Snapshot: Don't Touch the Original Storage—Assess What's Recoverable in This Order
When an ESXi VM is encrypted by ransomware with no snapshot or usable backup, first stop all writes to the datastore, then determine whether the VM config files or the underlying -flat.vmdk data disks are damaged.
Ransomware Decryption Files Won't Open: Determine If They're Undecrypted or Corrupted
When decrypted files won't open, it's often not a simple 'decryption failure.' This article outlines the first forensic steps after stopping, teaches you to use file headers to determine if files were truly restored, and explains what to do in cases of tool mismatch, decryptor flaws, interrupted encryption, multiple encryption, and database corruption.
Shared Folder Encrypted by Ransomware: Stop the Share First, Then Find the Machine That Is Actually Encrypting
When files on a shared drive suddenly get unfamiliar extensions, the first step is to cut off write access, not scan the server; this article explains why the file server or NAS itself is often not infected, how to use file owners and session logs to locate the source host on the LAN, how to preserve snapshots and backups, and which actions during forensics and recoverability assessment will destroy the data completely.
Choosing a Ransomware Decryption Company: How to Tell If Their Plan Is Reliable
After a ransomware attack, the biggest risk when choosing a third-party recovery vendor isn't the price—it's vague technical claims, operating directly on your only original disk, unclear acceptance criteria, and disguised ransom payments. This article covers four checkpoints and questions you can ask directly.
