Challenges
Recovering from data loss or ransomware
A deleted folder, a failed server or files encrypted by ransomware. Recovery depends on what was backed up before it happened and whether a restore was ever tested; the first hour decides the rest.
The challenge
A shared folder has gone, a server will not start, or files have been encrypted by ransomware. You need to know what can be brought back, from where, and which systems the business needs first. Most businesses find out what was not backed up only when they need to restore it.
If it is left
With a plain failure, every hour of guessing is an hour of people not working and an hour closer to the backup being overwritten by a newer, emptier one. With ransomware, the attacker is still inside: a machine left on the network encrypts the next share, a backup on the same network gets encrypted with the server it protects, and a hasty rebuild from an infected image brings the problem back a week later. Paying rarely ends it, which is why the NCSC advises against it.
What good looks like
The affected devices isolated and cleaned, the files, mailboxes or systems the business needs first restored from backups taken before the loss, a plain account of what was reached for your insurer and, if personal data was involved, the ICO, and then every system backed up to agreed recovery objectives with restores tested, so the next loss can be restored from a backup that is known to work.
What to do first
Before you call anyone
Stop the spread, keep the evidence
Unplug the network cable or Wi-Fi on anything behaving oddly. Leave the machines switched on: the evidence of how it got in is in memory, and you will want it.
Do not restore over the top, and do not pay
Restoring onto an infected machine, or onto the only copy of the data, destroys options. The NCSC advises against paying a ransom: it does not guarantee the files and it marks you as a business that pays.
Find out what backups exist and from when
The office backup, the cloud backup, the Microsoft 365 backup if there is one, the vendor's backup of the accounts system. Note the date of the last good copy of each. That date is the recovery point you have.
Decide what the business needs first
The order matters: the order line before the archive, the accounts server before the shared drive of photos. Write the list; it sets the restore order.
Check your reporting duties
If personal data may have been accessed or lost, the ICO must be told within 72 hours of you becoming aware. Your cyber insurer usually has to be told before recovery work starts. Ransomware is also a crime to report to Action Fraud.
What we would do first
-
Call us
A human answers within three rings. Tell us what has been lost or encrypted, which systems are affected and when they were last working.
-
Find what can be restored
What data you hold, where it lives and which backups exist for it, across office servers, laptops, cloud systems and Microsoft 365.
-
Restore what matters most first
Once affected devices are isolated and cleaned, files, mailboxes or whole systems are recovered from backup in the order your business needs them.
-
Be ready for next time
Every system backed up and monitored by our team, recovery objectives agreed for each one, and restores tested so we know they work.
How we approach it
-
Contain and assess
Affected devices isolated, and for ransomware the Microsoft 365 accounts checked and secured too. Then the inventory: what data you hold, where it lives, which backups exist for it and the date of the last good copy.
-
Clean before you restore
Infected machines cleaned or rebuilt with Microsoft Defender and Huntress detection and response in place before any data goes back on them, so the restore is not re-encrypted a day later.
-
Restore in business order
Files, mailboxes or whole systems recovered from backups taken before the loss, in the order you set: the systems the business cannot trade without first, the archive last. Each restore is checked before people are let back in.
-
Report
A plain written account of what was lost, what was reached and what was done, in the form your insurer and the ICO ask for.
-
Make it recoverable next time
Backup of servers, laptops, Azure and Microsoft 365 with a copy off site, recovery objectives agreed per system, restores tested on a schedule, and endpoint and identity protection watching for the next attempt.
The services that apply
-
Backup and recovery
The restore itself, and then the thing that was missing: backups of servers, laptops, Azure and Microsoft 365 with recovery objectives agreed per system and restores tested.
-
Disaster recovery planning
The plan for next time: which systems come back first, how fast and from where, written down and tested every year, so the time to recover is a number you have seen.
-
Odyssey private cloud
If the failed server is the cupboard server, its replacement often belongs on hardware we own in UK data centres, where backup is built in as standard.
-
Endpoint and identity protection
Ransomware recovery is pointless while the attacker is still inside; Huntress isolates the device and the identity monitoring shows which accounts were used.
-
Cloud infrastructure support
A server in Azure or our private cloud that nobody was monitoring is how a failure goes unnoticed; this is the monitoring and patching afterwards.
-
Complete Managed IT
For a business with no IT team, the recovery usually becomes the start of managed IT, so the backups are watched and the devices patched from then on.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
01
Consumed
Ad hoc work, no commitment
Recovery does not wait for a proposal. Without a retainer, the work is charged for the time spent at the list rate for the grade and the time of day, approved as it unfolds; out of hours is charged at the consumed list rate for every client.
-
02
Fixed price
A defined piece of work or project
Making the estate recoverable, backups across every system with a tested restore, is a project priced as a fixed sum once the recovery is over.
-
03
Retainer
The way most of our clients work with us
For a client on a retainer, in-hours recovery is pre-authorised within the retained hours and the cap, and the backup monitoring and scheduled restore tests are part of the managed service afterwards.
Who you would work with
The service desk, first
A trained Odyssey employee answers within three rings, takes the list of what is lost and which systems matter, and starts containment.
A senior engineer
Leads the clean-up and the restore, in the order you set, and checks each system before people go back in.
The Head of Service Delivery
Owns the recovery from your side: what is back, what is next, and when you can trade again.
A director
Reachable at any time. A day without the accounts server is the moment to use that.
Further reading
-
Guide
Microsoft 365 is not a backup: what World Backup Day should remind you
Microsoft keeps the service running. Keeping your data is your job. What the recycle bins actually cover, and where they stop.
Read the guide →
Questions people ask
What should we do first?
Disconnect anything behaving oddly from the network but leave it switched on, do not restore over the top or pay a ransom, find out what backups exist and from when, and call us: a person answers within three rings.
Does Microsoft back up our Microsoft 365 data?
Microsoft keeps the service running, but protecting your data against deletion, corruption or ransomware is your responsibility under its shared responsibility model, and the recycle bins have limits. We back up Microsoft 365 email and files separately so they can be restored to a point in time.
Should we pay the ransom?
The NCSC advises against it: paying does not guarantee the files come back and marks you as a business that pays. Recovery from backups taken before the attack is the route, and an insurer will usually ask the same.
How quickly can you restore?
That depends on the recovery objectives agreed for each system and on the backups that actually exist. In an emergency we restore the systems the business cannot trade without first and tell you honestly what the last good copy of each one is.
We are not an Odyssey client and our backups were run by someone else. Can you help?
Yes. Call us and tell us what has happened and what backups you think exist. We assess what can be recovered from whatever backups there are, whoever ran them, and once a short consumed-time agreement is signed, usually the same day, the recovery starts.
Which systems can you back up afterwards?
On-site servers and computers, laptops wherever they are used, systems in our private cloud and in Azure, and Microsoft 365 email and files, all in encrypted, resilient storage with a copy off site.
How do we know our backups will work next time?
A restore is tested before handover and repeated on a schedule afterwards, and the result is reported to you. Until a backup has been restored from, nobody knows it works.
Do we have to tell anyone?
If personal data may have been accessed or lost, the ICO must be told within 72 hours of you becoming aware. Your cyber insurer usually has to be told before recovery starts, and ransomware is reported to Action Fraud. We give you the written account those reports need.
Happening now? Call 01642 661888 and a person answers within three rings
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.