There is a particular sound to that phone call. Somebody rings on a Monday morning and behind them you can hear a whole office standing around, unable to work. The owner has come in, found every file renamed into something that will not open, and a note telling them what it will cost to get their working life back.
The backups had failed quietly some months earlier. Nobody found out until the morning they were needed, which is how it nearly always goes. There was a demand, there was a countdown, and the only advice anyone had given them was the advice everybody gets: restore from backup, or pay.
They could not do the first one. So before anybody talked seriously about the second, we went and had a proper look at the files.
Most of it was still there
is in a hurry. Encrypting terabytes properly takes hours, and hours are exactly what an attacker does not have, because somewhere in the building a monitoring alert is about to fire or a staff member is about to notice their files renaming themselves. So the faster families stopped encrypting whole files years ago. They scramble the front of each large file, or stripes through it, rename it, and move on.
The rename is the cruel part. Every file ends up wearing the same hostile extension, so everything looks equally dead. Underneath, a 100 GB database might have had a megabyte touched. The other 99.99 GB had never been encrypted at all. It was sitting there the whole time, perfectly readable, while people who had spent twenty years building that business worked out whether they could afford to buy it back.
Getting it back
We recovered the database by reading its intact pages directly. We got the domain controller back by working out the layout of its virtual disk and reading the filesystem straight out of it, even though the header had been destroyed and nothing would mount it. Roughly three-quarters of the records came back. There was no key and no payment, and we never went near the itself, which was perfectly sound. We read around the damage instead of through it.
Telling somebody their business is not gone after all is the best part of this job. Nothing else we do comes close, and no invoice we have ever sent has felt as good as that phone call did.
The full engagement, including the validation work that separates a real recovery from one that quietly hands back the wrong data, is written up in our whitepaper Reading Around Ransomware.
The thought that would not go away
What stayed with us afterwards was not the recovery. It was how close that business came to paying for data it already had.
When ransomware hits, the first question anyone asks is how much can I get back right now. Nobody asks it out of curiosity. It is the number that decides whether a director wires money to a criminal group, and it gets asked in the first day or two, when everyone is exhausted and the countdown is running.
Nothing answered it. No More Ransom and ID Ransomware will name the strain and hand over a free decryptor if a key has been published, and for most active families one has not. Ordinary file recovery tools know nothing about ransomware, so they run headlong into the encrypted regions and carve out garbage. Specialist firms do the work properly, but by hand, slowly, and at a price that quietly assumes you are the sort of organisation that can absorb it.
Which leaves the people who most need the answer. The family manufacturer, the medical practice, the not-for-profit with four staff and no retainer, all being told everything is gone by somebody who has not actually measured it.
So we gave it away
ScanCrypt is the technique from that engagement, turned into something anyone can run. Point it at an encrypted file, a folder, or a disk. It measures which bytes were encrypted and which were never touched, tells you what percentage is recoverable, and then pulls that data back out. It reads files out of Hyper-V and VMware virtual disks with their names and folders intact, even when the disk will not mount. It checks a recovered SQL database at the page level so you know what you actually got before handing it to anyone.
It is free and open source under Apache 2.0, with nothing to sign up for. It is read-only, so it never writes to the evidence, and it proves that by hashing the input before and after. It runs entirely offline, so you can carry it on a USB stick to an isolated machine and nothing leaves the room. There is a desktop app for people who should not have to learn a command line in the middle of an incident, and a scriptable command-line version for responders who want it in their kit.
We are not looking for a referral for it. Use it on your own incident. Use it on a client's. If you are a competing MSP, take it and use it against us, genuinely. We would rather a business somewhere got a real number before anyone decided to pay a ransom than we got the credit for being the ones who found it.
We would rather disappoint you than flatter you
The people living through this are frightened and short of time, and false hope costs them far more than bad news does. So the caveats live inside the tool rather than in the marketing around it.
- It is not a decryptor. It recovers the bytes that were never encrypted. Whatever was properly encrypted stays that way.
- Recovery is most, not all. You get a measured percentage, never a promise that every file will open.
- Small files are usually encrypted end to end, because the attacker had time. The value is in the big ones: databases, virtual disks, backup archives, media libraries.
- Some encryption patterns recover far less cleanly than others, and the report tells you which one you are dealing with rather than averaging it away.
- A partial file list is reported as partial. It is never passed off as complete.
The families it recognises are labelled the same way. One confirmed against a real sample is marked as confirmed. The rest come from public threat reporting and say so in the report. Identification only sets expectations anyway, because the recovery does not depend on it: a wrong or unknown family guess never changes what comes back.
Whatever the number says, please do not pay
This matters more than the tool does. Paying is never a guarantee that your files come back, decryptors handed over by attackers are frequently slow and buggy, and every payment funds the group to go after the next organisation. There are also reporting obligations in Australia that sit alongside the decision, and they do not disappear because the incident was handled quietly.
A measured figure changes that conversation completely. "Everything is gone" leads one way. "Seventy-three per cent of our data, including the database, comes back for free" leads somewhere else entirely, and it is a much harder position to panic out of at two in the morning.
And yes, we still have a business
It would be dishonest to pretend there is no commercial logic here, so here it is plainly. The number stays free. Turning that number into a restore you can trust is a different job, and it is the one people call us for.
The hard part of a ransomware recovery is not extracting the data. It is proving the data is right. Carving tools happily report success and hand back files that look complete and are quietly wrong, and the only thing that catches it is reconciliation against a known point in time. Then there is working out how they got in, whether they are still in, and what you owe your customers by way of notification.
But the scan is the easy part, and we would rather everybody had it. Somewhere out there, this week or next, a business owner is going to be told that everything is gone. If a free tool means they get to keep the thing they spent their life building, that is reason enough to have written it.
