Data recovery after ransomware: what to do and how to minimize losses

Data recovery after ransomware starts not with searching for a "magic" program but with proper actions in the first minutes after discovering the attack. You need to isolate the infected device, save encrypted files, identify the type of ransomware, check backups, and only then choose a recovery method. In this article, we will discuss what to do immediately, which methods can actually help recover files after ransomware, when to contact specialists, and how to protect against reinfection.

A ransomware virus locks access to data through encryption and demands a ransom for the key. However, paying criminals is risky: there is no guarantee that the key will be provided, and the payment itself may provoke new attacks. It is much safer to act according to a plan and avoid worsening the situation with hasty actions.

What is ransomware and how does it damage data

Ransomware is a type of malware that finds documents, archives, databases, photos, projects, virtual machines, and other valuable files, and then encrypts them. After that, a ransom note usually appears. Files may receive a new extension, such as .locked, .encrypted, .crypt, .lockbit, or another, depending on the malware family.

It is important to understand: in most modern attacks, data is not just "renamed." They are actually encrypted with a cryptographic algorithm. Therefore, manually changing the extension almost never helps. Moreover, careless attempts at "treatment" can erase traces needed for analysis.

Ransomware often infiltrates systems through:

• attachments in phishing emails;
• infected documents with macros;
• hacked RDP or VPN remote access;
• vulnerabilities in old software;
• pirate activators and illegal software builds;
• infected sites and downloaders;
• compromised administrator accounts.

In a corporate environment, the attack can spread across the network. In this case, not only workstations but also servers, network folders, NAS, backup storage, and cloud synchronization may be affected.

Initial actions when infected with ransomware

The main goal in the first minutes is to stop the spread and preserve as much information for recovery as possible. Do not restart the computer unnecessarily and do not run random decryptors from the internet.

Step-by-step plan for the first 30 minutes

1. Disconnect the device from the network. Remove the network cable, turn off Wi‑Fi and Bluetooth. If a server is infected, isolate it from the local network.
2. Do not delete encrypted files and the ransom note. They will help identify the ransomware family and find a possible decryptor.
3. Do not format the disk. Formatting complicates recovery and may destroy shadow copies or remnants of original files.
4. Make a copy of the infected medium. If possible, create a bit-by-bit disk image or at least copy the encrypted data to an external drive.
5. Document signs of the attack. Save file extensions, text of the note, wallet addresses, emails of the criminals, time of encryption start.
6. Check other devices. Disable shared folders, NAS, and external disks to prevent the ransomware from reaching them.
7. Contact an information security specialist or administrator. Especially if the infection occurred in a company.

This sequence of actions reduces the risk of data loss and helps choose the correct recovery strategy.

What not to do after a ransomware attack

It's easy to make a mistake after infection. Some actions may seem logical but, in practice, worsen the situation.

It is not recommended to:

• pay the ransom without consulting specialists;
• download "universal decryptors" from unknown websites;
• install new programs on the infected disk;
• run system cleanup before preserving evidence;
• delete ransom notes and suspicious files;
• overwrite data with large volumes of new files;
• connect backup disks to the infected system;
• attempt to restore a server over an old system without analyzing the cause of the attack.

Fake recovery services are particularly dangerous. They may charge for free tools, steal data, or reinfect the computer.

How to identify the type of ransomware

Identifying the ransomware family is a crucial step. It determines whether there is a free decryptor available, which files are needed for analysis, and how realistic recovery is without a backup.

Look for the following signs:

• new file extensions;
• the name and content of the ransom note;
• email, Telegram, Tor site, or other contact with the criminals;
• changed desktop wallpaper;
• names of suspicious processes;
• time of mass file changes;
• events in Windows, Linux, or network equipment logs.

For initial verification, you can use known ransomware identification services. Typically, they ask you to upload the note and several encrypted files. Be sure not to submit confidential documents. It's better to choose neutral files without personal data.

Where to look for a decryptor

Safe sources for verification include:

• the No More Ransom project;
• websites of major antivirus labs;
• official databases of decryptors from information security solution providers;
• recommendations from national computer incident response teams;
• consultations with specialized data recovery professionals.

If a decryptor is found, test it on copies of files first, not on a single instance. This protects against further data damage.

Data recovery methods after ransomware

There is no single method that works for everyone. The choice depends on the type of ransomware, the availability of backups, the state of the disk, the operating system version, and whether original files were deleted after encryption.

