Can you decrypt ransomware?

No, and neither can anyone else for current families. The algorithms are standard and sound and the keys sit with the attacker. Free decryptors exist only for specific older strains where keys were seized or an implementation flaw was found.

So what can actually be recovered?

Files the run never reached, original content still in unallocated space where the program encrypted to a new file and deleted the original, shadow copies whose deletion is itself recoverable, and anything on systems it could not authenticate to.

Should I leave the machine on to preserve evidence?

No — disconnect it from the network, then power it down. A running Windows machine writes constantly, and those writes overwrite the deleted originals that are the most recoverable material. A forensic image from a powered-down machine preserves the evidence anyway.

Our backup was on a NAS and it got encrypted too. Why?

Because it was reachable from the infected machine. Ransomware follows drive letters and network shares deliberately. A backup means at least one copy the compromised system cannot write to with its own credentials.

Should we pay the ransom?

That is your decision and not one we take a fee for either way. What we will say is that payment is no guarantee of a working decryptor, and that it is worth exhausting the recovery routes above first — they cost less and carry no counterparty risk.

Do we have to report it?

If personal data may have been accessed or lost, you have 72 hours to assess and potentially notify the ICO. Imaging the affected systems before any restore preserves what you need to answer that, at no extra cost.

// scenario · Ransomware

Nobody decrypts it. Plenty survives it.

Every document renamed, a ransom note in each folder, and the backup NAS encrypted alongside everything else because it was mapped as a drive letter. Then the machine was left running for two days while the business decided what to do.

← All case files · £300 + VAT, flat

ⓘ

This is a scenario, not a case study. It describes a failure pattern we handle regularly and how it is approached, written from the technical work rather than from one client's job. Our documented case files are here.

An encryption run has completed across a network. Files carry a new extension, a ransom note is present, and the backups have been found to be encrypted too — or to have been failing quietly for months. The question is what can be recovered without paying.

// nobody decrypts current strains

Said plainly, because the opposite is widely implied.

Modern ransomware uses standard public-key cryptography: files encrypted with a symmetric key, that key encrypted with the operators' public key, the private key never leaving their possession. There is no flaw to exploit and no computation that shortens it.

Several firms advertise ransomware decryption as a service. In practice a number of them negotiate and pay on the client's behalf, marked up, without saying that is what happened. You are then paying a premium for something you could have arranged directly, and funding the operation either way.

The honest exception is older or badly implemented strains where researchers have published working decryptors. The No More Ransom project catalogues those and it is worth checking. If yours is not listed, no laboratory is going to decrypt it.

// what does come back

Everything the run failed to reach.

SourceWhy it survivesTypical yield

Interrupted encryptionThe run was stopped partway Encryption takes hours across an estate. Machines powered off, disconnected or reached late are frequently untouched or partly done. Often substantial

Originals in free spaceEncrypt-then-delete leaves the original Many strains write an encrypted copy and delete the source, which on mechanical storage leaves the original recoverable exactly as any deletion would. Frequently good

Partially encrypted filesSpeed over thoroughness Large files are often only encrypted at the head to save time. The remainder is readable and repairable. Format dependent

Shadow copiesTargeted but not always cleared Deletion of volume shadow copies is standard behaviour and does not always succeed, particularly where privileges were limited. Worth checking

// the first day

Four decisions that shape everything after.

01 / ISOLATE, DO NOT WIPE

The disks are the evidence and the source

Disconnect affected machines from the network and from each other. Do not reimage — those disks hold the unencrypted originals in free space.

02 / DO NOT PAY YET

Establish what is recoverable first

Payment carries no guarantee and the decryptors supplied frequently work partially. Find out what you can get back without it before deciding.

03 / REPORT IT

Action Fraud, and the ICO if personal data

UK GDPR requires notification within 72 hours of becoming aware where personal data is affected. That clock is independent of the recovery.

04 / CHECK EVERY BACKUP

Not just the obvious one

Offline copies, immutable cloud snapshots and version history survive far more often than network shares do.