MHDR / Common faults / Locked by ransomware

Loss caused by ransomware

Ransomware recovery, Maidenhead. There is nearly always more left than the note claims.

We will help you recover your files from ransomware whether you are a business or household in Maidenhead; we do not deal with those responsible for the ransomware attack, and that holds for all of our clients. Our work runs the other way from the ransom demand: shadow copies the malware missed (if they were created), snapshots of NAS devices where backup data exists, original files stored in unallocated blocks, and the corners the malware cut as it tried to encrypt a network before being noticed. Encryption can be very successful; however, it rarely achieves complete success.

Only pay if we recover your data, on most jobs Diagnosis free, then a fixed quote Get a quote, then post it in from Windsor, Slough or anywhere else

Describe the fault to an engineer
0800 6890668

Ransomware notes and extensions, decoded.

None of these? Run the triage →

The signs	The likely cause	Start here
Every file name now includes a different suffix than it did previously (i.e., .akira or some string that was randomly created based upon the specific network you operate)	A “pass” through the encryption process has occurred, and the Qilin malware creates an extension for each victim’s files	Take a photograph of it, then remove the power source
akira_readme.txt left in every folder	This is Akira’s ransom demand; other builds typically drop powerranges.txt or fn.txt instead	Do not touch the ransom demands
README-RECOVER-<extension>.txt	Any ransom demand sent to you by the Qilin malware is named after the extension you received for your files	Save all of them
RECOVER-<id>-FILES.txt	This is a naming convention used by BlackCat/ALPHV	Save all evidence
Wallpaper was changed to a demand for payment	Your lock screen took you to a Tor website	Take a photo of your display first
Shadow copies gone, with vssadmin delete shadows in the logs	Roll-back restore points were deleted so you could not roll back Windows	Helps narrow down the area of investigation

If you wish to post it: first obtain a quote for your item via either of two methods: by telephone or by completing the online form. Then you can post the item to us using a tracked and fully insured postal service that will take it directly to our secure intake laboratory in Guildford. Alternatively, if you would rather drop it off at the Guildford laboratory personally, this is possible Monday to Friday, 9am to 5:30pm, and no appointment is needed; either way, we will cover the return postage costs. From a laptop, PC or Mac, send the drive on its own (storage soldered onto the circuit board, as in T2 and Apple silicon Macs or soldered laptop flash memory, is not taken on; if you're unsure which kind you have, please call us first). RAID drives require removal from their casing and labelling by bay number, and server disks will similarly need removing from the server and labelling by bay number. NAS disks need the same procedure if they can be removed; if not, send the entire NAS unit. An external drive must be posted whole, complete with its cable and power supply. If you wish to check the packaging before posting, an engineer will talk you through every item on the telephone. Every stage of this process is detailed on the posting page.

The ransomware crews working UK networks in 2025–26.

QilinMost prolific gang of 2025; had over a thousand identified victims. One victim was Synnovis, and as a result London’s NHS pathology service stopped working in June 2024. There is no free decryption available for this ransomware.

AkiraCISA and the FBI issued a warning in an advisory dated November 2025 calling it an immediate threat. The single free decryptor works only for the build from 2023, and each subsequent build has remained unbroken.

After LockBit's fallA joint NCA-led effort to take down LockBit in February 2024 provided keys for several previous victims that had been affected by the LockBit attacks. Since then other gangs have taken up where they left off, but operate at a lower scale.

Free decryptors, honestlyAny legitimate free tools are listed on No More Ransom. At this time there are no free tools to help decrypt Akira in its present form, Medusa, Qilin, RansomHub or INC. In addition, the “universal decryptors” being promoted via advertising campaigns online are not free and do not decrypt.

What happens between arrival and return.

The most recent cases →

Booked in, then assessed at no cost Free

Nothing is chargeable until you say yes. Every item gets a case number of its own immediately upon receipt, an engineer determines what has failed, and you get a clear picture of which files have a real possibility of being recovered. The single quote that follows is fixed, written down and does not cost anything.

Diagnosis at no costOne fixed quote, in writingNothing signed

Isolate, and preserve everything

Each infected machine is removed from the network before any further action is taken. Only the hard drive(s) come in to us (server disks labelled by bay), and any existing BitLocker recovery keys go on the shipping form. All drives are then imaged including any unallocated space (as many times original data can still exist in unallocated areas). No cleaning of any type is done: wallpapers, lock screens and notes are all part of your case record.

A forensic image of every diskUnallocated space included

Recover what survived

In many instances, variants employ duplication as the mechanism to perform encryption: the copy is encrypted and the original deleted, which leaves the original unreferenced but not removed. Until it is overwritten, patient carving will lift the entire file back. Concurrently, we seek to identify shadow copies missed by the variant’s execution, snapshots from a network attached storage (NAS), large files that were encrypted only in segments and any legitimate decryptors specific to your variant.

Deleted originals carved backYour variant checked for a key

Clean media, with a paper trail

Files recovered through forensic techniques do not return to any hardware device used during the malicious activity. Instead they arrive on new media devices with sufficient documentation to allow submission to insurers or the ICO (Information Commissioner’s Office).

