The job · a network encrypted overnight
Ransomware that encrypts a whole network overnight is working in a hurry, and hurry is careless. That carelessness is what we work with: a snapshot left on the NAS, a shadow copy that was never reached, deleted originals still sitting in unallocated space, a big file encrypted only in patches. Take the infected machines off the network, leave them powered, photograph the screens and ring. Work comes to this bench from Reading, Newbury, Theale, Didcot, Basingstoke and Slough; a single machine is £300 + VAT, a server, RAID set or NAS starts at £500 + VAT, and the figure is agreed in writing first. The data is our end of it. Nobody here speaks to the attackers.
An engineer answers, and looking is free
0800 6890668
| What you notice | What is likely wrong | What happens next |
|---|---|---|
| Every filename now carries a suffix — .akira, or a string of characters unique to you | The encryption finished. Qilin gives every business it hits a different extension | Photograph it, then unplug the network cable |
| akira_readme.txt in folder after folder | Akira's note. Others use fn.txt or powerranges.txt | Do not open any of them |
| README-RECOVER- | Qilin once more — the note takes its name from whatever extension has been applied | Keep every copy of it |
| RECOVER- | This is how BlackCat/ALPHV labels its notes | This is evidence — keep it |
| A demand where the desktop wallpaper used to be | The talking is meant to happen over a Tor link | Take a photo of the entire screen |
| No shadow copies left, and vssadmin delete shadows sitting in the log | Rollback is over — Windows has nothing left to restore from | Oddly, that helps us; it says where to begin |
A case number goes on your device the day it reaches us, and an engineer then finds the real fault — free, and before anything else happens. You are told plainly what will come back and what will not, with one fixed figure in writing beside it. Nothing chargeable starts until you have read that and said yes.
Anything infected comes off the network before it is touched at all. Then each disk is imaged in full, unallocated space and everything, because the originals it deleted are usually still down there. Nothing gets tidied away: ransom notes, the changed wallpaper, the demand screen — every bit of it goes into the case file.
Most strains never encrypt in place. The file is read, an encrypted copy is written alongside it, and the source is deleted — which takes away the pointer and nothing else. Those bytes stay on the disk until another file claims the room, so carving them back out whole is routine work. The other routes are pushed just as hard: shadow copies the run overlooked, snapshots on the NAS, large files encrypted in patches, and a published decryptor where one exists for the strain in front of us.
Nothing is returned to equipment the attack touched. Your files come home on media bought in for the job, together with a written record of the work that will stand up in front of an insurer or the ICO.
You see the file list first, then decide. Nothing is invoiced until you have said yes, and on most jobs there is no fee at all if the data does not come back. What we pull off goes onto media bought in for your job, and the postage home is ours. The case stays open on the bench until you tell us the files open on your own machine.
Most organisations now say no. Coveware measured the payment rate at about a fifth in late 2025, and it has fallen since. A June 2025 Sophos survey put recovery at 97% among the organisations it asked — and 49% of those had paid, which leaves the other half getting their data back without a payment. Roughly £600,000 was what the British Library was asked for in 2023. It declined, and did the rebuilding work itself. Nothing is guaranteed by paying. It is one route out of several, and the only one whoever encrypted your files has an interest in you choosing.
The data is our part of it: disks imaged, everything recoverable recovered, the results handed back on hardware known to be clean, and the work documented in the form an insurer or the ICO will expect. The first look is free, and the figure is fixed in writing before anything chargeable begins. We open no line to whoever did this, and we would advise you against it too.
Nothing had been encrypted in place. The software opened each file, wrote a scrambled copy beside it and deleted the original — which left the real accounts sitting in free space, ready to be carved back out. What that missed was still in a NAS snapshot nobody had looked at. The merchant was invoicing again inside a week, with no ransom paid and no reply sent.
No, and we do not broker on anyone's behalf either. Three reasons, in the order that matters: a payment buys no obligation, so the key you get back may be partial or simply broken; the money underwrites whoever gets encrypted next; and the ICO has said outright that having paid earns you nothing once it starts assessing the breach. Police guidance points the same way.
A great deal, often — whole files in some cases, parts of files in others. The routes are these, and a job normally uses several: a free tool, where one genuinely exists for that strain; the deleted originals, still lying in unallocated space; a snapshot the NAS kept; a shadow copy the encryption run missed; and, easiest of all, a backup already in your possession.
Check No More Ransom first. Europol stands behind the project, and it lists only tools that do what they say. Nothing is published today for Qilin, INC, RansomHub or Medusa, nor for the LockBit and Akira builds in circulation now. So a paid “universal key” for any of those strains is recovery labour with somebody else's name on the invoice.
Three places, depending. Report Fraud — the renamed Action Fraud — is the one for cyber crime, on 0300 123 2040. A business should log it with the NCSC too. And where personal records were among the encrypted files, UK GDPR puts a 72-hour limit on telling the ICO, counted from the point you realise.
You pay nothing for the look. What comes back is a list — the files that opened, the ones that did not, and one fixed figure to finish the job. Leave it switched off until you have that in writing.