Ransomware Data Recovery for the Americas
When the backups were encrypted too, the data is usually still there, just out of reach. Our ransomware lab, run in partnership with Recoveo, gets it back without paying the attackers and without talking to them.
Under attack right now? Leave the affected servers and storage switched on, unplug them from the network, and do not run recovery software, reinstall or reformat anything. Then call (213) 986-4855. The steps are on our ransomware recovery guide.
Why encrypted data can often be recovered
Ransomware is written to work fast. To finish before anyone notices, most strains encrypt only part of each file, skip very large files, or leave older copies of the data in places they do not look. Virtual disks, database files, backup archives and RAID volumes are big enough that a large share of what was inside them is often untouched.
A lab does not need the attackers' key to use that. We work below the file system, on an exact copy of each disk, and rebuild what can be read: whole virtual machines, database tables, backup sets and folders of ordinary files.
What we recover after ransomware
- Virtual machines: VMware ESXi, Microsoft Hyper-V and Proxmox virtual disks. See virtual machine and backup recovery.
- Backups that were destroyed or encrypted: Veeam and other backup repositories, and backup drives that were connected at the time
- Servers and storage: servers, RAID arrays, SAN volumes and NAS units such as Synology and QNAP
- Databases: SQL Server, MySQL and the accounting, practice-management and line-of-business databases built on them
- Workstations and laptops: documents, mailboxes, photos and project files
Our Los Angeles ransomware lab and Recoveo
Creative IT USA has a ransomware data recovery lab in Los Angeles in partnership with Recoveo, a specialised ransomware data recovery laboratory which has been recovering data since 2001. Recoveo brings the tools and the case experience with encrypted servers, virtual machines and backups. We bring the response for businesses anywhere in the United States, Canada and Central and South America.
How a case runs
Call and triage
We ask what was hit, which systems matter most and what the ransom note says, and tell you what to leave alone.
Secure and image
Each disk is copied sector by sector through a write blocker. All work is done on the copies, never on your originals.
Diagnose
We assess how much of each volume was encrypted and give you a realistic view of what can come back, with a fixed quote.
Recover and check
You get a list of the recovered files and machines to check before anything is returned.
Return and rebuild
Data comes back on new storage, and our IT team can rebuild the network so the same way in is closed.
No ransom, no negotiation
We do not contact the attackers or negotiate with them, and we do not act as a payment channel. Paying funds the next attack, gives no guarantee that the decryption tool works, and marks a business as one that pays. Recovery from the data itself does not depend on any of that.
Evidence and insurance
Because every disk is imaged before work starts, the originals stay as they were found. Copies can be made available to your insurer, your forensic investigator or law enforcement, and we can document what was received, when and in what condition.
What it costs
Each case is quoted after the diagnosis. The price depends on how much data there is, the systems involved (a single NAS is very different from a cluster of virtual hosts) and how fast you need it. You approve the quote before recovery starts.
Questions
Can you recover files without the decryption key?
Often, yes. Recovery works from the parts of the data the ransomware did not encrypt, and from older copies still on the disks. How much comes back depends on the strain and the storage, and the diagnosis tells you before you commit.
Our backups were encrypted too. Is it too late?
Not necessarily. Backup files are large and often only partly encrypted, and backup repositories can frequently be rebuilt. Stop all writes to the backup storage and call us.
Should we pay the ransom first and see?
We advise against it, as does the FBI. Talk to us, your insurer and your lawyer before any decision about payment.
Which countries do you cover?
The United States, Canada and Central and South America. We start remotely the same day, and disks, servers and NAS units are shipped to us. For on-site help, see Los Angeles.
Is our data kept confidential?
Yes. We sign a confidentiality agreement on request, and recovered data is returned to you on new storage.
Start a ransomware case
Call (213) 986-4855 or open a case online. Have the ransom note, a list of affected systems and the name of your insurer to hand if you have one.