Ransomware has locked it
An attack that has to lock a whole network overnight cuts corners, and those corners are where our work starts. Shadow copies the script never reached. Snapshots sitting on a NAS. Deleted originals still readable in unallocated space. Big files locked only in places. Jobs reach us from all over Birmingham and the West Midlands; we recover data, and we hold no conversation with whoever did it, for any client.
Tell an engineer what it is doing
0800 6890668
| Symptoms | What is behind it | What to do |
|---|---|---|
| Files now end in something they did not before — .akira, or a random string unique to your site | The run has completed. Qilin issues a different extension to every victim | Take a photo, then cut the power |
| akira_readme.txt sitting in each folder | That is Akira's note. Others leave powerranges.txt or fn.txt | Do not move or delete them |
| README-RECOVER- | Qilin again — the note takes the name of your extension | Keep the lot |
| RECOVER- | BlackCat/ALPHV names its notes this way | That is evidence. Keep it |
| Your desktop background swapped for a demand | It points you at a Tor address to open talks | Photograph that screen before you touch it |
| No shadow copies left, and vssadmin delete shadows in the log | Restore points cleared so Windows cannot be wound back | Useful. It tells us where to dig |
Every item gets a case number of its own the day it lands. An engineer then works out what has actually failed and tells you plainly which files have a real chance of coming back and which do not. Only then does a price follow: one figure, fixed, in writing, and it costs you nothing to see it. Nothing is charged until you say yes.
Step one is unplugging: anything infected leaves the network. After that each drive is imaged end to end, unallocated space and all, because clean originals are often still lying in it. We clear nothing away either — the notes, the wallpaper and the lock screen all belong in the file.
Plenty of strains do not encrypt in place. They copy the file, lock the copy and delete the first one — and deleting a file only removes the pointer to it. The data stays put until something writes over it, and careful carving brings it back whole. We also chase shadow copies the run skipped, snapshots on a NAS, big files locked only in parts, and any real decryptor for your variant.
Nothing goes back onto kit that was caught up in the incident. Your files arrive on media bought new, together with an account of the work detailed enough for an insurer or the ICO.
No invoice is raised until the full list of recovered files has sat in front of you and you have said go ahead. Your data comes back on media we buy new, posted at our expense, and the job is not closed here until every file has opened on your own machine.
Saying no is now the normal answer: in June 2025 Sophos put recovery at 97% of encrypted organisations, with a ransom involved in 49% of those cases. Coveware's Q3 2025 number has payment down to 23%, its lowest ever. The British Library was asked for about £600,000 in 2023, refused, and rebuilt from the ground up. Paying guarantees nothing, and it has never been the only way out — only the loudest.
What we handle is the data: taking images of the disks, pulling back whatever can be pulled back, restoring onto hardware proven clean, and writing the whole thing up for an insurer or the ICO. Talking to the attackers is something we neither do nor advise.
Not one file was encrypted where it sat. Each was copied, the copy locked, the original deleted — so what mattered still lay in free space, ready to carve back, and a NAS snapshot nobody had remembered covered the rest. They were trading again within the week, no ransom paid and no reply sent.
No, and we will not do it on your behalf. UK policing and the ICO both advise flatly against it. A payment bankrolls whoever gets hit next, obliges nobody to hand over a key that works, and the ICO has stated outright that it counts for nothing in how a breach is judged. Moving money to criminals is not a service we offer.
Frequently yes, in full or in part. What we work from: your own backups, any shadow copy the attack overlooked, snapshots held on a NAS, deleted originals still sitting in unallocated space, and now and then a real free decryptor published for that particular build.
Check No More Ransom first — Europol backs it, and it is the honest list. As things stand there is no working tool for Qilin, Medusa, RansomHub or INC, nor for today's Akira and LockBit builds. Anyone selling you a key for one of those is selling something else.
Yes. The line for it is Report Fraud, once called Action Fraud, on 0300 123 2040; any business should also flag it to the NCSC. Where personal data was probably taken, UK GDPR gives you 72 hours to get a notification to the ICO.
Every extra power-up takes something off a drive that is already going. Leave it switched off and let the free diagnosis say what still reads.