By Shaun Stockman, Senior Director of Business Development, Americas, Ontrack
We get this question a lot, usually from someone who just found a ransom note where their file server used to be. Can encrypted files be recovered? Yes, sometimes. Not always. It depends on what encrypted the data, what you still have from before the attack, and how fast the team moved once something looked wrong.
I spend a lot of my time on the data recovery side of this industry, working with insurance companies and incident response teams after the damage is already done. So I want to walk through what actually decides whether encrypted files come back, instead of the usual advice you find in a five-minute blog post.
Most ransomware today doesn't touch your hardware. It runs through your files and folders and encrypts them in place, usually fast, sometimes locking down tens of thousands of files in a matter of minutes. The attacker holds the only key or claims to. Without that key, or without a workaround, the data underneath is still there. It's just scrambled.
A drive that's encrypted isn't a drive that's damaged. The files, the folder structure, most of it is intact underneath the encryption layer. That's different from a drive with a burnt controller board or a corrupted file system, and it changes what recovery looks like.
It also matters what kind of encryption you're dealing with, because ransomware isn't the only source of it. A lot of the drives we see already had encryption running before the attack happened. BitLocker on a Windows laptop, a self-encrypting SSD with the key stored on the controller chip or full disk encryption on a Dell or Sophos-managed fleet. When ransomware lands on top of that, you're looking at two layers instead of one, and recovery must account for both. Credentials, recovery passwords, and keyword packages from the original encryption software often matter just as much as anything tied to the ransomware itself.
I wish I could say there's a reliable trick here, but there isn't one you can count on. What I can say is that it happens more than people expect. Law enforcement and security researchers have captured key databases from specific ransomware operations before, which let victims decrypt for free. Some ransomware code has bugs in it, plain and simple, and those bugs can leave an opening. And because attackers often care more about speed than thoroughness, they'll encrypt files quickly and unevenly, which sometimes leaves recoverable fragments or lets us walk back through storage snapshots to find clean copies underneath.
We've seen this play out on systems like NetApp storage, where the underlying file system keeps multiple consistency points over time. In one case, a customer's aggregate had been infected for two weeks before anyone noticed, and the team was still able to walk back through those points to merge unencrypted data and rebuild most of what was lost. Our team has written up a few of these ransomware recovery cases if you want to see how differently they can go.
None of this is guaranteed for any specific attack. I think that's the honest answer. Every ransomware variant behaves differently, and what worked for one client's SQL server might not apply to another company's NAS.
This is the question everyone wants answered, and I understand organizations want the fastest path the restoration and production, but my take is that paying should be the last option, not the first. According to Sophos's 2025 State of Ransomware report, about 49 percent of organizations that paid the ransom got their data back, and they paid an average of 85 percent of the original demand. Across all organizations that had data encrypted, 97 percent eventually recovered it through some combination of backups, decryption, and rebuilding, not payment alone.
Paying the ransom is not the safety net people assume it is. If a key does get purchased, it needs to be tested against a copy of the encrypted data first, never the live system, because a bad key can corrupt what's left just as easily as it can restore it. We've walked through this tradeoff in more detail in our piece on whether to pay the ransom, and the calculus is different for every organization depending on what's backed up.
In almost every recovery I've seen, backups and snapshots do more work than any decryption effort. The problem is that ransomware often targets backups directly now, deleting them or encrypting them too, or both, so the backup you're counting on might already be compromised by the time anyone checks.
That's why the fastest recoveries tend to belong to teams with offline or immutable backups, ones the ransomware physically couldn't reach. We put together some practical guidance on dealing with a ransomware attack that covers this in more depth, including what to check first before you assume the backup is gone too.
Don't touch the encrypted files or try DIY decryption tools you found online. That can make future recovery efforts more difficult or impossible, since a lot of free decryptors are built for one specific variant and will corrupt anything else. Isolate the affected systems from the network so the infection doesn't spread further. Check your most recent backups before you assume anything is lost, including offsite or air-gapped copies, and note down any recovery passwords or encryption keys tied to the original system, not just the ransomware. And bring in people who've done this before, whether that's your incident response team, your insurer, or a data recovery specialist, before anyone decides whether to pay.
Can law enforcement decrypt my files for me?
Sometimes. Agencies and security researchers have occasionally recovered master keys from specific ransomware operations and released free decryption tools. It's worth reporting the attack and checking against known decryptor databases, but it's not something to count on for every variant.
Is it illegal to pay a ransom?
In the US, paying isn't illegal in most cases, though it can carry legal risk if the attacker is on a sanctions list. I'd talk to legal counsel before making that call, not a blog post, mine included.
Does cyber insurance cover the cost of data recovery?
Often, yes, depending on the policy. Recovery expenses are one of the more common categories of ransomware-related claims, which is part of why insurers increasingly want to see backup and recovery planning before they'll write a policy.
Will quantum computing make ransomware recovery easier?
Eventually, maybe. Quantum computing could weaken some of today's encryption algorithms, but that's a future consideration, not something that helps with an attack happening right now.
Is your encrypted data gone for good? I've seen enough recoveries, and enough dead ends, to know the honest answer is “it depends,” and I'd rather tell you that than promise something I can't back up. What actually determines the outcome gets decided long before the attack, in how backups are built and tested. That part is worth fixing now, while you still can.