Ransomware:
the first few hours

A disk failing through hardware usually gives mechanical warnings: knocking, clicking, the BIOS not detecting it, or the system freezing on boot. Ransomware, by contrast, leaves the disk working normally: the computer boots, the file explorer sees the folders, but every file has an extra extension and won't open with its usual program. There's almost always a ransom note, a text file or a new wallpaper asking you to make contact or pay. Another strong clue is several computers on the same network showing the same problem at once: a disk failure is an isolated event on one machine, whereas ransomware spreads and hits several workstations almost simultaneously. If you're in any doubt about which it is, act as if it were ransomware: disconnect that computer and any other that shares a network or drives with it before looking any closer.

It depends on where you are in the process. If the machine is still encrypting at that moment, disconnecting the network and leaving it on stops contact with the attacker without losing what's in memory, which sometimes holds traces of the encryption key that a forensic tool can use. Switching it off abruptly wipes that memory and can leave the encryption half-finished, which complicates any later recovery attempt. If the process has already finished and the machine is idle, switching it off changes nothing and stops someone from using it by mistake. The priority is always the network, not the power button: unplug the cable and Wi-Fi first, decide afterwards whether to switch off, and only do so once it no longer shares drives or a connection with the rest of the office. If someone is going to analyse the machine, ask them before touching the switch.

There's no guarantee the key will arrive, that it will work on every file, or that the attacker won't come back for more once they know you pay. On top of the encryption, many current attacks copy data before encrypting it, so paying for the key doesn't erase that copy or stop it being used or published later: two different problems on the same bill. The real decision isn't “pay or don't pay”, it's what alternatives exist: if there's a backup outside the machine and it can be restored, the ransom no longer makes economic sense. If there's no backup, the question becomes whether the disk can be recovered another way, which depends on the type of failure and how much has been written over it since the encryption. Paying answers neither of those questions; it just adds a third.

Formatting can't be undone, and it wipes exactly the information that would let you understand what happened and, in some cases, recover something. What decides whether formatting is reasonable is whether there's a verified backup, stored outside the machine, that the ransomware couldn't reach at the time of the attack. If that backup exists and you can restore a test file without trouble, the infected machine can be formatted with peace of mind because the data is already safe elsewhere. If there's no backup, or you're not sure it's good, the disk isn't touched: it's treated as a recovery case, not as something to clean. In that case formatting closes the only route left. Checking whether the backup works is the first thing to do, before deciding anything about the disk.

Disconnect it from the network and don't switch it on “to see if anything survived”: if it was mapped as a drive on the infected computer, the ransomware has probably gone through it just like the other disks. What changes the outcome is how it was configured before the attack. A NAS with versioned backups or snapshots that the ransomware couldn't delete, because it had no permission to modify them, keeps versions from before the infection, even if the current files are encrypted. A NAS used as just another shared folder, with no versions or write protection, gets encrypted like a local disk and offers nothing extra to recover. Before touching it, you need to review the NAS's own snapshot or versioning settings without restoring anything yet. It's the same principle that separates a real backup from a mere duplicate folder: the difference is whether the ransomware could write to it.

Yes, especially if there's customer, supplier or employee data on the affected machines. Filing a report doesn't unlock anything or speed up recovery, but it leaves an official record of the incident, which may be needed later with insurers, customers or organisations asking what happened. If the attack affects personal data, you need to assess whether you should notify the data protection authority and, in some cases, the people affected; that assessment depends on the type of data and the real risk to those people, and isn't automatic in every case. Keep screenshots of the ransom note, the approximate time it was detected and which machines were connected to each other: that's the information both the police and any legal or data protection adviser you consult later will ask for. The sooner it's gathered, the more reliable it is.

Only if that machine was genuinely isolated from the infected one before the encryption began: no shared network drives, not mounting the same NAS, and preferably on a separate network segment. If it shares the same router or switch without any segmentation, “carrying on working” on it means exposing it to the same route the ransomware has already taken through the network, just a few hours later. Before using it, check which drives it has mapped and disconnect them even if they look fine. The question that decides whether it's safe isn't whether that PC shows symptoms, it's whether it had any way into the same resource the infected machine had. If the answer is that you don't know for sure, treat it as at risk: disconnect it from the network until someone has reviewed the whole infrastructure, not just the machine that showed symptoms.

There's no single answer, and it depends on two things decided before the incident. The first is whether there's a verified, accessible backup: if there is, the work consists of rebuilding the machine from scratch and restoring onto it, a process that depends on the volume of data and the number of machines affected. The second is if there's no backup, in which case the disk goes into a recovery process whose scope depends on the type of encryption, whether anything has been written over it since the attack, and whether tools exist that can reverse that particular ransomware family, which isn't always the case. What really makes the difference between getting back quickly and being stuck for a long time is decided before anything happens: having a backup outside the machine that the ransomware couldn't touch. That's the only thing within your control today.