Returned on fresh mediaDocumentation for the ICO

Opened, verified, and sent home

You don't get charged anything until you've confirmed and authorised that everything is fine after seeing the entire list of what was recovered. Any recovered items are returned via brand-new storage media and the postage costs for these are covered by us. We do not consider a project complete here until we receive confirmation that you have been able to successfully access and review every item you received back.

You approve the list firstReturned on fresh mediaThe return post is ours

What tends to show up first

vssadmin delete shadows /all /quiet: virtually all variants begin with vssadmin delete shadows /all /quiet, removing the restore point entries kept by Windows. Identification of this entry within logs allows us to determine which variant(s) are being utilised and where to continue our search efforts.
Copy, encrypt, delete leaves a gap: the original file remains unlinked rather than destroyed when it is copied and then encrypted before deletion. It is placed into unallocated space until another process or application claims the space. Carving will often return it intact.
Speed forces compromises: variants that execute quickly only encrypt large files in sections. Typically, the portions of these large files that were excluded from encryption can usually still be opened.
The rules are moving: in July 2025, the UK government set out a ban on public sector entities and organisations considered critical national infrastructure making ransom payments. As such, regardless of what happens to private businesses, the trend away from paying ransoms is evident.

Now refusal is the majority position: in June 2025, Sophos reported that 97% of organisations which had been subject to encryption recovered their data, including a payment made in 49% of these instances. Coveware's Q3 2025 statistics report that only 23% paid, which represents the lowest percentage of payment Coveware has recorded. The British Library was asked for approximately £600,000 in 2023 after having been attacked by ransomware, and decided not to pay, rebuilding instead. A payment does not guarantee any form of security, and it is not the only method of recovering lost data; making a payment is simply the most obvious option.

Under attack? Who to inform

Report Fraud (previously Action Fraud): you should contact this service for cybercrime reporting at 0300 123 2040, which will answer your calls day and night during an active hack.
NCSC: report this incident to the National Cyber Security Centre as well, and follow their steps, as outlined on their website, to guide you through handling the ransomware.
ICO, within 72 hours: if you suspect your company has lost personal information as a result of the hack, report it to the Information Commissioner's Office (ICO) within 72 hours under UK GDPR; the clock starts immediately.
No More Ransom: nomoreransom.org is the Europol-supported repository of publicly available decryption tools, and the one place a legitimate free decryption tool is published. Search here first before accepting any other offers.

Our job is to handle the data: create images of the hard drives, restore files where possible, rebuild the data onto hardware that we know is clean, and document everything to provide evidence to an insurance company or to the ICO for regulatory purposes. We do not negotiate with hackers, and we don't recommend it.

From the casebook, lately.

MH · MHD-2026-6638ON RECORD ✓

A builders' merchant in Buckinghamshire, locked overnight

All files were copied prior to encryption, therefore none were encrypted in place. The copies were then encrypted, and the originals deleted. Therefore, the key issue became finding a way to carve out what remained in unallocated space. A previously unknown NAS snapshot provided them with enough material to fill in the gaps. They resumed trading within the week, with nothing paid, and no one answered the attackers.

Running inside the weekNothing paid out at all

Before it comes to the lab.

Do these now

Get a photo of each note and all your lock screens first
Pull infected computers off the network (while they are still running)
Save all logs; do not remove anything
File a report with Report Fraud, then contact the National Cyber Security Centre (NCSC); if you suspect a breach of personal data, please report to the Information Commissioner's Office (ICO) within 72 hours

Things best not done

To communicate with the attacker, negotiate, or pay them
Restoring from back-ups to systems which have never been wiped clean of malware
Paying for any 'universal decryptors'
Rebooting a locked network attached storage device prior to photographing its screen

The questions that arise most often.

Is paying ever advisable?

No. British law enforcement agencies and the ICO agree on this point: do not pay. Payment for ransomware attacks funds subsequent attacks, there is no obligation for an attacker to provide access to encrypted files after receiving payment, and according to the ICO payment will not improve how your case will be treated. We do not make payments to attackers.

Can the files come back without a payment?

Many times, yes, whole or in part. There are many routes available, including backups, shadow copies when a run failed to delete them, NAS snapshots, files left behind in free space by a strain that copies before encrypting, and occasionally a legitimate free decryptor for a particular version/build of ransomware.

Could a free decryptor already exist for it?

Start here: No More Ransom, the real archive supported by Europol. At present, none of the tools will open Qilin, Medusa, RansomHub, INC, nor the current versions of LockBit and Akira, therefore anybody claiming to sell keys for these strains is merely selling recovery labour under a different name.

Does it have to be reported?

Yes. Report Fraud (formerly Action Fraud) accepts calls at 0300 123 2040 and a business should also contact the NCSC regarding this incident. If it is more likely than not that personal data has left your building, you have 72 hours to inform the ICO per UK GDPR.

More of the jobs we've closed.

NAS recovery → Servers & RAID sets → Files gone missing → Media we work with →

Switched off, it keeps every chance it has.

Every additional power-up asks for even more of a drive that is already starting to fail. First open a case with us, and let the free diagnosis tell you how much remains.

0800 6890668

Ask for a free diagnosis Posting it to us

Hardware and media we recover

Typical faults

Evidence and enquiries

Practical matters