ransomware recovery (4)