Comparison of main recovery methods

Method	When it suits	Advantages	Limitations
Recovery from backup	Clean backup exists before attack	Most reliable path	Must ensure that the copy is not infected
Official decryptor	Ransomware family has been studied	Can recover files without ransom	Not available for all ransomware variants
Windows shadow copies	Shadow copies not deleted	Quick for individual files and folders	Many ransomwares delete the copies
File history and restore points	Features were enabled beforehand	Convenient for home PCs	Does not always save all types of data
Recovery of deleted originals	Ransomware created a copy and deleted the original	Sometimes helps partially	Requires minimal disk overwrite
Cloud file versions	Used Google Drive, OneDrive, Dropbox, or similar	Can roll back changes	Depends on the plans and retention periods
Professional lab	Data is critical, situation is complex	Deep analysis and safe handling of the medium	Requires time and budget

We will now discuss these options in more detail.

Recovery from backups

If you have a current backup, this is the best scenario. But before recovery, it is important to ensure that the backup was created before the infection and does not contain any malicious files.

The correct order of actions:

1. Clean or reinstall the infected system.
2. Close the vulnerability through which the attack occurred.
3. Check the backup with antivirus and EDR tools, if available.
4. Restore data in an isolated environment.
5. Check the integrity of documents, databases, and applications.
6. Only then return the system to the working network.

For businesses, it is especially important not to restore the server into the old compromised infrastructure. If criminals retained access, encryption may recur.

What backups are considered safe

The most resilient option is the 3-2-1 rule:

• 3 copies of data;
• 2 different types of media or storage;
• 1 copy off the main network or in immutable storage.

Offline backups, WORM storage, immutable snapshots, separate accounts for backup systems, and regular recovery tests are very helpful. It is important not only to make copies but also to verify that they can actually be restored.

Decryptors for ransomware

Sometimes specialists find mistakes in the encryption implementation, acquire keys after detaining a group, or publish free tools. In such cases, recovery is possible without paying a ransom.

However, decryptors only work for specific families and versions. If a tool is intended for one version of ransomware, it will not decrypt files of another. In the worst case, it can damage copies if used incorrectly.

Before running a decryptor:

• make a copy of the encrypted data;
• read the manufacturer's instructions;
• check the digital signature or source of the download;
• use a test folder;
• save a report on the result.

If a decryptor asks you to upload private documents to an unknown site, it's better to stop. Safe tools are usually published by reputable organizations and come with clear documentation.

Shadow copies, file versions, and restore points

In Windows, shadow copies, file history, and previous versions can help restore a file or folder to its state before encryption. However, many modern ransomwares attempt to delete shadow copies using a command like vssadmin delete shadows.

You can check for previous versions as follows:

1. Open the properties of the folder or file.
2. Go to the "Previous Versions" tab.
3. Select a date before the attack.
4. Copy the data to a safe place.
5. Check the result.

If the standard interface shows nothing, sometimes specialized tools for viewing shadow copies can help. But they should be installed on a separate clean computer or work with a disk image.

In macOS, Time Machine can serve a similar role. In Linux — snapshots of Btrfs, ZFS, LVM, or backups through rsync, Borg, Restic, and other systems. The key point is to have a snapshot before encryption.

Recovery of deleted original files

Some ransomware create an encrypted copy of a file while the original is deleted. In such situations, part of the originals can be attempted to be recovered as deleted files. The chances depend on whether the corresponding disk areas have been overwritten.

This method is especially sensitive to user actions. The more you use the disk after the attack, the lower the likelihood of success. Therefore, it is important to stop writing to the medium immediately and make an image.

Recommendations:

• do not install recovery programs on the infected disk;
• do not save found files to the same medium;
• create an image first, then work with the copy;
• use read-only mode if possible;
• check the integrity of recovered files.

This method often yields partial results. It can recover photos, documents, archives, or individual databases but does not guarantee full recovery of folder structure.

Cloud storage and synchronization

If files were synchronized with the cloud, the ransomware may have sent already encrypted versions there. However, many cloud services keep a history of changes. Therefore, you can roll back individual documents, folders, or entire accounts to the point before the attack.

Check:

• the history of file versions;
• the trash of the cloud service;
• the mass recovery feature after ransomware;
• activity logs;
• connected devices and applications;
• access of third-party users.

After recovery, be sure to change the password, enable multi-factor authentication, and disconnect unknown sessions. Otherwise, criminals may regain access.

When to seek professional help

A home user can check backups, shadow copies, and official decryptors independently. However, in some cases, it’s better to contact specialists immediately.

