Recovery after ransomware: a practical guide for businesses and private users

Recovery after ransomware does not start with searching for a "magic" program, but with properly stopping the attack, preserving evidence, and safely returning systems to operational status. This article covers the initial actions to take when infected, ways to assess damage, options for restoring files, working with backups, verifying decryptors, and measures to reduce the risk of re-attack.

Ransomware is a type of malicious software that blocks access to data, typically by encrypting files. The attackers then demand a ransom for the decryption key. Sometimes the attack is accompanied by data theft and threats of publication. Therefore, it is important to act quickly but without panic.

The main goal in the first hours is not to "fix everything at once," but to avoid making matters worse. You should not reboot everything indiscriminately, connect backup disks to the infected network, or pay the ransom without assessing the situation. A methodical approach increases the chances of recovering data and preserving evidence for investigation.

What happens during a ransomware attack

Modern ransomware is rarely launched randomly and all at once. Often the attack unfolds in a chain:

• the attacker gains access via a phishing email, stolen password, vulnerable VPN, RDP, or outdated server;
• establishes a foothold in the network and escalates privileges;
• disables defensive measures and shadow copies;
• searches for file servers, databases, accounting systems, and backups;
• encrypts data and leaves a ransom note;
• in some cases, preemptively exfiltrates documents to external storage.

Because of this, recovering from ransomware includes not just file restoration. It is necessary to understand how the breach occurred, which accounts were compromised, and whether the attacker is still inside the network.

Initial actions upon discovering an infection

If a ransom note appears on the screen, files have strange extensions, or users are complaining en masse about document unavailability, follow the plan.

Step-by-step checklist for the first 60 minutes

Step	What to do	Why it’s necessary
1	Disconnect infected devices from the network	Stop the spread of encryption across network folders and servers
2	Do not turn off computers unnecessarily	Keys, processes, and traces of the attack may remain in RAM
3	Disconnect shared folders and network drives	Protect data that has not yet been encrypted
4	Isolate backups	Prevent the ransomware from reaching backups
5	Save the ransom note and examples of files	Help identify the ransomware family
6	Notify responsible personnel	Quickly involve cybersecurity experts, system administrators, management, and lawyers
7	Start an event log	Document the time, actions, and detected signs of compromise

Important: if the infection affected servers, virtual infrastructure, or critical business systems, it is better to immediately involve incident response specialists. Independent attempts to "clean" the system may destroy important traces.

What not to do immediately after the attack

Do not perform actions that often worsen the situation:

• do not connect external backup drives to the infected computer;
• do not run random "decryptors" from unverified sources;
• do not delete the ransom note, logs, and suspicious files;
• do not format disks before making copies and analysis;
• do not use compromised passwords to access restored systems;
• do not transfer ransom without consulting lawyers, cybersecurity specialists, and management.

Hasty cleaning could lead to reinfection. Additionally, some data can sometimes only be recovered if the original encrypted files and technical traces of the attack are present.

How to isolate infected infrastructure

Isolation is a key stage in data recovery after ransomware. The goal is to separate infected nodes from healthy ones and preserve what is still unencrypted.

For a separate computer, it is usually enough to unplug the network cable and Wi-Fi. If it’s a laptop, disable Bluetooth and don’t connect USB drives. Do not turn off the device if it is not actively encrypting data and you can transfer it to a specialist.

In a corporate network, take broader actions:

• disable access to file shares for suspicious accounts;
• temporarily block VPN, RDP, and remote access if they could be entry points;
• segment the network by separating workstations from servers;
• disable synchronization of cloud folders if encrypted files have been uploaded there;
• check domain controllers, hypervisors, mail servers, and backup systems;
• stop scheduled tasks that may overwrite good backups with bad ones.

If EDR, SIEM, or centralized antivirus is used, check the management console. Often, the first infected hosts, suspicious processes, and accounts that executed the encryption are visible there.

How to assess the extent of damage

Before recovery, it is necessary to determine what data is lost, which systems can be trusted, and where the root cause of the attack lies.

Inventory of affected systems

Make a list:

• infected workstations;
• file servers;
• databases;
• virtual machines;
• cloud storages;
• network folders;
• backup repositories;
• accounts used during the attack.

For each item, document the status: operational, turned off, isolated, partially encrypted, fully encrypted, data accessible, backup present, or absent.

