Taking work now — the first look is freeSpinning disks in a machine Quicker still, give us a ring:0203 0868633
ADR Advanced Data Recovery 0203 0868633 Price my job
ADR / Sorted by symptom / Ransomware has encrypted the files

The job · an encryption run across the network

Ransomware data recovery, London. Speed makes mistakes, and we work from the mistakes. No ransom is paid.

Encrypting a whole network in one night has to be done in a rush, and rushed work is sloppy, and that sloppiness is the thing we can build upon: a snapshot the NAS is still holding, a shadow copy that the run didn’t make it to, deleted originals still sitting in free space, and a single very big file that was only encrypted in stripes. Unhook the network cable, leave the computers running, take pictures of every screen, and then call us. We see a lot of jobs coming in from places like London, Bromley, Richmond and Croydon. One computer’s disk is £300 + VAT; if the computer has two disks, or it is a server, RAID set or NAS box, the price starts from £500 + VAT, and that price is quoted to you in writing beforehand. Data is the part we do, and none of the people working here talk to the people who did this.

Only pay if we recover your data, on most jobs A free look first, then one figure in writing Media posted in from Croydon, Ealing and Camden

Put it to an engineer — the first look costs nothing
0203 0868633

Ransomware: what the symptom usually means.

Different fault? Try the finder →
How it shows itselfThe usual reason for itWhere that leaves you
All filenames now end with something new: .akira, or some unique identifier created just for youThe run has completed: Qilin creates each business it encrypts its own extension.Take pictures of the screen, then pull the network cable.
akira_readme.txt, folder after folderAkira leaves that one behind. Elsewhere it is fn.txt or powerranges.txtOpen none, delete none
The README-RECOVER-<extension>.txt noteQilin once again: its note carries whichever extension was appliedJust leave them where they are.
A RECOVER-<id>-FILES.txt noteHow BlackCat/ALPHV names itThat is a piece of evidence, and it remains on the disk.
A demand for money as the desktop wallpaper.A Tor address is how you are meant to talk to them.Take pictures of everything on screen, edge to edge
Shadow copies don’t exist at all, and vssadmin delete shadows is in the logRolling back Windows is out: there are no restore points, so there is nowhere to roll back to.Oddly useful: it shows us exactly where to start.
Packing it and posting it: movement is what finishes off a damaged drive, so pack your unit into a solidly constructed container and fill any empty space with padding material. Get a quote first, by calling us or using the form, and once you receive your quote send your unit tracked and insured to our Guildford intake lab, or drop it off there yourself, Monday to Friday, 9am to 5:30pm (no appointment needed). We pay for the trip home. Would you like your packing materials reviewed prior to taping up your box? Please call first. All of this information is detailed within our guide to packing and posting.

Who is encrypting UK networks in 2025–26.

Qilin ransomwareThrough 2025 it was named in more incidents than any other group, and the public list of organisations it claims to have encrypted now runs into four figures. There is no free key for it.
Akira ransomwareIn November 2025 the FBI and CISA jointly labelled it an active threat. Two builds were broken publicly: the original 2023 Windows build, by Avast’s decryptor, and the 2024 Linux/ESXi variant, by a GPU brute-force method published in March 2025, and nothing issued after that has given way.
Whoever followed LockBitIn February 2024 LockBit was dismantled by an operation led by the NCA, and decryption keys were given to some of the firms it had encrypted. The space occupied by LockBit is currently being used by smaller groups.
The free decryptors that do existThere is only one place that lists free tools that genuinely work: No More Ransom. Search for Akira there and you’ll find Avast’s tool, which covers the early Windows builds only. Qilin, INC, RansomHub and Medusa are not listed at all. Anything sold online under the term “universal decryptor” is a sales page.

From the box arriving to your files going back.

Work we have closed →
01

Logged the day it lands, and the first look costs nothing Free

As soon as your parcel arrives here, an engineer assigns a case number that same day, prior to determining what has really failed, which is the first thing done and costs you nothing. In addition to a note of what can and cannot be recovered from your drive, you will receive at the same time the fixed, written price for restoring what can be recovered. You can accept this quote, or decline it, which will result in no further obligation on your part and nothing owed to us.

