Getting systems running again and establishing what was taken are different problems, and only one of them has a deadline set by law.
Two problems, and most vendors only solve one
The immediate problem is your data. The second problem is that whatever let the attacker in is still there. Recovering files without closing the entry point buys you weeks, not safety, and re-infection through the same route is common enough to be predictable.
We work both. Decryption is attempted across an array of over a hundred tools matched to the strain, while an on-site assessment establishes how entry was achieved, what else was touched, and what has to change before you go back online. Where the matter becomes evidentiary, forensic capability is in-house.
Two problems, and most vendors only solve one
Ransomware presents as an availability problem — systems are encrypted, the business has stopped. That is the visible half, and it is the half most recovery vendors address: rebuild, restore, resume.
The other half is what was taken. Nearly every serious ransomware operation now exfiltrates data before encrypting it, precisely because a company with good backups will not pay for a decryptor but may pay to prevent publication. That half is not a restore problem. It determines your legal position: what personal information was accessed, whose, from where, and therefore which notification statutes and regulators apply.
You cannot answer that from the attacker’s claims — they lie in both directions, inflating what they took and omitting what they missed. It is answered by forensics: staging directories, archive creation, outbound transfer volumes, the tooling left behind, and the access paths used. An organisation that restores and moves on without that analysis has an unquantified legal exposure sitting on its balance sheet, and it will surface later.
What Honeybadger Solutions provides
Honeybadger Solutions is an Arizona-licensed security guard and private investigations agency — Guard 1759798, PI 1759795 — with investigations, digital forensics and cyber work delivered nationwide. This article is background on the problem. For what we actually provide, see Ransomware Recovery, or book a confidential consultation.