ransomware recovery (1)