Nothing to pay for lookingA single figure, put in writingNothing owed at this stage
02

Off the network first, then copied as found

Anything infected does not get touched until it’s off the network. Once it is removed from the network, every disk is imaged in full (including free space). Why? Typically whatever was deleted during encryption still remains on the disk. Also, nothing is tidied away: anything that was altered or modified (the wallpaper, the screen carrying the demand) is left intact in order to preserve evidence, and everything, including the notes, goes into the case folder.

Each disk imaged in fullFree space copied as well
03

Recovering what it did not reach

Encryption in place is unusual. What most strains do is read a file, encrypt a copy, write the new version beside the old one and remove the pointer to the original while leaving its contents untouched. Until another file takes up the room where the old file lived, the bytes remain unchanged, so carving out the entire file is routine here. Every other route is given equal effort, including but not limited to snapshots held by the NAS, shadow copies never reached by the encryption run, large files only partially encrypted, and a published decryptor where one exists for the strain in front of us.

Deleted originals carved out againPublished keys checked too
04

Clean media, and the work documented

Nothing gets put back onto hardware that was affected during the incident. Your files go home on media purchased specifically for this job, alongside a written report detailing the work done, with enough information provided to satisfy an insurer or the ICO.

Fresh media, supplied with the jobDocumented for the ICO or an insurer
05

You see the file list before you pay

You will see what has been recovered as a list first, after which a bill exists. Accepting the list means that a bill will be issued. Rejecting the list means that a bill will not be issued, and in most cases you only pay if we recover your data. The recovered data travels from here back to you via new media purchased specifically for your project, with the cost of postage paid by us. Your case is not resolved (i.e., "closed") until you personally view the files on a computer of your own.

No charge until you accept the figureFresh media, supplied with the jobThe post home is ours

What arrives most often

  • vssadmin delete shadows /all /quiet: a command found in most of these cases, it deletes all the restore points held by Windows. In a log, that single line usually identifies the script that did it and which other machines should be examined further.
  • Read, encrypt, unlink, and the original survives: unlink does not mean erase. The source file stays where it was until something wants that room, and carving normally lifts it out whole.
  • Hurry leaves holes: a strain that runs fast doesn’t encrypt large files fully, just big chunks here and there, and every stretch it skipped still opens as it always did.
  • The law is only moving one way: under a proposal the Government published in July 2025, it would be illegal for any public authority, or any operator of an essential national service, to pay a ransom. Private businesses are also widely expected to end up in the same place, and no one expects the rules on ransomware payments to loosen any time soon.

Refusal is now the majority position. For Q3 2025, Coveware reported a ransom payment rate of 23%, the lowest recorded since the company began tracking ransomware. In June 2025, Sophos asked organisations whether they were able to recover their data after being attacked with ransomware. Of those questioned, 97% said yes, they did get their data back, but only 49% paid the attackers, so approximately half of those affected were able to restore their data without paying anyone. Asked to pay around £600,000 in 2023, the British Library refused and chose to rebuild instead. Nothing is certain about paying a ransom. It is one route among several to recover lost data, and the only one in which the people responsible for encrypting your files have an interest.

Incident still live? These are the numbers

  • Report Fraud (formerly known as Action Fraud): their cybercrime hotline on 0300 123 2040 is available out of normal working hours. This is important because you want to act quickly while the incident is still live.
  • NCSC: the National Cyber Security Centre also accepts reports, and their ransomware guidelines document is worth going through from start to finish and not just looking at specific sections.
  • ICO, and 72 hours to report: under UK GDPR, once you suspect that personal details were caught up in the attack, the countdown begins immediately, not after your investigation is complete. By day four your reporting opportunity has expired. Do not view the time limit as negotiable.
  • No More Ransom: nomoreransom.org. Europol and the security industry collaborate to maintain No More Ransom, and any actual free tool that exists for your particular strain of malware will be listed there. Before you believe anyone selling you a "key" to unlock your data, check No More Ransom.

