top of page
Network Cable Technician

Our Step By Step Process

Create a new Case


The purpose of the evaluation is to determine the complexity of infection and the cost associated with the recovery. Every infection is unique and we can only determine the cost of recovery after a proper evaluation.

We have 100% success rate with most ransomware infections like BIP, COMBO, JAVA, Arrow, Cryptolocker, DMA, XTBL, Kyra, Locky, Thor, CrytpoMIX, Microsoft Crypto, Aleta, Arena, Nuclear, NM4, Gryphon, BTC, and Zepto & many more



Depending on the evaluation you have selected we will begin analyzing your files to determine the cost associated with recovery.

If you have selected priority evaluation, you will receive an invoice from our accounts department and upon receipt of payment we will begin the evaluation.

A proper tax invoice will be issued clearly mentioning no data no charge policy.



Upon completion of the evaluation, a quote will be sent to you. 80% of most jobs are between $750 – $4000 and cost can only be determined after we run the evaluation on your files.

We provide three levels of service.

Standard Recovery Service (6-10 days)

Priority Recovery Service (1-5 days) on average

Emergency Recovery Service (24 Hours) DHARMA ONLY

Most of our jobs are recovered within 1-2 days but we do allow up to 5 days

All jobs are started immediately after quote acceptance.

Notify us immediately and confirm the files you have sent as we will provide a quote/recovery based on the ransom attached

Acceptance of Quote


Once you accept the quote, an invoice will be sent to you to commence recovery.

Upon receiving remittance advice, your job will start immediately.

Initial Recovery Process


We will work on the original sample files submitted as part of the ticket until we reverse-engineer the decryption key.

Once the key has been identified, we will contact you or update the ticket to start the recovery.

We will need remote access via team viewer (

Further instructions will be sent by email

Actual Recovery


Upon a successful remote connection to your infected computer,  we take a snapshot of your infected files before and after the recovery on an excel spreadsheet for your records.

We start the recovery process and check random files to ensure they are opening successfully and confirm successful recovery.

Your ticket will be updated to notify you of completion.

Note1: We highly recommend a complete backup of your files to an external drive (and have it disconnected from the infected system before we begin recovery)

Note2: Please ensure your network has been scanned and cleaned properly before any data recovery.

If you don’t have an IT technician, please let us know and we are happy to perform the service at an additional cost.

The advantage of our Ransomware Recovery?

At WeDecrypt, we pride ourselves in our knowledge and experience in the Ransomware Recovery and Ransomware Prevention services from cyber-attacks (aka Ransomware).

Trust the largest ransomware recovery service in the US with a growing list of international clients with your data recovery


A primary recommendation will be made to identify the risk of infection and discuss the appropriate solution to avoid further attacks.

website security
bottom of page