Signs of data theft

Not all ransomware restricts itself to blocking files. Many ransomware operators first exfiltrate data. Check for:

• unusually high outgoing traffic;
• archives with names like backup.zip, data.7z, docs.rar in non-standard folders;
• running remote administration tools;
• connections to unknown IP addresses;
• login events at unusual times;
• use of cloud utilities and public file-sharing services.

If there are signs of leakage of personal data, trade secrets, or payment information, involve lawyers. Notification of regulators, customers, or partners may be required in accordance with applicable laws and agreements.

Is it necessary to pay the ransom?

Payment does not guarantee file recovery. The decryptor may not work, the key may be partial, and the attackers may demand payment again. Moreover, paying supports the criminal model and sometimes carries legal risks, especially if the recipient is on sanctions lists.

However, the decision to pay the ransom in business is usually made not emotionally but through risk assessment. Factors such as backup availability, critical downtime, likelihood of leakage, legal requirements, and expert recommendations are taken into account. Even if an organization considers negotiations, this does not eliminate the need for investigation, isolation, and preparation for recovery.

For private users, the best option is almost always not to pay, but to check backups, try reliable decryptors, and restore the system safely.

How to identify ransomware

Determining the ransomware family helps understand whether a free decryption tool exists and what indicators of compromise to look for.

Use the following data:

• file extension of encrypted files;
• text of the ransom note;
• email addresses or websites of the attackers;
• names of malicious files;
• hashes of suspicious executable files;
• time of mass file changes.

It is better to check samples through known and secure ransomware identification services or with specialists. Do not submit sensitive documents to public services if it could violate company policy or the law. Usually, a ransom note and one irrelevant encrypted file are sufficient for analysis.

File recovery after ransomware

There is no one method that fits all. The choice depends on the type of ransomware, the condition of backups, the affected systems, and whether shadow copies were deleted.

Option 1: recovery from backup

This is the most reliable way if the backups are undamaged. But they must be checked before recovery.

Correct sequence:

1. Isolate the backup storage from the infected network.
2. Find a restore point prior to the attack, not just to the moment of detection.
3. Test the backup in a test environment or on a separate machine.
4. Scan the recovered data with antivirus and EDR.
5. Ensure that no malicious tasks, scripts, or accounts are saved in the system.
6. Restore critical services first, then secondary ones.
7. After restoration, change passwords and access keys.

It is important to select a point prior to compromise. If the attacker had been in the network for a week, a backup from yesterday may contain a backdoor, malicious script, or modified account.

Option 2: free decryptors

Free decryption tools are available for some ransomware families. They emerge when researchers find vulnerabilities in the implementation of encryption, obtain keys, or law enforcement seizes infrastructure from criminals.

Use only reliable sources: websites of well-known antivirus companies, international initiatives against ransomware, and official recommendations from CERT/CSIRT. Before launching a decryptor, make a copy of the encrypted files. If the tool fails or the files are corrupted, the copy will allow for trying another method.

Do not trust sites that promise "100% decryption of any files." There is no universal decryptor for all ransomware.

Option 3: shadow copies and previous versions

Windows may store shadow copies of volumes. Some ransomware deletes them, but not always successfully. Check for the possibility of restoring previous versions of files and folders.

Also check:

• Windows file history;
• local NAS snapshots;
• virtual machine snapshots;
• versions of objects in cloud storages;
• the recycling bin and archive folders;
• copies on employee laptops that were not connected to the network during the attack.

Do not restore data directly over encrypted files. It’s better to copy them to a separate clean location and only then move them into the working environment.

Option 4: recovery of deleted data

Sometimes ransomware creates an encrypted copy of a file and deletes the original. In this case, part of the data can theoretically be recovered with file recovery programs. The chance is higher if the disk has not been used since the attack.

For SSDs, the probability is lower due to TRIM. For network storages, it all depends on the file system, snapshot settings, and the volume of subsequent writes. This method should not be the first option, but it is worth considering if there are no backups.

Option 5: manual recovery from sources

If documents cannot be fully restored, you can at least recover critical data from secondary sources:

• email attachments;
• sent reports;
• CRM, ERP, and accounting exports;
• cloud versions of documents;
• local copies from employees;
• data from contractors and clients;
• printed documents and PDF archives.

This path takes time but helps to quickly launch key processes while the technical investigation is ongoing.

How to safely restore servers and workstations

Simply deleting the malicious file is not enough. After ransomware, you should proceed on the basis that credentials may have been stolen and hidden access mechanisms may remain in the system.

Preparing a clean environment

The best option is to redeploy systems from trusted images. This is especially important for domain controllers, administration servers, VPN gateways, and hypervisors.

