Room4.05Floor 4 Security and backup
Business data recovery and ransomware recovery
When a server dies, files disappear or ransomware locks the office, we get you working again from the cleanest copy of your data, protect the evidence, and tell you plainly what can and cannot be recovered.
- Ransomware, deletion or a dead server
- Restored from the cleanest copy
- No guesswork on failing drives
- A technician on the 24/7 line
The first hour decides most data recovery jobs
Most data loss in an office can be undone. Files deleted from SharePoint sit in a recycle bin for weeks. A server that will not start usually has healthy drives inside it. Even ransomware is survivable when a clean copy of the data exists and nobody makes things worse before help arrives.
That early window is where recoveries are won or lost. A well-meaning person who restarts a failing server five times, runs a disk repair tool, or restores last night’s backup onto a network that is still infected can turn a recoverable problem into a permanent one. This is what we ask every client to do, and to avoid, while we are on our way.
Do this
- Disconnect any computer showing a ransom note or renamed files from the network. If files are still changing in front of you, shut it down. Otherwise leave it on.
- Write down what you saw and when: the first strange file name, the first error, who noticed it.
- Stop people saving to the affected drive, share or NAS.
- If you have cyber insurance, call the insurer’s claims line before hiring anyone.
- Call us and keep your phone close.
Avoid this
- Restarting a server whose drives are clicking or that keeps failing to boot.
- Running CHKDSK, disk repair or recovery software on a drive that is failing.
- Rebuilding or re-initializing a RAID array, or swapping drives between bays.
- Deleting ransom notes or encrypted files. They help identify what hit you.
- Contacting the attackers or paying anything before you have advice.
What was lost, and where it usually comes back from
The recovery path depends on where the data lived and how it was lost. These are the situations we see most often in offices of 5 to 250 people.
| What happened | Where it usually comes back from | What to expect |
|---|---|---|
| A file or folder deleted in SharePoint or OneDrive | The recycle bin, which keeps deleted items for 93 days | Usually back within minutes, with version history intact |
| A whole OneDrive overwritten, synced over or encrypted | OneDrive’s Restore feature, which rolls the library back to any point in the last 30 days | Full recovery if caught inside those 30 days |
| Email deleted and then emptied from Deleted Items | Recoverable Items in Exchange Online, kept 14 days by default and up to 30 | Recoverable inside the window. After it, only a separate Microsoft 365 backup helps |
| A folder deleted from a Windows file server | Shadow copies (Previous Versions) or the nightly backup | Usually same day, back to the last snapshot |
| A server that will not boot, drives still healthy | The drives themselves, attached to working hardware or a virtual machine | Often no data loss at all |
| A RAID array that is degraded or has failed | The array, provided nobody has rebuilt it in the wrong order, otherwise the backup | Good odds when it has been left untouched |
| A Synology or QNAP NAS that will not mount its volume | The volume read on a separate Linux machine, or the NAS’s own backup target | Often recoverable without a lab |
| Ransomware on the server and shared drives | An offline or immutable backup taken before the attacker got in | Days rather than hours, done in a strict order |
| A laptop drive that has failed or been physically damaged | A specialist clean-room lab, or OneDrive if the files were synced | Lab results vary. Synced files are safe |
Ransomware recovery, in the order that matters
Restoring files is the last step of a ransomware recovery, not the first. An attacker who has encrypted your server has usually been inside the network for days or weeks, holding stolen passwords and often a way back in. Restore too early and you give them a fresh copy of everything.
We work through every recovery in a fixed order and keep a written timeline as we go, because your insurer, your lawyer and possibly the Privacy Commissioner will ask for it later.
Contain the damage
Infected machines are isolated, remote access is switched off and internet access is cut back to what the recovery needs. Firewall logs and Microsoft 365 sign-in logs are saved before they roll over and disappear.
Bring in the insurer
Most cyber policies require you to use their breach coach and an approved forensic firm. We work alongside that team and do the hands-on rebuild, so you do not pay twice or put your cover at risk.
Find the clean point
Logs and file timestamps show when the attacker first got in. The restore has to come from before that date, which is why 30 days of backups is often not enough.
Rebuild identity before data
Every password is changed, including service accounts and the domain’s krbtgt account, which is reset twice. MFA is re-registered, stale remote access accounts are removed and administrator rights are cut back to the minimum.
Restore in business order
Systems return in the order your business needs them, agreed with you. Usually that means sign-in first, then email, then the line-of-business application, then files. Each one is scanned before it rejoins the network.
Watch closely afterwards
Endpoint detection stays on high alert for weeks. Attackers often try their stolen credentials again once the office is back on its feet.
Why backups fail on the day you need them
When a recovery goes badly, it is rarely because the office had no backup. It is because the backup had a weakness nobody had found yet. These are the ones we meet most often.
| The weakness | What happens | The fix |
|---|---|---|
| The backup lives on the same network, reachable with the same passwords | Ransomware encrypts or deletes the backup along with the server | An immutable or offline copy that your domain accounts cannot delete |
| The job has been failing quietly for months | The newest good copy is from last spring | Failed-job alerts that a person reads and acts on every day |
| Retention is too short | Every copy still kept already contains the attacker | At least 90 days of restore points, plus monthly copies kept longer |
| File sync is treated as backup | OneDrive or Dropbox faithfully copies deletions and encrypted files to every device | A separate Microsoft 365 backup with its own retention |
| Nobody has ever tested a restore | The restore takes three days, or the database will not open | A timed test restore every quarter, written down |
| Only the files are backed up, not the server | The data is safe, but rebuilding the application takes a week | Image-level backups of any server that runs software |
If any of these sound familiar, our backup and disaster recovery service closes the gaps before they matter, and Acronis cloud backup keeps an off-site copy in immutable storage that ransomware on your network cannot delete.
