Your files are encrypted
Locking a whole network overnight is a rush job. And rush jobs are messy. And that's where your files come from. The shadow copy the script never reached. A snapshot left on the NAS. The originals were deleted but still sitting there in free space. Large file encrypted only partially. We service clients from Hull, the East Riding and North Lincolnshire. We handle your data. We do not speak to whoever did this.
An engineer will take the details
0800 6890668
| The symptoms | What the fault is | What to try |
|---|---|---|
| There are additional suffixes being applied to filenames now; .akira or a custom string of characters that has been assigned to you personally. | The encryption process continued through to completion. Each Qilin extension that is generated represents an individual victim. | Snap a photo of it. Remove the network cable. |
| akira_readme.txt sitting in every folder | Akira's own note. Other teams have used fn.txt and/or powerranges.txt | Do nothing with any of them. |
| README-RECOVER-<extension>.txt | Qilin again: the note is called whatever your extension is. | Save everything |
| RECOVER-<id>-FILES.txt | BlackCat/ALPHV name their notes in this fashion. | That is evidence. Save it. |
| Your desktop wallpaper was changed to a ransom note. | The note says you are supposed to negotiate via a Tor link. | Take a picture of what appears on your screen. |
| All shadow copies gone. vssadmin delete shadows in the log | That eliminates any rollback, since Windows has nothing to restore back to | Oddly useful to us: tells us where to start |
Every piece of gear that shows up receives a case number on the very same day it arrives. An engineer examines it and determines what is really wrong with it and there is no charge for this. We give you straight language about which files we will be able to copy from the disk and which ones we won't be able to. Then we provide you with a single price quote, in writing, based upon these findings. We don't begin working on anything until you agree to the quoted price.
Everything infected is removed from the network before we touch it. Each disk is then fully imaged, free space included, because the original data is typically left intact there. We clean nothing. All evidence (the ransom note, the changed wallpaper, the locked screen) goes into the case file.
Most ransomware does not encrypt data in place. Instead, they first read the data, create an encrypted copy adjacent to it, and then delete the original. Deleting a file only deletes the pointer. The actual bytes are left on the disk until something else uses the allocated space. This is why recovering the exact, original bytes requires little more than normal carving techniques. Other methods receive similar treatment: shadow copies the run ignored; snapshots on NAS devices; partial encryption of larger files; and the presence of a legitimate decryptor when one is available for that particular type of ransomware.
No information will go back to your "kit" that the attack affected. All of your files will return on the media purchased for the purpose of the job and include a written summary of all of the completed work. This will be adequate for both an insurance claim and the Information Commissioner's Office.
You will not be charged while you think about this. First, you receive a list of everything that was recovered from the drive. Once you have seen the list and given us the go-ahead, the bill comes next. Files are returned to you on media purchased specifically for this job and we cover the return postage as well. Your job is kept open by us until you can view them on your personal computer.
Now refusing to pay is the norm: in a June 2025 Sophos survey, 97% of organisations were able to recover their data, and 49% ended up paying to recover it. According to Coveware, in Q3 2025, they reported their lowest ransom payment percentage ever, at 23%. The British Library was hit with a ransom demand of close to £600,000 in 2023, refused to pay, and rebuilt itself. Paying does not ensure you won't lose your data and it was never the only way out; it was simply the option being presented to you by those who locked you out.
Our role is data recovery. It's our duty to image the disks, recover everything possible, put the files back onto hardware that we know is clean, and document the work the way an insurance company or the ICO will want it. We do not establish communication with the attackers, nor should you.
The files were never locked in place. Each file was opened and a locked version created. Then the originals were deleted. This allowed us to carve out of the free space on the disk whatever was needed. All the rest of this was sitting in a NAS snapshot that no one looked at. The business was running within the week with no ransom paid and no response given to the threat.
We say no, and we won't act as a go-between either. Police guidance and the ICO both advise against paying. Any payment funds the next attack on somebody else. No criminal is bound to hand over a key that works. And the ICO has said that paying will not count in your favour when a breach is assessed.
Many times, most of the data affected by a ransomware attack can be recovered, in full or in part, using five different methods: a backup you made before the attack; finding any shadow copies that the attacker's script missed; restoring files from snapshots that remain on your NAS device; locating any original files deleted during the attack and found in the free space on your system; and occasionally, a free decryptor created specifically for that build of the ransomware.
No More Ransom is the place to look for decryption tools. The No More Ransom project is backed by Europol. It also has a very honest description of what is currently available. At present, there is no decryption software available for versions of Qilin, Medusa, RansomHub or INC. Likewise, there is currently no decryption software available for the most recent versions of Akira or LockBit. Anybody who charges you money for access to the decryption software for one of these versions is effectively providing you with professional services to recover your files, but using a different name.
Report cyber crime to Report Fraud (formerly Action Fraud) via telephone number 0300 123 2040. Businesses should contact the National Cyber Security Centre as well. In addition, if personal data was affected, businesses will need to report this breach within 72 hours to the Information Commissioner's Office.
Leave it off. There are only a few start attempts left in your failing drive and each attempt uses up a little more of what remains. Our complimentary diagnosis will determine what files are readable.