Recommended order:

1. Create an isolated recovery network.
2. Deploy clean servers from verified images.
3. Install up-to-date security updates.
4. Set up antivirus, EDR, and logging.
5. Restore data from verified backups.
6. Change passwords for administrators, service accounts, and users.
7. Reissue API keys, certificates, and tokens if they could have been accessed by attackers.
8. Check access rights based on the principle of least privilege.
9. Connect workstations gradually, after verification.

Checking Active Directory

In a domain infrastructure, pay special attention to Active Directory. Attackers often create new accounts, add themselves to administrator groups, or use old service passwords.

Check:

• members of the Domain Admins, Enterprise Admins, and local administrators groups;
• new and recently modified accounts;
• suspicious group policies;
• login scripts;
• delegated rights;
• login events from unusual nodes;
• Kerberos anomalies and use of old protocols.

After this, enable multi-factor authentication for remote access and administrative accounts. Also restrict administrators from logging into regular workstations.

Returning users to work

Do not connect everyone at once. Start with a pilot group and critical departments. Monitor logs, network traffic, and security events. If signs of re-encryption appear, immediately halt the process and return to the investigation.

Communication with users is also important. Inform them about which passwords need to be changed, which files are temporarily unavailable, and where to send suspicious emails. The clearer the instructions, the less chaos ensues.

How to work with backups after an attack

Backups are the main tool for recovery, but they often become a target for attacks. Therefore, it is necessary to assess not only the presence of a backup but also its quality.

Signs of a reliable backup

A good backup should be:

• created before the start of compromise;
• inaccessible to regular domain administrators;
• protected from modification or deletion;
• verified through restoration and not just through a successful job report;
• separated from the main network;
• encrypted and protected by separate credentials.

A useful rule is 3-2-1: keep a minimum of three copies of data, on two different types of media, with one copy off-site. To protect against ransomware, immutable copies are additionally used: immutable backups, WORM storage, object storage with version locking, or offline media.

Why backups should not be immediately overwritten

After the attack, some backup systems continue to operate on schedule. They may save already encrypted data over old points. Therefore, first, halt tasks, check retention policies, and protect old copies from deletion.

If there is suspicion that the backup server has been compromised, do not use it as trusted. First, take copies of logs and configurations, then analyze them in isolation.

Investigating the cause of the infection

Without identifying the root cause, recovery remains incomplete. The system could become encrypted again through the same vulnerable access.

Frequent entry points include:

• phishing emails with malicious attachments;
• stolen passwords for VPN or email;
• open RDP to the internet;
• vulnerable web servers and CMS;
• outdated VPN gateways;
• weak administrator passwords;
• absence of MFA;
• infected personal devices;
• insecure contractor connections.

Collect logs from email systems, VPNs, domain controllers, firewalls, EDR, proxy servers, and servers. Compare the time of the first suspicious logins with the time of encryption. Often there is a significant period between them, so analyze not just the last hours.

Legal and organizational actions

Technical recovery after ransomware should proceed alongside risk management. For a company, this is not just an IT incident.

Recommended actions include:

• appointing a responsible incident coordinator;
• keeping a log of decisions and actions;
• preserving evidence for possible action with law enforcement;
• assessing whether personal data has been affected;
• checking the requirements of contracts with clients and partners;
• notifying the insurance company if cyber insurance exists;
• preparing clear messages for employees and clients.

It is inadvisable to hide the problem from internal teams that need to participate in recovery. However, spreading unverified details is dangerous. It is better to use a single communication channel and agreed-upon phrasing.

How to reduce the risk of re-attack

After recovery, the most important stage begins—strengthening defenses. If you simply return everything to how it was, the likelihood of a new incident remains high.

Technical protective measures

Priority actions include:

• enabling MFA for VPN, email, administrators, and cloud services;
• closing RDP from the internet or securing it via VPN and strict access rules;
• updating operating systems, VPN gateways, hypervisors, mail servers, and CMS;
• implementing EDR or modern endpoint protection;
• limiting user rights;
• segmenting the network;
• prohibiting the execution of macros from the internet;
• setting up filtering for email and attachments;
• monitoring PowerShell, PsExec, WMI, and other administrative tools;
• maintaining centralized logs and storing them separately from workstations;
• regularly verifying backup restoration.

Start with measures that close obvious entry points. MFA and patching vulnerable external services often yield quick results.

