The 30-second fix: Check for shadow copies
I've seen this dozens of times. Client calls, panic in their voice: "All my files are .crypt or .locked or some weird extension. There's a text file demanding $500 in Bitcoin." First thing you do — don't pay. Paying doesn't guarantee you'll get your files back. I had one client pay $300 and got nothing.
Right-click the folder where your encrypted files are (like Documents or Desktop). Go to Properties, click the Previous Versions tab. If you see any versions listed — double-click one. If the files open, copy them to a safe place (external drive or cloud). This works because Windows creates shadow copies automatically on some systems. It's not guaranteed, but it's free and takes 30 seconds.
If you see nothing there, skip to the next step.
The 5-minute fix: Run a decryption tool
Not all ransomware is unbreakable. Some strains have had their keys leaked or cracked. Head over to No More Ransom or Emsisoft Decryptor — both are free and legit. Upload one encrypted file to ID Ransomware's site. It'll tell you which ransomware hit you. Then download the matching decryption tool.
I had a client last month whose files got hit with the STOP/Djvu variant (files end in .djvu or .tro or similar). We ran the Emsisoft decryptor and got back about 80% of files. Not perfect, but better than paying $490.
Important: Run the decryption tool on a copy of the files, not the originals. Some tools can mess things up if they mismatch the key. Copy the encrypted folder to a USB stick first, then run the tool on that copy.
What if the decryption tool fails?
Then the ransomware is probably using a unique key per victim. That's the case with most modern strains like REvil or LockBit. In that situation, you've got two options: restore from backup or accept the loss.
The 15+ minute fix: Restore from backup or use file recovery
This is the real fix. If you have a backup — external drive, cloud backup like Backblaze or OneDrive, or a NAS — you restore from that. But most small businesses don't. I get it. So let's try file recovery.
Step 1: Disconnect from the network immediately
If you're reading this while still connected to Wi-Fi or Ethernet, unplug it. Ransomware can spread to other drives, network shares, cloud sync folders. Cut the connection now.
Step 2: Boot from a live USB
Grab a USB stick, download a Linux live distro like Ubuntu, boot from it. This lets you access your Windows files without the malware running. Copy everything you can to an external drive. Even encrypted files — you might need them later for decryption.
Step 3: Try Recuva or PhotoRec
Some ransomware doesn't actually encrypt everything. It might delete original files and leave encrypted copies. Recuva (free for Windows) can sometimes recover the originals if they weren't overwritten. PhotoRec is more powerful but command-line — works on any file type, not just photos.
Run Recuva on the drive where the encrypted files are. Deep scan. Look for files with dates before the attack. Copy them to a separate drive. I've recovered Word docs and Excel sheets this way — not perfect, files can be corrupted, but data is data.
Step 4: Restore from any backup
If you have a backup — even an old one — restore from that. Windows File History, OneDrive version history, any cloud backup (Backblaze, CrashPlan, Acronis). I had one client who had a 3-month-old backup. Lost three months of work, but got the business running in a day. Better than paying $2,000 to the bad guys.
What NOT to do
- Don't pay. There's no guarantee. Plus, it funds more attacks. In some cases, the criminals give you the key. In many, they don't.
- Don't run random tools from forums. People on Reddit might mean well, but fake decryption tools sometimes make things worse or install more malware.
- Don't reboot. Some ransomware encrypts during shutdown. Reboot can trigger it on other files.
When to call a pro
If the files are business-critical — say, QuickBooks database or patient records — and you don't have a backup, call a local IT company or a data recovery specialist. They can sometimes do hardware-level recovery. Expect to pay $500-$2,000, but that's still less than ransom and more reliable.
Prevention for next time
The only real fix is backups. Use the 3-2-1 rule: three copies of your data, on two different media, one offsite. Cloud backup (like Backblaze or iDrive) is cheap — $5/month for unlimited. Do it today, before you get another email with "URGENT" in the subject.
Also: keep Windows updated. Most ransomware exploits old vulnerabilities. And don't click on "Your package is waiting" emails. I can't tell you how many times I've seen that one.