A recovery file is a note left by an attacker during a ransomware or extortion event. It usually contains contact instructions, payment demands, or a message telling the victim how to “recover” access to files or systems. In practice, it is often the attacker’s ransom note, placed on desktops, shared folders, or encrypted directories so it is easy to notice.
Recovery files matter because they are an early sign of extortion activity and can help defenders identify which systems were touched. Security teams preserve these files as evidence, since the wording, filenames, and embedded contact details may support attribution, threat analysis, and incident response. They also help determine whether an intrusion is real, what the attacker is asking for, and whether the same campaign has hit other organizations. A recovery file is not proof of full compromise on its own, but it is a strong indicator that response and verification should begin immediately.