When Ransomware Encrypts Your Files and Deletes the Originals

Imagine opening a folder of client briefs, photos or tax records only to find contents replaced by strange file extensions and a ransom note demanding payment in cryptocurrency. When the same strain then deletes the originals, the usual recovery paths narrow considerably. Encryption alone leaves the original bytes reachable through forensic means; deletion strips that safety net away.

Australian households and small businesses file more than 94,000 cybercrime reports a year through ReportCyber, and ransomware sits near the top of the categories. Incidents affecting organisations in Sydney, Brisbane and regional Victoria have shown how quickly a single infection can cripple payroll and customer databases. What happens in the opening minutes often determines whether anything can be salvaged.

How Encryption-and-Deletion Strains Operate

Modern ransomware families rarely rely on encryption alone. After scrambling documents, images and source code, the malware runs commands such as vssadmin delete shadows /all and wbadmin delete catalog -quiet to wipe restore points and backup catalogues. Some payloads then overwrite the originals with random data before renaming them, leaving only the encrypted blob on the disk.

Strains like LockBit 3.0, BlackCat and Play have appeared in Australian cases reported to the ACSC. They typically arrive through insecure Remote Desktop Protocol ports, stolen VPN credentials or malicious attachments disguised as freight invoices. Once executed, they spread through mapped drives and shared folders before triggering encryption across every reachable volume.

First Steps in the Opening Minutes

Resist the urge to restart or click anything inside the ransom note. Rebooting may trigger secondary payloads registered through Run keys, and dismissing the note can wipe an embedded key used for later negotiation. Photograph the ransom screen and note the file extensions appended to your documents; those extensions help identify the family.

Shut the device down through the hardware button if the infection appears to be scanning network shares. List every other machine, NAS and cloud-synced folder that can see the infected host. Many Australian small businesses run Synology boxes alongside Dropbox-style sync clients, and any of those may already be touched.

Isolating the Machine From Everything Else

Ransomware that deletes originals spends time searching for adjacent systems before encrypting anything. Pull the Ethernet cable, disable Wi-Fi through the hardware switch and turn off Bluetooth to limit spread to printers, shared folders on an Adelaide or Perth office server, and Always-On VPN tunnels used by remote staff.

For organisations running Active Directory, isolating the host from the domain matters more than saving shared resources. A compromised workstation can pivot to the domain controller and encrypt the same data again. Until forensics confirms scope, treat every machine that recently authenticated against the infected host as suspicious.

Hunting for Decryptors and Untouched Backups

The No More Ransom project hosts free decryptors for dozens of older families, and an older tool sometimes handles early variants of newer strains. Always check before considering any payment. Australian users often overlook backups on removable drives rotated weekly and stored in a drawer; those are usually untouched if the malware only encrypted volumes visible to the operating system.

Cloud backups with version history, such as Dropbox Rewind, OneDrive version restore or Backblaze snapshots, can recover files created before the encryption timestamp if the account credentials were not also stolen. Audit billing portals for forgotten backup subscriptions. Local IT firms in Melbourne and Sydney frequently keep offsite image-based backups precisely for scenarios like this.

Removing the Malware Before Any Recovery

Once backups are confirmed safe, scrub the infection from the system. Booting into Safe Mode with Networking limits the drivers and services the malware can load, making signature and behavioural scans far more effective. A walk-through of the procedure is available in the guide on how to use safe mode with networking to download removal tools and is worth following before introducing new utilities.

After a clean boot, run a full scan with a reputable on-demand scanner, then a second pass with a different engine. Browser hijackers and persistence mechanisms often ride alongside ransomware installers, so a structured pass at removing browser adware helps confirm the attackers have not left a foothold for a later intrusion.

Bringing the Files Back, Carefully

File recovery software works best on drives touched during the deletion phase rather than the encryption phase. Tools such as R-Studio, Recuva and DMDE can carve original copies out of unallocated clusters when the malware overwrote the file with a freshly encrypted blob. Acting quickly matters; every minute the drive stays powered on risks new writes to sectors you want to recover.

For irreplaceable material, a clean-room data recovery service is a realistic option locally. Providers based in Sydney and Brisbane handle ransomware cases routinely and image SSDs and HDDs with hardware write blockers. Their quotes run from a few hundred dollars for a single drive to several thousand for RAID arrays, and they often recover data consumer software cannot.

Hardening Defences Against the Next Wave

Routine patching of Windows, macOS and any VPN appliance in the office closes the bulk of entry points flagged in ACSC alerts. Application allow-listing through Microsoft Defender Application Control prevents unknown binaries from executing and catches most encryption tools even when delivery succeeds.

Three other habits make a measurable difference in Australian settings: rotate at least one backup copy to a location never connected to a network, enforce multi-factor authentication on every account with mailbox or VPN access, and rehearse a full restore at least once a year. The deeper references compiled at Pc Malware Expert cover each of those themes in more detail.

Practical Steps for an Australian Victim

• Photograph the ransom screen, list affected file extensions and note the time of discovery before doing anything else.
• Disconnect the host from Wi-Fi, Ethernet and any VPN, and isolate it from Active Directory where applicable.
• Check No More Ransom for a free decryptor before considering any payment, and audit every local and cloud backup you can recall.
• Boot into Safe Mode with Networking and run two independent scanners to confirm the threat has been removed.
• Report the incident through ReportCyber at cyber.gov.au and notify clients whose data may have been exposed.
• Engage a local data recovery provider if the deleted originals hold information that cannot be recreated from elsewhere.