The job · a network encrypted overnight
Ransomware that locks down an entire network overnight is working against the clock, and speed makes it reckless. That recklessness is what we work with: a snapshot on the NAS, a shadow copy that was never reached, deleted originals still in unallocated space, and large files that have only been partially encrypted. Pull the infected computers off the network but do not power anything down, take pictures of each screen and call. Most of these jobs come to this lab from Reading, Newbury, Theale, Didcot, Basingstoke and Slough; a single computer is £300 + VAT, and any server, RAID set or NAS starts at £500 + VAT. The figure is agreed in writing before the work begins. We are responsible for recovering the data. Nobody here contacts the attackers.
An engineer answers, and looking is free
0800 6890668
| What you notice | What is likely wrong | What happens next |
|---|---|---|
| Every filename now includes a suffix: .akira, or some string of characters specific to you | The encryption completed. Qilin assigns a different extension to every company it attacks | Photograph it, then unplug the network cable |
| akira_readme.txt in folder after folder | Akira's note. Others use fn.txt or powerranges.txt | Do not open any of them |
| README-RECOVER- | Qilin again: the ransom note is named after the extension that was applied | Keep every copy of it |
| RECOVER- | This is how BlackCat/ALPHV labels its notes | This is evidence — keep it |
| A demand in place of the usual desktop background | Communication is meant to happen over a Tor link | Take a photo of the entire screen |
| Shadow copies deleted, with vssadmin delete shadows sitting in the log | Restore is no longer possible: Windows has nothing left to restore from | Ironically, this makes it easier for us to know where to begin |
A case number is assigned to your device when we receive it. An engineer then finds the real fault (free) before anything else occurs; you will be advised clearly of what will be returned and what will not, along with a single written price. Charges cannot begin until you have read this and accepted.
Anything infected is removed from the network before it is touched. All disks are then imaged in full, unallocated space included, since the deleted originals often remain on the disk. Nothing is cleaned up: ransom notes, wallpaper changes, demand screens, all of it goes into the case file.
Most strains do not encrypt in place. They read the original file, create an encrypted copy alongside it and then delete the original, which removes the reference but not the actual bytes. Those bytes remain on the disk until another file needs that space, so carving them back out whole is routine work. We pursue the other routes just as hard: shadow copies the run missed, snapshots on the NAS, large files encrypted in patches, and, where one exists for the strain in front of us, a published decryptor.
Nothing is put back onto equipment the attack touched. Your files are returned on media bought for the job, together with written documentation of the work that will stand up in front of an insurer or the ICO.
You look at the file list first and make a decision about what to do. We will never invoice anything until you have said yes, and in most cases you only pay if we recover your data. All of the information that we recover will be put on new media purchased by us specifically for this job, and our company pays the cost of postage back to you. The case stays open on the bench until you tell us the files open on your own machine.
Most organisations now refuse to pay. Coveware put the payment rate at about a fifth in late 2025, and it has fallen since. A Sophos survey in June 2025 found that 97% of the organisations it asked recovered their data, while 49% of those paid, which leaves the other half getting their data back without a payment. In 2023, the British Library received a demand of roughly £600,000. It refused to pay and rebuilt its systems itself. There is no guarantee that paying will get your data back. It is merely one option among several, and the only one whoever encrypted your files has an interest in you choosing.
Our part is the data: the disks imaged, everything recoverable recovered, the results handed back on hardware known to be clean, and the findings documented in the form insurers or the ICO expect. The first look is always free, and the figure is agreed in writing before anything chargeable begins. We do not open any line of communication with whoever did this, and would caution you against contacting them too.
Nothing had been encrypted in place. Each file was opened, a scrambled version written beside the original, and the original deleted, which left the real accounts sitting in unallocated space, ready to be carved back out. What was missed remained in a NAS snapshot nobody had reviewed. The merchant was sending invoices again within a week, with no ransom paid and no reply sent.
No, and we do not act as brokers for anyone either. Here are three reasons, in order of relevance: a payment creates no obligation, so the key you get back may be partial or simply broken; the money paid funds whoever is encrypted next; and the ICO has stated outright that having paid earns you nothing once it begins assessing your breach. Police guidance points the same way.
A great deal, most of the time: entire files in some cases, partial files in others. The methods are these, and jobs typically use several: a free tool, if one genuinely exists for your strain; the deleted originals, still sitting in unallocated space; a snapshot made by the NAS as part of its normal operation; a shadow copy the encryption run missed; and the simplest of all, a backup you already have.
Check No More Ransom first. The project is backed by Europol, and the only tools listed are those that do what they claim. There are no tools currently published for Qilin, INC, RansomHub or Medusa, nor for the builds of LockBit and Akira now circulating. So paying for a “universal key” for any of those strains just means recovery labour, with another company's name on the invoice.
Three places, depending. Report Fraud (previously known as Action Fraud) is the one for cyber crime, on 0300 123 2040. Businesses should also report the incident to the NCSC. And if personal records were among the encrypted files, UK GDPR gives you 72 hours to notify the ICO, counted from the moment you realise.
There is no charge for the look. You then receive a list of the files that opened, those that did not, and a fixed amount to complete the job. Keep it switched off until you have received that in writing.