When data loss becomes a privacy breach
Ransomware today usually means theft as well as encryption. Many groups copy files out before they lock them, then threaten to publish. That turns an IT outage into a possible privacy breach, with legal duties attached.
Under PIPEDA, the federal privacy law for private-sector organizations, a breach of security safeguards must be reported to the Office of the Privacy Commissioner of Canada when it is reasonable to believe it creates a real risk of significant harm to someone. The people affected must be told as well. Every breach also has to be recorded, and those records kept for 24 months, even when no report is required. Health information custodians in Ontario have separate duties under PHIPA, reported to Ontario’s Information and Privacy Commissioner.
We are not lawyers, and we do not decide whether a breach is reportable. What we provide is the factual record your lawyer or breach coach needs: which systems were touched, what data sat on them, whether logs show data leaving the network, and a timeline they can rely on.
Failed drives, and the honest limits of what we do
We recover data from drives that are healthy but unreadable: a laptop that will not start, a server with a dead motherboard, a NAS that has lost its configuration, a volume with a damaged file system. That covers most of what offices bring us.
A drive that clicks, grinds, is not detected at all, or has been dropped or flooded needs a clean-room lab.
Opening one anywhere else destroys what is left on it. We do not do that work ourselves and will not pretend to. We tell you plainly when a drive needs a lab, before anything is sent, help you choose one, and send the drive with a written note of its history.
Solid-state drives deserve their own warning. When a file is deleted on an SSD, a feature called TRIM clears the underlying storage within minutes, so deleted files on a modern laptop are rarely recoverable from the drive. That is why every company laptop we manage keeps its Desktop and Documents folders in OneDrive, where a deletion can be reversed.
One last myth: putting a hard drive in the freezer does not fix it. It adds condensation to a device that is already damaged.
Recovery work we take on
Emergencies start on the phone, straight away, day or night. Planned work, such as moving data off a NAS that is showing early signs of failure, is quoted as a fixed project. If you are not yet a client, our 24/7 emergency IT support page explains how a first call works.
- Ransomware containment and recoveryEmergency, 24/7
- Deleted Microsoft 365 files and mailboxes restoredFixed quote
- Failed server brought back on new hardwareFixed quote
- Data moved off a failing NAS or RAID arrayFixed quote
- Clean rebuild of Active Directory after a breachFixed quote
- Recovery test and backup weakness reviewFixed quote
Questions people ask
Should we pay the ransom?
That is a business and legal decision, made with your insurer and lawyer, not an IT one. Paying does not guarantee a working decryptor, does not stop stolen data being published, and marks you as a company that pays. The Canadian Centre for Cyber Security advises against it. We also check whether a free decryptor exists for the strain. In most of our recoveries the question never comes up, because a clean backup existed.
Can you recover files if we have no backup?
Sometimes. Deleted files may still be in a recycle bin, a shadow copy or OneDrive version history. A failed server or NAS can often be read directly. Files encrypted by modern ransomware cannot be decrypted without the attacker's key, unless the strain is one of the few with a free decryptor. We will tell you which situation you are in early, before you spend money on it.
How long does ransomware recovery take?
For an office of 20 to 50 people with good backups, core systems are usually back within a few working days to a week. Finding the clean restore point and rebuilding sign-in security take longer than restoring the files. Without usable backups, or when an insurer requires a full forensic investigation first, it can take several weeks.
Doesn't Microsoft back up our Microsoft 365 data?
Microsoft keeps the service running and holds deleted items for a limited time: 93 days in the SharePoint and OneDrive recycle bins, and 14 to 30 days for emptied email. It does not keep long-term copies you can restore from whenever you like. If a deletion goes unnoticed past those windows, or an attacker deletes data on purpose, only a separate Microsoft 365 backup brings it back.
Will you work with our cyber insurance provider?
Yes. Call your insurer's claims line first, because most policies require their own breach coach and approved forensic firm. We then work alongside that team, preserving logs, answering their questions about your systems and doing the hands-on rebuild. Hiring outside the policy's process can put your cover at risk.
Do we have to report a ransomware attack?
If personal information was involved and the breach creates a real risk of significant harm, PIPEDA requires a report to the Privacy Commissioner of Canada and notice to the people affected. Ontario health information custodians have separate duties under PHIPA. Your lawyer or breach coach decides whether a report is needed, and we supply the technical facts. Reporting to police and the Canadian Centre for Cyber Security is voluntary but worthwhile.
Can you get data off a laptop that will not start?
If the drive is healthy and the laptop simply will not boot, usually yes, as long as the BitLocker recovery key is available. For laptops we manage, that key is stored in Microsoft Entra ID. If the drive itself has failed, it needs a clean-room lab. Files synced to OneDrive are safe either way.
How do we stop this happening again?
Three things prevent most repeats: backups that ransomware cannot reach and that are test-restored, MFA on every account with old sign-in methods switched off, and endpoint protection that a person actually watches. After every recovery we write up what failed and what each fix would cost, in priority order, so a future incident is an inconvenience rather than a crisis.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.