Same-day assessment available
Ransomware Data Recovery
When ransomware encrypts your servers, virtual machines and backups, DriveSavers looks for every path to your data, before or after engaging with the threat actor. Our solutions may get more data back than paying the ransom.
What we recover after an attack
Encrypted virtual disks
Structural damage to virtual disks caused by encryption.
Backup files
Damaged or partially encrypted backup sets.
Databases
SQL and other databases damaged by encryption.
Prior versions
Unaffected versions of data, including from copy-on-write systems.
Alternate sources
Tape and cloud assets that may hold clean copies.
Failed decryptors
Files corrupted by a decryptor that didn't work.
First steps after an attack
- Isolate affected systems, but don't wipe or rebuild them.
- Preserve encrypted data, logs and ransom notes.
- Don't run decryptors on your only copy of the data.
- Bring in your incident response firm, counsel and insurer.
- Call us for a free consultation.
How we work
- Free consultation and same-day assessment.
- We work alongside forensics firms, incident responders, breach counsel, restoration teams and insurers.
- Can operate under privilege with counsel.
- Cost is confirmed before work begins.
- Annual SSAE 18 SOC 2 Type II audit.
Turnaround times
ASAP
Ransomware cases are handled as Priority, beginning as soon as data is available to us, 365 days a year.
1 to 2 business days
24 to 48 hours during business hours, Monday through Friday. The fastest Standard turnaround in the industry.
5 to 7 business days
Completed during business hours. Smart devices such as phones and tablets take 10 to 14 business days.
No payment is needed to start. You pay only when your recovery is complete.
Frequently asked questions
Should we pay the ransom?
That decision is yours and your advisors'. Paying doesn't guarantee a working decryption key, and full recovery after paying is rare. We may be able to recover more data without paying.
Can you help after we've already paid?
Yes. We recover data damaged by decryptors that didn't work, and data the decryptor missed.
Do you work with our incident response firm?
Yes. We routinely work alongside forensics firms, breach counsel and insurers, and can operate under privilege.