According to Cybersecurity Ventures predictions, a new business will fall victim to ransomware every 11 seconds in 2021.

When time is of the essence and next steps are uncertain, organisations should consult with the experienced professionals at Ontrack to determine their best course of action.


If your organisation might be affected by ransomware:

  • Contain the attack by disconnecting infected machines from the network. 
  • Contact us as early as possible. Our team will provide a free consultation and advise on options for data recovery and how to prevent further potential data loss. 
  • Avoid do-it-yourself attempts to decrypt the affected data. Doing so could make future recovery attempts impossible.

Data recovery experts are ready to help.

Ontrack has developed a specialised collection of proprietary tools to recover data from ransomware-encrypted systems, virtual machines, backup files, tapes and other storage media. With labs located around the world, help is available 24/7 from our knowledgeable team with vast experience in all types of data loss situations.



  • 130+ Decrypters
  • Specialised collection of proprietary tools developed to recover data encrypted by ransomware


File Recovery

  • Virtual Disk Repair
  • Database Repair
  • Backup File Repair


Volume Recovery

  • All type supported (SAN, NAS, Server)
  • Deleted File Recovery
  • Copy On Write File Systems (NetApp WAFL, ZFS, etc.)


Backup Recovery

  • Full Tape Support (LTO, DLT, etc.)
  • Veeam Specific Tools (deleted and encrypted files)
  • All Backup Formats (Commvault, TSM, Networker, etc.)

Recovery Process Overview

Though each ransomware incident is unique and varies in complexity, data recovery is possible. Success depends on the type of payload that has been executed, the hardware it has affected, and the initial actions taken upon discovery.



Immediate phone consultation with data recovery specialists.



Media is evaluated to determine what files can be recovered.



Recovery carried out by our expert data recovery engineers.



Data is recovered remotely or returned on encrypted media.

Why Choose Ontrack?

Ontrack is the only solution provider with custom tools and development capabilities to support all types of data loss scenarios. We offer free ransomware consultations with our experienced engineering team​.


Global Locations


Recovery Labs


Data Centers

Top Ransomware Threats to Your Organisation in 2021

  • Maze
  • REvil
  • Tycoon
  • TrickBot
  • Qakbot trojan
  • PonyFinal
  • Mailto (aka Netwalker Ransomware)
  • Ragnar Locker
  • Zeppelin
  • TFlower
  • MegaCortex
  • ProLock
  • DoppelPaymer
  • Thanos
If you find yourself under attack from ransomware, contact the experts at Ontrack to help you gain access to your data.

Ransomware Case Studies

Ontrack delivers world-class data recovery for all types of storage including: hard drives, solid-state drives (SSD), servers, NAS, SAN, virtual machines, cloud, mobile devices and tape.

CryptoLocker Ransomware

A single user’s laptop at a large pharmaceutical company was infected with CryptoLocker ransomware. The laptop was connected to the corporate network, which allowed the malware to infect 46 shares. Leveraging NetApp’s proprietary OS (OnTap) and file system (WAFL), Ontrack engineers used multiple consistency points to “walk back” in time to a point before the attack to find and recover unencrypted copies of the critical data to return to the client.

Erased Backups

Ransomware attacked a company server, encrypted the Microsoft Dynamics 365 data, and demanded payment. Recent backups of the server were stored on multiple LTO-6 backup tapes, which had been erased by the malware. Working in conjunction with the R&D department, Ontrack developed a custom hardware and software-based solution to recover 46TB of data from 18 of the LTO-6 erased backup tapes.

Healthcare Ransomware Attack - Veeam Agent for Windows

A health care customer was affected by a ransomware attack that not only targeted their server data, but also “Veeam Agent for Windows” backups located on an external HDD. Their IT / managed services provider agreement did not include regular off-site backups, so this was the only copy of the data that existed.

