A hospital lost every backup of its genetics and patient-exam database to ransomware: the ZIP files were gone, replaced by .cripto copies. We recovered them. Not by breaking the encryption, but by understanding the disk. The ransomware made a quiet mistake: instead of encrypting in place, it wrote encrypted copies elsewhere and deleted the originals, leaving them intact in “free” space. Using a forensic image, the signature and structure of older backups, and carving with CRC and hash validation, we rebuilt the archives with evidentiary value. This session walks through the case step by step, explains how files actually live on sectors, and is honest about when this works and when it doesn’t (SSD/TRIM, in-place encryption, wiped free space). It closes with the decisions in the first hours of an incident that determine what can still be recovered.