RECOVER FROM RANSOMWARE
Have you been targeted by ransomware? Most forms target your data rather than locking you out of your PC. Typically, you’ll need to use a rescue disc or boot into Safe mode with networking to remove the underlying infection before you can look at recovering your files.
If the files have just been encrypted, you should be able to restore them from a recent backup. If your files are stored in OneDrive and you have a Microsoft 365 subscription, you should receive a warning that files have been changed or deleted and given the chance to roll back to earlier, pre-infection versions.
If the feature doesn’t appear automatically, click the OneDrive settings button and choose Options, then select ‘Restore your OneDrive’. After verifying your identity, you’ll be able to quickly roll back a set amount of time from the drop-down menu or choose ‘Custom date and time’ to review changes on a timeline and pinpoint the best moment to roll back to.
If you’ve no backup, or you’re looking for a quicker fix, you’ll need to see if there’s a decryption tool for the specific ransomware infection. Your security tool has hopefully identified the ransomware type, so visit www.nomoreransom.org/ en/decryption-tools.html for a comprehensive list of types, tools from reputable antivirus vendors, and a guide to using them.
Take care that you have the right tool or you risk scrambling the files beyond any attempt at recovery. Some vendors such as Trend Micro’s Ransomware File Decryptor tool combine all its known ransomware decryption tools inside a single program. Although you’re asked to select the ransomware type, there’s a handy ‘I don’t know the ransomware name’ link. Click this and you’ll be prompted to select one of your infected files. The app analyzes it to reveal what ransomware is behind it and help you restore your files.