The job · files encrypted across a network
Encrypting an entire network overnight requires rapid action, and as a result it is hasty. That haste is our raw material: snapshots still stored on the NAS, shadow copies never reached, deleted originals that now sit in unallocated space, and one very large file encrypted only in blocks. Remove the network cable, leave the machines powered on, take photos of all the screens, then call. Jobs arrive at this bench from Nottingham, Derby, Loughborough and Leicester. One drive costs £300 + VAT; servers, RAID sets and NAS boxes start at £500 + VAT, and we quote in writing first. Data is our half of it, and nobody here has any contact with the people behind it.
Ask an engineer and the first look is free
0115 8220606
| What it looks like | What usually causes it | What that means for you |
|---|---|---|
| Each filename has a new suffix added: .akira, or a string of characters assigned only to you | Encryption is complete. Qilin assigns a separate extension to every business it hits | Photograph the screen, then unplug the network |
| akira_readme.txt left in each folder | The note Akira leaves. Others may have filenames such as fn.txt or powerranges.txt | Touch none of them |
| README-RECOVER- | Qilin again: the note's name matches the extension applied | Keep all of them exactly as found |
| RECOVER- | The naming BlackCat/ALPHV uses | It is evidence. Nothing gets deleted |
| A demand sitting where the desktop wallpaper was | Any conversation is meant to happen only via a Tor link | Get a photograph of the full screen |
| No shadow copy remains, and vssadmin delete shadows is recorded in the log | Rollback is finished: Windows has nothing to roll back to | That actually makes things easier: it gives us a starting point |
Your case number is assigned when the item is received. Then an engineer works out what went wrong (no charge). At this point, you receive a basic summary of which parts are recoverable and which are not. You also receive a single written quote for the price of the recovery. Accept the quoted price or turn it down, and there is no obligation to pay anything.
The first step, before touching anything infected, is to take it off the network. Next comes a full image of each disk, unallocated space included, because most of the original files deleted can typically still be found there. Nothing is tidied up either: the ransom notes, the wallpaper changes and the demand screen all go into the case file.
It is unusual for ransomware to encrypt data in place. Most strains read the original file, create an encrypted copy right next to it and delete the original, which removes the reference to it and leaves everything else intact. As long as nothing else has taken over that space, those bytes are still there, so carving them out whole is ordinary work here. Every other route gets pushed just as hard: shadow copies the attack missed, snapshots kept on the NAS, large files that were only partly encrypted, and any published decryptor that covers the strain we are dealing with.
Nothing goes back on equipment the incident touched. Media bought specifically for the job carries your files back to you, along with a written account of the work in a form an insurance company or the ICO will accept.
A complete file list will be provided before any invoicing. Simply say "yes" or "no" to what we found: yes means it is billed, no means it is not, and in most cases you only pay if we recover your data. What we find is posted to you on media purchased specifically for your case, at no additional cost to you. We consider the process complete once you have opened those files yourself on your own computer.
Most organisations now refuse. At the end of 2025, Coveware put the share of organisations paying at around 20%, the lowest it had recorded, and its 2026 reports indicated the numbers were even lower. Sophos surveyed organisations early in 2025, publishing that June, and found that 97% of the organisations it asked were able to recover their data. Of those, 49% had paid (48% in its 2026 report), leaving the other half recovering their data without paying. The British Library was asked for roughly £600,000 in 2023. It declined and rebuilt on its own. Paying does not guarantee recovery. There are several paths to recovery and payment is just one of them; however, it is the only path that whoever encrypted your files is interested in you using.
Data is the part we handle: disks imaged, everything that can be retrieved retrieved, results provided on clean hardware purchased specifically for the purpose, and the whole process documented to meet insurer or ICO expectations. Nothing is charged for the first review, a written fixed price is sent before any chargeable work starts, and in most cases you only pay if we recover your data. No connection is ever established with whoever did this, and there shouldn't be one from you either.
None of the files were encrypted where they lay. The malware opened each file in turn, wrote a jumbled version next to it, then deleted the original, so the real accounts never moved from where they sat. They remained unallocated, waiting to be recovered. Anything missed turned up in a NAS snapshot nobody had checked. No ransom, no reply, and the merchant was issuing invoices again within the week.
No. We do not broker payments for anyone. Three reasons, most important first: there is no obligation on the other side to hand over a working key, so what arrives may be partial or broken outright; your money funds more encryption attacks; and the ICO has been explicit that payment counts for nothing when it assesses what happened. Police guidance says the same.
A good deal of it, frequently: some files entire, others only in part. There are five routes and many jobs use two or more of them. A published free tool, if one genuinely covers the strain. Files deleted rather than erased, sitting in place where the file system left them. Snapshots stored on the NAS. Shadow copies the run was unable to reach. And most straightforward of all, a copy already in your own possession.
Start with No More Ransom, which Europol is behind and which only lists tools proven to work. Currently there are no published tools for Qilin, INC, RansomHub or Medusa, and none for the current builds of LockBit or Akira. If someone offers you a “universal key” for any of these strains, you are essentially paying for recovery labour under another name.
Up to three bodies, depending on the case. Cyber crime goes to Report Fraud (Action Fraud renamed) on 0300 123 2040. Businesses should also report it to the NCSC. Where personal data sat among the encrypted files, the ICO needs to be told within 72 hours under UK GDPR, with the time starting from the moment you realise.
The look costs nothing. It gives you a file listing of what opened and what did not, along with the cost of finishing the job, in writing, before anything chargeable begins. In most cases you only pay if we recover your data. Do not switch the drive on until you have that listing.