Professional help is needed if:

• accounting databases, CRM, ERP, or medical data are encrypted;
• servers, Active Directory domain, NAS, or virtual infrastructure are attacked;
• there are no backups;
• the medium is physically damaged;
• you need to preserve evidence for investigation;
• there is a risk of personal data leakage;
• criminals still have access to the network;
• business continuity with minimal downtime is required.

Specialists first create copies of media, analyze the malware, check logs, look for the entry point, and assess recovery options. This approach is safer than chaotic attempts to restore files.

How to verify that the system is clean

Recovering files is not enough. You need to ensure that the ransomware is removed and the entry path is closed. Otherwise, the attack may happen again.

Minimum checklist:

1. Update the operating system and all critical applications.
2. Remove unknown accounts.
3. Change passwords, especially for administrators.
4. Enable multi-factor authentication.
5. Check autostart, services, and task scheduler.
6. Analyze RDP, VPN, email gateways, and login logs.
7. Scan the system with reliable antivirus or EDR.
8. Check network folders and backup repositories.
9. Limit user rights based on the principle of least privilege.
10. Set up monitoring for suspicious activity.

For companies, it’s useful to conduct an incident breakdown. It should answer three questions: how attackers entered, what they managed to do, and what measures will prevent recurrence.

How to protect against re-encryption

Prevention is cheaper than recovery. Even if data has been restored, it’s worth reviewing protection.

Backup

Set up regular copies of important data. Keep at least one copy off the main network. Use separate accounts for access to backups. Periodically conduct test recoveries.

Updates and vulnerabilities

Outdated systems and programs often become entry points. Update Windows, Linux, macOS, office suites, browsers, VPN gateways, hypervisors, and network devices. For businesses, the vulnerability management process is crucial.

Protecting remote access

If RDP is used, do not open it directly to the internet. Use VPN, MFA, IP restrictions, complex passwords, lockout mechanisms, and logging of logins. Remote access should be visible to the administrator and not run "on its own."

User rights

A user operating with administrator rights increases damage from an attack. Separate regular and administrative accounts. Do not grant access to network folders "just in case."

Employee training

Phishing emails remain a common infection vector. Explain to employees how to verify senders, attachments, links, and urgent payment requests. The sooner a person notices a suspicious email, the lower the risk of an incident.

Network segmentation

Not all devices should see each other. Separate workstations, servers, backup storage, cameras, guest Wi‑Fi, and critical systems. This way, the infection of one computer will not automatically lead to the encryption of the entire network.

FAQ about recovery from ransomware

Can you recover files after ransomware without paying ransom?

Yes, sometimes it is possible. The most viable options are a clean backup, an official decryptor, shadow copies, cloud file versions, or recovery of deleted originals. If none of these are available, chances depend on the specific ransomware variant.

Is it necessary to pay ransom for decrypting data?

Paying is risky. Criminals may not send the key, may send a non-working tool, or may demand more money. Additionally, payment does not eliminate the vulnerability that led to the attack.

Will renaming files restore access?

Almost never. A new extension is usually just an external sign. The content of the file remains encrypted. Renaming may hinder analysis, so it’s better to retain the original names.

Can antivirus be used to decrypt files?

Antivirus can remove the malware and stop further infection but usually does not decrypt already damaged files. A suitable decryptor or backup is needed for decryption.

Why shouldn't you format the disk immediately?

Formatting destroys part of the information that might be needed for recovery: deleted originals, shadow copies, event logs, and traces of the malware. It's better to create a disk image first and conduct an analysis.

How to know if a backup is not infected?

Check the creation date, backup system logs, file integrity, and antivirus scan results. It's better to recover data first in an isolated environment, not directly into the working network.

What to do if files on NAS are encrypted?

Disconnect the NAS from the network, do not overwrite data, and check snapshots, trash, file versions, and backups. If the NAS was accessible via SMB from the infected computer, you also need to clean that computer and change passwords.

Quick recovery checklist

Use this list as a guideline:

1. Isolate the infected device from the network.
2. Preserve encrypted files and the ransom note.
3. Create a disk or important data copy.
4. Identify the ransomware family.
5. Check for an official decryptor.
6. Check backups, shadow copies, and cloud versions.
7. Recover data only to a clean environment.
8. Eliminate the cause of the infection.
9. Change passwords and enable MFA.
10. Set up secure backups for the future.

Conclusion

Data recovery after a ransomware virus requires a calm and methodical approach. First, stop the spread, preserve evidence and copies, then check backups, decryptors, shadow copies, and cloud versions. Do not pay the ransom and do not run dubious programs. If the data is important or a corporate network is infected, contact specialists as soon as possible: this will increase the chances of recovery and help close vulnerabilities before another attack.