An employee came to work and was met with the following sight. After an hour of panic and cursing the entire world, he turned to the local IT specialist, who in turn “cleaned” the computer and reported that there was no way to recover the data. Then, as a last hope, he contacted us.
Unfortunately, the computer had already been cleaned, so it was no longer possible to analyze the malicious code itself. We had to examine the files directly. By understanding the structure of certain files and what content they should contain, and comparing them to the encrypted ones, we managed to obtain the decryption key.
As the work progressed, we developed a decryption tool, and by the end, we informed the employee that we could already send the most urgent files needed for that day.
If we had access to the virus itself, the time and effort required would have been significantly lower—and so would the cost. This situation once again confirms that although your actions might seem logical, they can strongly affect professional data recovery, the time it takes, and ultimately, the price.