Ransomware: Assess the Cipher Before Touching Anything
Ransomware recovery starts with identification: the family, the cipher mode, and whether keys leaked or a decryptor exists.
Preserve first
Power down, image the encrypted volume, and keep ransom notes and executables. Any cleanup destroys the evidence needed to identify the family and any partial plaintext that survived.
Partial recovery
Some families encrypt only part of each file, or leave shadow copies, caches, thumbnails and mail spools intact. Those fragments often recover more than clients expect.
FAQ
Should we pay?
It funds the ecosystem and often yields nothing; decryptors exist for some older families only.
Are backups enough?
Only if they are offline and immutable — ransomware targets connected backups first.