ransomware Recovery Experts Ready to Help

We recommend following the steps below if you require data recovery from ransomware. For a detailed overview of how ransomware encryption happens and what methods you can use to recover your data, we’ve provided a detailed guide here.

1. Do not turn off your computer as it may cause permanent data loss. If digital forensic services are required, it is critical to preserve evidence in memory.
2. Document any relevant information pertaining to the nature of the ransomware (pop messages, name of ransomware, etc.) The FBI asks for the following:
   • Company Point of Contact
   • The name of the variant if known
   • Approximate date/time of the attack
   • A copy or photo of the demand note or splash screen
   • The file extension of encrypted files
   • The file naming scheme for the ransom note/readme file left behind by attacker
   • Any email addresses or URL or other method provided by the attacker for communications
   • Required payment methods – Bitcoin addresses if known at this time etc.
   • Amount demanded if known
   • Electronic copies If possible for communications if they have already taken place
3. Check for backups or shadow copies & restore from backups.
4. Report the crime 
5. Recreate your data from scratch
6. Back up the encrypted data and wait for a solution in the future as a decrypter could be publicly released at some point.
7. Should you pay the ransom?

   The FBI’s official statement on ransomware: “The FBI does not advocate paying a ransom, in part because it does not guarantee an organization will regain access to its data. In some cases, victims who paid a ransom were never provided with decryption keys. In addition, due to flaws in the encryption algorithms of certain malware variants, victims may not be able to recover some or all of their data even with a valid decryption key.Paying ransoms emboldens criminals to target other organizations and provides an alluring and lucrative enterprise to other criminals. However, the FBI understands that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers.

   Regardless of whether you or your organization have decided to pay the ransom, the FBI urges you to report ransomware incidents to law enforcement. Doing so provides investigators with the critical information they need to track ransomware attackers, hold them accountable under U.S. law, and prevent future attacks.”

   If you determine that paying the ransom is a necessity to your business, doing so responsibly, while eliminating the possibility of the threat actor coming back and encrypting your data is essential.  Utilizing our threat intelligence from previous cases, we determine the risk level of the specific ransomware variant to see if the threat actor makes good on his promise to deliver decryption keys, there is a chance for file corruption, or if the ransom payment is ending up in the wrong hands by investigating the threat actor through our OFAC Compliance Program.  

8. Contact a ransomware service provider like Proven Data. We are here for you 24/7 at 877-364-5161.