Data Recovery · LanCologne

What is the difference between traditional data recovery and data restoration as part of an incident response following a cyber attack?

Following a cyber attack, there are two distinct questions: How do we get our data back? And: How did the attacker gain access and what did they do? Data recovery addresses the first question, whilst incident response and forensics address the second. If you merely restore the data, you risk failing to address the root cause and losing evidence.

Free enquiry

Technical background

In the case of ransomware, data is encrypted, and shadow copies and backups are often deliberately deleted. Recovery from backups or raw data is possible if unencrypted data sets exist. At the same time, the affected systems contain traces such as event logs, logins, remote maintenance connections and persistence mechanisms, which are required for investigating the cause, insurance purposes and reporting obligations.

What you should – and shouldn’t – do now

  • Disconnect the affected systems from the network, but do not reinstall or format them.
  • Do not restore data to the compromised system until the method of access is known.
  • Document the ransom demand, the blackmail note and the times involved.
  • Involve the insurance company and the data protection officer at an early stage.

Here’s how we do it

  • Identify which data is stored in unencrypted form (back-ups, offline media, shadow copies, raw data).
  • Before restoration, carry out a forensic backup of the relevant systems and logs.
  • Restoration to cleaned-up systems; simultaneous reconstruction of the attack path.

Borders

  • Files secured using the latest encryption cannot usually be decrypted without a key.
  • If logs have been overwritten or systems have been reinstalled, it is often only possible to reconstruct the cause to a limited extent.
  • Paying a ransom does not guarantee that the files will be decrypted or that they will be recovered in full.

Possible results

Depending on the assignment: recovered data sets and/or a report on the method of attack, the timeline and the systems affected.

How we carry out data recovery

Every data storage device is first diagnosed in our own laboratory in Cologne; the diagnosis is free of charge. You will then receive a written quote and can decide whether to accept it. If you decline, you can collect the data storage device from the laboratory by appointment – there are no postage costs involved – or we will post it back to you; in which case postage and packaging costs may apply. Data is recovered from copies, not from the original – using professional data recovery hardware such as the PC-3000. If a drive needs to be opened, this is carried out on a HEPA H14-filtered clean bench. We do not offer a guarantee of success prior to diagnosis, as this is simply not possible in a professional context. Your storage device and your data will remain confidential and will not be passed on to third parties.

1Enquiries and submission by post or in person at the laboratory by prior appointment
2Free diagnosis of the cause of the damage
3Written quotation – we will only proceed once you have approved it; if you decline, you may collect the item from the laboratory or we will return it to you (postage and packaging costs may apply)
4Recovery, data verification and confidential handover

Request a diagnosis   Find out more about the process, costs and confidentiality →

Frequently Asked Questions

Is it enough simply to restore the data from the backup?+
Only if the access route is closed. Otherwise, the attacker can gain access again, and evidence needed for insurance claims and reporting will be lost.
Is it possible to recover files encrypted by ransomware?+
To some extent: via unencrypted copies, shadow copies, files that are not fully encrypted, or known vulnerabilities in individual malware families. For recent variants with a clean implementation, there is generally no way round it without a key.
Who decides whether a forensic examination is necessary?+
The company – ideally one that offers insurance and legal advice. We’ll explain which questions can be answered from a technical perspective.

Related topics

🔗 Related topics