Ransomware Recovery: A Step-by-Step Guide

There’s a common assumption about ransomware that gets businesses into trouble: the idea that recovery means paying a ransom, or clicking “restore” and being back to normal by lunchtime. Both are wrong, and believing either can turn a bad day into a genuine crisis.

Real recovery is a controlled sequence. Rush it and you can wipe the evidence you’ll need, restore the malware along with your files, or hand the attackers a second bite. Done properly, it’s methodical, and most businesses with decent backups come through it. Here’s the playbook we work through, in the order that actually matters.

First, correct the panic

The instinct when screens lock up is to start deleting things, rebooting servers, or reaching for the ransom note’s payment link. Resist all three. Deleting files can destroy evidence and clean copies. Rebooting can trigger further encryption or lose useful data held in memory. And paying — before you even know what’s encrypted — is the least informed decision you can make.

Ransomware also isn’t only an encryption problem any more. Most modern attacks steal data before they lock it, then threaten to publish it. That changes recovery: even a perfect backup restore doesn’t undo the fact that data may have left the building. You need to treat it as a security incident, not just an IT outage.

Step 1 — Isolate, don’t destroy

Your first job is to stop the spread. Disconnect affected machines from the network — unplug the ethernet cable, switch off Wi-Fi — but leave them powered on unless a specialist tells you otherwise. Powering down can lose forensic data that helps identify how the attackers got in.

Isolate shared drives and servers too, and pause any backup jobs so a clean backup doesn’t get overwritten with encrypted files. If you use cloud storage that syncs automatically, disconnect the syncing devices before the encryption propagates to the cloud copy.

Step 2 — Assess the blast radius

Before you can fix anything, you need to know the shape of the problem. Which machines are hit? Which file shares? Is the ransom note naming a specific strain? Are backups intact and, crucially, disconnected from the infected network?

This is where you find out whether your backup and continuity setup earns its keep. A backup that was permanently connected to the network has very likely been encrypted too — which is exactly why off-site, offline or immutable backups matter so much. If you’re not sure what’s clean, don’t guess. Restoring from a compromised backup just restarts the whole nightmare.

Step 3 — Bring in help and preserve the evidence

This is the point to call in specialists, and to notify your cyber insurer if you have one — many policies require it before you take major steps, and some provide a response team. Keep the ransom note, take photographs of affected screens, and write down a rough timeline of what you noticed and when.

You may also have reporting duties. In the UK, ransomware should be reported to Action Fraud, and if personal data is involved, UK GDPR can require you to notify the ICO within 72 hours. Good cyber security support means having someone who knows these obligations rather than working them out mid-crisis.

Step 4 — Eradicate before you restore

Once you understand the attack, the infected systems need to be cleaned or, more often, rebuilt from scratch. Wiping and reimaging is usually safer than trying to scrub malware off a machine, because attackers frequently leave hidden ways back in. This is also the moment to force password resets across the business and revoke any sessions that could still be live.

Skipping this step is the classic mistake. Restore your files onto a machine that’s still compromised and you’ll be encrypted again within days. Thorough virus and malware removal comes before recovery, not after.

Step 5 — Restore in a sensible order

Now you rebuild. Start with the systems the business most depends on, and restore from your cleanest verified backup. Bring things back gradually, checking each system before it rejoins the wider network. If your backups are incomplete or partly encrypted, specialist data recovery can sometimes retrieve more than you’d expect — but it’s a fallback, never a plan.

Test as you go. Confirm data is intact, applications work, and nothing odd is phoning home before you declare a system safe.

Step 6 — Learn from it, honestly

When the dust settles, work out how they got in — a phished password, an unpatched server, a dormant account — and close that door properly. Nearly every attack exploits something preventable, and the businesses that recover best are the ones that treat the incident as a lesson rather than bad luck.

If you’re in the middle of this now

If you’re reading this because it’s happening right now, isolate the affected machines, leave them on, stop your backups, and get expert eyes on it before you touch anything else. If you’d rather not face it alone — during an incident or, better, before one ever happens — get in touch and we’ll help you work through it calmly, in the right order.