Phishing Attack

A multinational chemical corporation experienced a ransomware attack that took over a server using administrator privileges obtained through phishing. The ransomware formatted all the hard drives and created a new aggregate. Ontrack was able to rebuild the RAID and the original volumes, and restore the client's data.

Current Ransomware Trends


The number of attacks is down, but the severity, size and payments for each attack are up​.


Only 50% of the victims that pay the ransom are able to decrypt all of their critical files.


Attacks are targeting file shares, critical infrastructure and backups including cloud​.


Cyber Insurance is paying a significant number of claims including data recovery​.

Join over a half million people and businesses who have trusted Ontrack to recover their data.


Visit the Ransomware Recovery Knowledge Base for all Ontrack resources related to ransomware data recovery.

View frequently asked questions, expert insights, case studies, blogs and more!

Visit the Ransomware Recovery Knowledge Base

Ransomware Webinar

This webinar, co-hosted with NetApp, details how to mitigate the risk of a ransomware attack, why and when to involve a data recovery company, and how Ontrack can help.

This 45-minute webinar covers:

  • The history and evolution of ransomware
  • The scale of the current ransomware threat - including the results of a recent Ontrack investigation
  • Success stories of data recovery following a ransomware attack
  • Find out how NetApp can help prevent ransomware attacks
  • How to recover data from point of infection from a snapshot
  • Scenarios that lead to successful recovery
  • Levels of effort and difficulty depending on the ransomware

Ransomware Experts

Ransomware FAQ's

Can Ontrack recover from a server infected with ransomware?

Our virtual machine is infected with ransomware. Can Ontrack help?

What is ransomware?

What does ransomware mean?

How does ransomware work?

Who is Ransomware for?

Who's behind the Ransomware cash claim?

How are ransomware attacks performed?

How much does ransomware cost an organization?

How does ransomware spread, and do you get infected by ransomware?

We'll collect your device and perform an evaluation, free of charge.

Data recovery for single drives and smartphones starts from £478.80 (inclusive of VAT). The final price will be determined at the end of the evaluation, according to the complexity of the work involved and the urgency required.

To begin, start by clicking on the type of media from which you need data recovered. The evaluation time for single hard drives (HDD and SSD) is four hours*, and within 24 hours for RAID systems*. Other media, such as mobile phones do not require an evaluation to provide an accurate quotation.

*These are typical time frames and apply within normal business hours (Monday to Friday, 9am to 5pm). For an out of hours, emergency service, or for further assistance, please contact us on +44 (0)1372 741999.

Step 1

Device Type
Step 2

Data Loss Reason
Step 3

Details & Evaluation

What type of device do you need data recovery for?

What is the main reason for your data loss?

What data is most important to you? Additional comments?

* The free evaluation may not be possible. Please contact us or enter your details and we will contact you as soon as possible. In case of assistance please call: +44 (0)1372 741 999

1. Contact details

2. Shipping details

Would you like to start your FREE evaluation and arrange a FREE pick up?:
Complimentary shipping is not available in your country.
By submitting this form you acknowledge that:
  • The free evaluation will be completed by KLDiscovery Ontrack Ltd (trading as Ontrack), Nexus, 25 Farringdon Street, London EC4A 4AB.
  • If you choose not to go ahead with the recovery after the evaluation, and would like your device returned, we will ship back to you for £9.60 (inc. VAT) for UK mainland shipping (next day service). Other delivery costs may vary. If you choose to go ahead and we cannot recover your data, we will return your device free of charge. Alternatively, we can securely destroy your media.
  • You authorise Ontrack to begin the evaluation immediately. During the free evaluation, you can cancel at any time. If you are a consumer and place an order, you have a period of 14 days in which to cancel the Order but you acknowledge that your right to cancel will be lost if Ontrack completes the evaluation before your notice to cancel is received. Full details for cancellation and your rights are set out in our Terms and Conditions. In order to cancel, please email or call Ontrack using the contact details provided or use the model cancellation form on our website.

For information on how we collect, process and retain your personal data, please see our Privacy Policy.