ransomware recovery (5)