Encrypted files, a note demanding cryptocurrency, a countdown — ransomware is engineered panic, and panic is the attacker’s best tool. The counter is method: isolate what’s infected, pay nobody, and let a systematic recovery establish what can come back without funding the next attack. This bench runs that method for homes and businesses across Scotland.
$ edr connecting…
Disconnect infected machines from network and internet — ransomware spreads to every share and drive it can reach, and NAS boxes are prime targets. Don’t wipe, don’t ‘clean up’, don’t reinstall — the encrypted files, the note and the malware itself are all evidence the recovery needs. Don’t pay: payment funds the industry, marks you as a payer, and returns working decryption far less reliably than the note promises. Report it — Police Scotland on 101 and the NCSC take these seriously — then get the affected media to the bench, powered off, for assessment.
Real-world ransomware recovery is archaeology across several strata: known-ransomware decryptors where researchers have broken a strain (it happens more than attackers advertise — identification of your exact variant comes first); what encryption missed — interrupted runs, skipped folders, file types the malware ignored; shadow copies and snapshots that sloppier strains fail to purge; deleted originals, because many variants encrypt a copy and delete your file — making this partly a deletion recovery against a hostile clock; and backup archaeology, resurrecting the drive you’d retired or the cloud version history you forgot. The honest note: files sealed by intact modern encryption, with no decryptor and no other stratum, stay sealed — you’ll hear which parts of your data fall where at diagnostic, free.
Our strong advice: no. Payment is unreliable (broken decryptors, partial keys, repeat extortion are all common), it funds and encourages the next attack, and it can raise legal issues depending who's behind the strain. Let assessment establish what recovers without paying — frequently more than the panic suggests.
Often, and NAS boxes bring extra strata: snapshots the strain failed to purge, and deleted-original recovery on the volumes. Power it down, don't factory-reset it, and send the labelled disks. NAS-targeted strains are a bench staple now.
Yes — identification from the note, extensions and samples is step one, checked against current decryptor availability. When a decryptor exists we use it as part of the job; when it doesn't, the other recovery strata still apply. Either way you know before spending.