Ransomware recovery is the process of restoring a company's systems from clean backups after a ransomware attack, without letting the attack back in. Ransomware is software that encrypts a company's files, so that nobody can open them, and then demands money for the key. Recovery is the alternative to paying.
Restoring after an attack is harder than restoring after a broken disk. The attacker may have been inside the network for days or weeks before the files were locked. So the most recent backups may already contain the attacker's programs, or a hidden way back in. If the company restores those backups straight into its network, the attack can start again.
So recovery uses a clean room. A clean room is a separate, sealed-off set of servers with no connection to the company's normal network. The company restores its systems there first. Security tools scan the restored copies for the attacker's programs. Only copies that pass the scan are moved back into use.
Consider an IT services company in Kochi with 2,000 employees. At 2 a.m. on a Sunday, ransomware encrypts 300 of its servers, and a note demands payment in cryptocurrency. The company decides not to pay. The security team first cuts the infected servers off from the network, using its endpoint detection and response (EDR) tool. Indian rules from CERT-In, the national cyber-security agency, require the company to report the attack within six hours.
Next, investigators in digital forensics work out when the attacker first got in. The answer is 12 days earlier, through a stolen VPN password. So every backup from the last 12 days may be infected.
Then the order of the restore matters. The team restores the directory service first. This is the master list of users, computers and passwords, such as Active Directory. No other server can check a login without it. The team resets every password, because the attacker had copied them. Then it restores the other servers into the clean room, from a 13-day-old copy kept as an immutable backup. The scans find nothing. The servers return to use in a fixed order: email and the project systems that serve clients first, payroll and the rest after. Files changed in the last 12 days are brought back one by one from newer backups, after each file is scanned. Four days after the attack, 280 servers are running again. The other 20 are rebuilt from scratch.
Why not restore everything at once? Hundreds of restores at the same time would overload the backup system and the network, and nobody could check them. So companies write a recovery plan in advance, listing which systems come back first, and they test it. The whole process depends on a copy the attacker could not reach, which is why companies also keep an air-gapped backup. Ransomware recovery is part of backup and recovery.