Organizational measures

Technologies do not replace processes. Clear rules are needed:

• who decides on disconnecting the network;
• where the recovery plan is stored;
• who has access to backups;
• how often recovery is verified;
• how employees report phishing;
• who communicates with clients, partners, and regulators;
• which systems are considered critical.

Conduct training exercises. Even a brief exercise on the scenario of "an encrypted file server" reveals weak points: forgotten passwords, unverified backups, dependence on one administrator, or lack of contractor contacts.

Recovery plan for small businesses

Small businesses often lack a separate cybersecurity team. Therefore, the plan should be simple and executable.

Minimum set includes:

1. List of critical systems: accounting, CRM, website, mail, files, online banking.
2. Contacts for the administrator, hosting provider, lawyer, and manager.
3. Daily backups of important data.
4. One offline copy or immutable cloud copy.
5. MFA for email, VPN, and remote access.
6. Prohibition of shared administrator accounts.
7. Regular updates.
8. Instructions for employees on what to do in case of suspicious emails or encrypted files.

If the budget is limited, start with backups, MFA, and closing open RDP. These measures do not resolve all issues but address common causes of major losses.

Recovery plan for private users

If ransomware infects a home computer, the course of action is similar but simpler.

Do the following:

1. Disconnect the computer from the internet and home network.
2. Do not connect an external drive with photos and documents.
3. Photograph the ransom note and keep a copy.
4. Copy a few encrypted files to a separate medium for analysis, if safe.
5. Check for backups in the cloud, on an external drive, or another device.
6. Find a reliable decryptor for the ransomware family, if one exists.
7. Reinstall the system or restore it from a clean image.
8. Change passwords for email, banking, social media, and cloud storage from another clean device.
9. Return data only after verification.

If the encrypted files contained scans of documents, passwords, or financial data, consider them potentially compromised. Change passwords and enable two-factor authentication.

Common mistakes during recovery

Mistakes often cost more than the attack itself. Here are the most common:

• restoring data onto still infected networks;
• using old administrator passwords;
• failing to verify backups before mass restoration;
• deleting logs and malicious files before analysis;
• trusting random decryptors;
• connecting offline backups to infected servers;
• ignoring the cause of the intrusion;
• prematurely declaring the incident closed.

A good practice is to divide recovery into stages: stopping the attack, analysis, clean environment, data restoration, monitoring, enhancing protection. This reduces the risk of missing important details.

FAQ: answers to common questions about recovering from ransomware

Can files be recovered after ransomware without a backup?

Sometimes it can be done, but not always. Check for free decryptors, shadow copies, versions in the cloud, NAS snapshots, and remote original files. If encryption was implemented correctly and no copies exist, complete recovery may be impossible.

Is there a universal program for decrypting files?

No. Each ransomware uses its own keys and methods. There is no universal decryptor. Use only tested tools for the specific ransomware family.

Should the computer be turned off upon infection?

If encryption is ongoing and there is no other way to stop it, turning off the power may limit damage. However, in a corporate environment, it’s better first to isolate the device from the network and keep the state for analysis, if possible.

Why should passwords be changed after recovery?

Because attackers may have stolen credentials before starting the encryption. If old passwords are left, they may re-enter the network and repeat the attack.

Can the computer be used after removing the virus?

It is better not to consider such a system trusted. For important devices, it is safer to reinstall the OS or deploy a clean image, then restore verified data.

How to tell if a backup is not infected?

You need to select a point before compromise began, restore it in an isolated environment, check with antivirus, and analyze for suspicious accounts, tasks, scripts, and configuration changes.

What to do if files in the cloud are encrypted?

Stop synchronization, change the password, and end active sessions. Then check the version history, recycling bin, and account recovery features. Many cloud services allow rolling files back to previous states.

Brief action plan

If you need to quickly orient yourself, use this order:

1. Isolate infected devices and backups.
2. Document signs of the attack: notes, file extensions, time of events.
3. Assess the scope: workstations, servers, clouds, backups.
4. Identify the ransomware family and check for decryptor availability.
5. Find a clean recovery point.
6. Deploy a trusted environment and update systems.
7. Restore data from verified copies.
8. Change passwords, keys, and tokens.
9. Identify and eliminate the root cause of the attack.
10. Strengthen protection and review the recovery plan.

Conclusion

Recovery after ransomware requires discipline: first, stop the spread, then preserve evidence, check backups, and return systems only to a clean environment. Do not rely on random decryptors and do not connect backups to an infected network. Start with isolation, inventory, and finding a reliable recovery point. After restarting the business, make sure to eliminate the cause of the breach and update the protection plan.