Ransomware keynote: recovering data without paying the ransom
Drawing on real forensic cases, Thiago shows how organizations hit by ransomware can rescue their data through forensic recovery — turning a crisis into a controlled response, without funding criminals.
How a ransomware attack really unfolds
Modern ransomware groups rarely break in and encrypt on the same day. They enter through stolen credentials or unpatched systems, move quietly, steal data and only then lock files — so they can pressure victims twice: to decrypt and to stay silent.
Understanding this timeline changes how leaders prepare, what they monitor and which decisions must be ready before an incident.
Forensic data recovery without paying
Paying does not guarantee data back and funds the next attack. Drawing on real forensic work, Thiago Vieira shows the routes organisations use to recover information: overlooked backups and snapshots, flaws in how some ransomware encrypts, residual copies on disk, and careful reconstruction of critical systems.
The goal is not a magic tool, but a calm, evidence-based response that turns panic into a controlled recovery.
Legal duties and crisis leadership
The first hours decide much of the outcome. As a lawyer in Brazil and Portugal, Thiago covers evidence preservation, notification duties to authorities and data subjects, communication with insurers and clients, and why the decision to pay or not is a legal and ethical question as much as a technical one.
What the audience will learn
- Anatomy of an attack — How modern ransomware groups get in, encrypt, and pressure victims to pay.
- Forensic data recovery — Real techniques used to recover encrypted or deleted data without paying.
- Legal & crisis response — Evidence preservation, reporting duties and decisions for the first hours.
CISOs, IT and crisis teams, boards, insurers and industry conferences.
FAQ
Is it possible to recover data without paying the ransom?
Often, yes — but not always. The keynote explains the conditions that make recovery possible and why preparation before an attack matters most.
Who should attend?
CISOs, IT and crisis teams, boards, insurers and industry conferences. The content works for both technical and executive audiences.
In which languages is it available?
English and Portuguese, in person or online, typically 30 to 60 minutes.
Thiago Vieira is a court-appointed digital forensic expert (Tribunal da Relação do Porto, TJMG, TJSC) with 60+ judicial cases on deepfakes and forensic source code analysis, a licensed attorney in Brazil and Portugal, TEDx speaker, co-founder of Incubou, angel investor in 18+ startups and global advisor to cybersecurity companies through CyberTech Acceleration.
- Forensic Challenges in Real-World Cases of Digital Manipulation — Based on 60+ judicial cases as a court-appointed forensic expert (TRP, TJMG, TJSC), Thiago reveals how deepfakes, tampered evidence and manipulated source code are investigated — and what it means for companies, courts and society.
- How to Create Digital Immunity Against Scams — The cyber pandemic is here. Thiago shows practical ways for people and organizations to build digital immunity against scams, fraud, deepfake calls and social engineering.
- Ransomware Rescue: Recovering Data Without Paying the Ransom — Drawing on real forensic cases, Thiago shows how organizations hit by ransomware can rescue their data through forensic recovery — turning a crisis into a controlled response, without funding criminals.