When a ransomware attack hit one of our clients, it went straight for the top — encrypting the Superintendent’s computer and every file share connected to it. Within moments, critical district data became unreadable. The attackers left a ransom note demanding roughly $25,000–$40,000 for the decryption key — a relatively small demand by today’s standards, but still a direct assault on the district’s operations and data integrity.

Instead of paying, we went to work. The organization had trusted Aeneas Technologies to implement a 3-2-1 backup strategy: Three copies of all data, stored on two different types of media, with one copy offsite.

Our environment included:

• Hot hardware backups running continuously on-premises
• A secondary backup system at a separate location
• Cloud-based backups in a secure, encrypted environment

Because of this multi-layered design, restoring the primary file server was straightforward. We were taking hourly snapshots of data, allowing us to restore operations with less than one hour of data loss. In fact, we achieved a Recovery Time Objective (RTO) of just 30 minutes — the time it took to get the critical file server back online.

However, several key staff members who had clicked the phishing email had their local computers fully encrypted. Despite policy prohibiting local storage, some had saved important documents directly to their machines — data now seemingly lost forever.

That’s when our team got creative.

The attackers had disabled Windows’ shadow copy restore feature to prevent recovery. But during our forensic review, we discovered a flaw in their approach: while they had deleted the global shadow copies, they failed to disable folder-level shadow copies.

That small oversight became our victory.

By manually accessing and restoring from these hidden folder-level snapshots, we recovered 100% of the locally stored files — without paying a dime to the hackers. Every single document, spreadsheet, and record was restored.

The final results:

• 100% of encrypted data recovered
• RTO (Recovery Time Objective): 30 minutes
• RPO (Recovery Point Objective): <1 hour
• No ransom paid

Through a combination of preparedness, precision, and persistence, we outsmarted the ransomware creators and brought the district back to full strength — faster than anyone thought possible.

At Aeneas Technologies, we don’t just recover data — we design environments that win, even when the worst happens.

‍