FAQ

It depends on the type of storage and how the reinstallation was performed.

On a HDD (mechanical hard drive): if the disk was formatted without "secure erasure" (simple deletion of partitions), the encrypted files are often still physically present on the magnetic platters. A laboratory extraction can allow us to recover the encrypted files, which our experts will then attempt to decrypt.

On an SSD: the situation is more complex. The SSD firmware may trigger a TRIM operation automatically after formatting, permanently erasing the data. On some models or if TRIM has been disabled, partial recovery is still possible.

In both cases, the faster you act after the reinstallation, the higher the chances of recovery.

#reinstallation #disk format #ransomware recovery #disk image