Data is our half of it: all disks will be image copied, all items that can possibly be restored will be, results will be provided to you on clean hardware purchased specifically for this purpose, and all the documentation an insurer or the ICO looks for will be completed. Looking at it costs you nothing, a fixed figure goes to you in writing before any billable work starts, and on most jobs you only pay if we recover your data. We never make contact with the person responsible for encrypting your information, and likewise, we recommend you do not either.

One job, followed all the way through.

LDN · ADR-2026-3188JOB LOGGED ✓

A Richmond builders' merchant, and ransomware in the night

Nothing was encrypted where it sat. The encryption software worked on a file by file basis: read one file, produce an encrypted version of that file and place it next to the original, then delete the original it had just read (which left the actual accounts in their exact location, in unallocated space and easily recoverable). What that did not catch was sitting in a NAS snapshot that nobody had checked. Nothing was paid, nothing was answered, and the merchant had new invoices going out the same week.

Invoicing again within that same weekNot one penny paid, and no demand met

What helps, and what harms.

Do this much first

  • Photograph each ransom note, along with any screen showing a demand.
  • Disconnect the network cable from affected computers, but do not disconnect the power cord: leave them running.
  • Keep every log, and do not delete anything else at all.
  • First report it to Report Fraud, next to the NCSC; if any personal information was caught up in the attack, the ICO needs to be told within 72 hours.

What sets us back

  • Do not contact the attackers or attempt to negotiate with them, and do not pay the ransom.
  • Do not restore a copy of your data onto a machine that remains infected.
  • Never trust anyone claiming they can sell you a 'universal decryptor'.
  • Do not restart an encrypted NAS until it has been completely documented photographically.

Questions answered before you commit.

Would paying be faster?

No, and nobody here will handle a ransom payment on your behalf. There are three reasons why, in order of weight. First, there is no obligation for the attackers to respond with a decryption key that works, so what comes back can be partial or useless. Second, the money you pay helps fund the attack on whoever gets encrypted next. Third, the ICO's published position is plain: having paid the ransom counts for nothing when your case comes to be assessed, and police guidance says the same.

How much of it usually comes back?

Very often a great deal: some files are fully restored, others partially restored. There are five methods used to access the data, and most cases require the use of more than one method. Shadow copies the encryption run failed to reach. Snapshot images still held by the NAS. Original files left intact in free space, since they were not overwritten but merely unlinked from the file system. A free published tool, where one genuinely exists for your strain of malware. And lastly, and plainest of all, a copy of the data you already hold yourself.

Has a free decryptor been published for this strain?

When searching for tools, always refer to No More Ransom first. It is a listing run by Europol with the security industry, and only tools that actually work will appear in this list. Neither Qilin nor Medusa currently has entries listed against it. Nor do INC or RansomHub, nor do any current builds of LockBit or Akira. Anybody attempting to sell you a “universal key” for one of these strains is merely billing you for recovery labour under a different name.

Who has to be told about it?

There can be no more than three, and which of them could vary depending upon the circumstances. If cybercrime has occurred, then this would need to be reported to Report Fraud (Action Fraud, renamed) on 0300 123 2040, and if you are a business, the NCSC should have a report too. Then, where personal data may have been amongst the encrypted data, you will have 72 hours in which to notify the ICO under UK GDPR, counted from the moment you find out.

Begin here if yours is doing the same thing.

Disks taken out of a NAS box → RAID and server jobs → What is left after a delete → Every device we take →

Nothing gets worse while the power is off.

It doesn't cost you anything for us to look at it. All we do is give you a breakdown of what opened and what did not, plus a single fixed price to complete, written down before you agree to let us continue. On most jobs, you only pay if we recover your data. Please don't turn on the drive until you get that breakdown.

0203 0868633

Get it assessed Sending it to Guildford