What does data recovery cost?
Ransomware assessment is $49. If shadow copies or public keys are available, recovery is $349. Partial sector recovery (unencrypted blocks) is $799. Complex ransomware + hardware failure cases are $1,499. No-data-no-pay guarantee: if we recover nothing, you only pay the $49 assessment.
Should I pay the ransomware ransom?
IT Cares recommends consulting us before paying. In many cases, ransom payment does not guarantee successful decryption — especially with LockBit 3.0 and BlackCat. The decryptor key may not work, or the threat actor may not provide it at all. We explore all free options (NoMoreRansom.org, law enforcement decryptors, shadow copies) before any payment decision. Our $49 assessment is completed within 24 hours.
Can I recover ransomware encrypted files for free?
For some variants, yes. Dharma/CrySIS, older REvil, Hive, and some Phobos-based ransomware have free decryptors available at NoMoreRansom.org, Emsisoft’s decryptor library, or through Bitdefender’s tool repository. For LockBit 3.0, BlackCat/ALPHV, Conti, and newer 2025 variants, free decryptors are rarely available. Our $49 assessment checks all databases in your specific case.
Is it possible to recover data without paying the ransom?
Yes — in a meaningful percentage of cases: (1) Public decryptors are available for the specific variant. (2) Windows Volume Shadow Copies (VSS) were not deleted by the ransomware. (3) Cloud version history (OneDrive, Google Drive, iCloud) preserved previous versions. (4) Partial sector recovery extracts unencrypted data blocks. (5) An offline backup exists. The $49 assessment maps out all viable paths before any payment decision.
What ransomware variants do you handle?
We have hands-on experience with LockBit 2.0 and 3.0, BlackCat/ALPHV, Conti, Dharma/CrySIS, REvil/Sodinokibi, Hive, BlackMatter, Cl0p, Vice Society, Quantum, Royal/BlackSuit, Play, 8Base, Rhysida, Akira, INC Ransom, and Medusa. We stay current with 2025–2026 emerging variants through CCCS and international threat intelligence feeds.
Can ransomware encrypt NAS and RAID arrays?
Yes — modern ransomware, especially LockBit, Hive, and BlackCat, specifically target NAS shares over SMB/CIFS, network drives, and cloud-synced folders. Synology and QNAP devices are high-profile targets. We handle combined RAID + ransomware cases. See our
RAID recovery page for NAS-specific scenarios.
How to recover data from a ransomware-encrypted drive?
Step 1: Isolate the infected machine from the network immediately. Step 2: Do not pay the ransom yet. Step 3: Call IT Cares at 1 (888) 711-9428 for a same-day assessment. Step 4: We identify the variant, check public key databases, and assess shadow copies. Step 5: We recover via the best available method with your approval.
Where can I get ransomware help in Canada?
IT Cares handles ransomware recovery remotely for all Canadian provinces and in-person for Montreal and Greater Montreal. Remote assessment and recovery is available via secure connection. Call 1 (888) 711-9428 or email info@itcares.ca. We can start assessment the same day you contact us. Also report the attack to the
Canadian Centre for Cyber Security.
Do you help with ransomware prevention after recovery?
Yes — IT Cares offers post-incident cybersecurity hardening including: ransomware-resistant backup strategy (3-2-1 rule with offline copy), email gateway filtering, endpoint protection, network segmentation, and privilege access management. See our
cybersecurity services page. Prevention is far cheaper than recovery.
