Data Recovery Blog
Technical notes on data recovery, disaster recovery and IT resilience — written from cases and questions we actually see.
Looking for something longer? See the recovery and resilience guides.
Incidents & response
Most Active Ransomware Groups in 2026: The Current Ranking
The Gentlemen and Qilin lead 2026 by a wide margin. Here is the September 2026 ranking by victims posted on leak sites, the groups that hit India, and a recovery guide for each group.
Should You Pay the Ransom? What to Weigh
It is the first question every victim asks. The honest answer starts with finding out what you can recover without paying, because that changes the decision entirely.
Suspected Data Theft by an Employee? First Steps
The instinct is to check the laptop yourself. That single step can destroy the timestamps that would have proved what happened.
Why Ransomware Finds Your Backups First
Attackers know a working backup is the reason victims don't pay. Deleting it is not an afterthought in the attack, it is an early objective.
Multiple Systems Down at Once? Where to Start
When everything fails together, the instinct is to fix whatever is loudest. The order you recover in usually matters more than the speed of any single restore.
Ransomware and Partly Encrypted Database Files
Some ransomware encrypts only part of each large file to finish faster. For databases, that can mean the difference between a total loss and a partial recovery. It also means the first steps matter.
Ransomware families
Abyss Locker Ransomware Recovery: HelloKitty-Based ESXi Encryptor
Abyss Locker shuts down every VM on an ESXi host and encrypts its files. The encrypted virtual disks are where the recovery starts.
BlackNevas Ransomware Recovery: Trigona Variant Hitting Asia, NAS and ESXi
BlackNevas targets Asia-Pacific companies and encrypts everything from Windows servers to NAS boxes and ESXi hosts. Here is what is known and what can be recovered.
Global Group Ransomware Recovery: The BlackLock Rebrand With AI Negotiators
Global Group's negotiator may be a chatbot. The recovery question is the same as with any group: what state are your encrypted files in?
Space Bears Ransomware Recovery: The Phobos-Linked Leak Site
Space Bears looks like a corporate website but is a Phobos-affiliate leak site. Whether files were encrypted, and by which Phobos variant, decides the recovery.
RansomHouse Ransomware Recovery: MrAgent and the Mario ESXi Encryptor
RansomHouse built a tool to encrypt every hypervisor in a network at once. When all VMs go down together, the recovery work is in the encrypted virtual disks.
Money Message Ransomware Recovery: Windows Encryptor and an ESXi Variant That Deletes Disks
Money Message's ESXi variant deletes virtual disks rather than encrypting them. What you do in the first hours decides whether that data can still be found.
Beast Ransomware Recovery: The Monster RaaS for Windows, Linux and ESXi
Beast encrypts files in segments to work fast. Segmented encryption leaves parts of large files intact, which is what database and VM recovery works from.
Nitrogen Ransomware Recovery: ESXi Bug Means Paying Cannot Help
Because of a coding mistake, Nitrogen's ESXi encryptor uses a key nobody can decrypt, not even Nitrogen. Recovery from the data itself is the only route left.
Sarcoma Ransomware Recovery: Fast-Growing Group Targeting Manufacturers
Sarcoma went from unknown to 36 victims in a month and claimed 377 GB of SQL files from a PCB maker. Databases are often what it takes and what it locks.
Cloak Ransomware Recovery: ARCrypter Encryption and Bought Network Access
Cloak doesn't break in itself; it buys the way in. Once inside, it encrypts with an ARCrypter variant. Here is what is known and what can be recovered.
Termite Ransomware Recovery: The Babuk Rebrand Behind the Blue Yonder Attack
Termite is Babuk under a new name. It deletes the easy ways back, shadow copies and the recycle bin, but large databases and virtual disks are a different story.
3AM Ransomware Recovery: .threeamtime Files, Teams Vishing and What Survives
3AM gets in by phoning your staff as "IT support" and encrypts with a Rust tool that deletes shadow copies. Here is what is known and what can be recovered.
Makop Ransomware Recovery: .makop Files, RDP Attacks and Database Recovery
Files renamed to .[ID].[email].makop and a readme-warning.txt note: that is Makop. There is no public decryptor, but the data is often still recoverable.
Mallox Ransomware Recovery: The Ransomware That Breaks in Through MS SQL Server
Mallox goes straight for Microsoft SQL Server: the database is both the way in and the main target. Here is what can be recovered and how.
8Base Ransomware Recovery: A Phobos Variant With a Free Decryptor
Files ending in .8base were encrypted with a Phobos variant. A free decryptor exists; here is how to use it safely and what to do if it fails.
Phobos Ransomware Recovery: Free Decryptor, What It Covers, and What to Do When It Fails
Phobos is one of the most common ransomware families in small and mid-size businesses. Since July 2025 there is a free decryptor. Try it first, on a copy, and know what to do if it does not work.
Aurora Ransomware Recovery: New 2026 Group Targeting Manufacturers and VMware ESXi
Aurora is one of the newer ransomware groups of 2026, with manufacturers as its main target and VMware ESXi among the systems it encrypts. Here is what is known and what can be recovered.
Crypto24 Ransomware Recovery: Stealthy Attacks and EDR Bypass
Crypto24 hides in normal admin activity for days before encrypting. When it finally does, the databases, VMs and backups are what need recovering.
Embargo Ransomware Recovery: Rust Toolkit That Disables Security Tools
Embargo switches off antivirus and EDR before it encrypts. That explains how the attack succeeded; it doesn't decide whether your data is recoverable.
Gunra Ransomware Recovery: Conti Code, Windows and Linux
Gunra's Linux encryptor supports partial encryption, and partial encryption of large files is exactly what makes database and virtual-disk recovery possible.
Kairos Data Extortion: Stolen Data Without Encryption
Kairos often doesn't encrypt a single machine; it steals data and threatens to leak it. The work is finding out what was taken and making sure nothing else was damaged.
Nova Ransomware Recovery: The Rust Encryptor Formerly RALord
Nova deletes shadow copies so Windows can't roll back, but the encrypted databases, virtual disks and backups themselves are still worth examining before anyone writes them off.
Devman Ransomware Recovery: The DragonForce Spin-off
Devman can encrypt a whole file, only its header, or a custom pattern. When only the header or parts were hit, the data in databases, VMs and backups is usually still there.
KillSec Ransomware Recovery: After the Operation KillSwitch Takedown
KillSec's servers were seized in September 2026, but a takedown does not decrypt anything. Encrypted servers, VMs and databases still need recovering, and India was one of its main targets.
NightSpire Ransomware Recovery: .nspire Files, Databases and VMs
NightSpire encrypts virtual disks, Veeam backups and SQL Server files in 1 MB blocks instead of end to end, so large files usually keep most of their data readable.
MedusaLocker Ransomware Recovery: What's Recoverable
MedusaLocker is not the same as Medusa. It has been around since 2019, gets in mostly through exposed Remote Desktop, and was still posting victims in 2026, two of them in India in September.
Spirals Ransomware Recovery: What's Recoverable
Spirals went from a web shell on an IIS server to a fully encrypted network in under 24 hours. It stops backup, database and virtualisation services first, and encrypts large files only in part.
Emperador Ransomware: New Extortion Group of 2026
Emperador appeared in August 2026 and posted 23 victims in September alone, among them government bodies. Whether it uses its own encryptor is not yet known.
Panzer Ransomware Recovery: What's Recoverable
Panzer's leak site went live on 5 August 2026 and listed dozens of victims within weeks. It is a ransomware-as-a-service operation with encryptors for Windows, Linux, FreeBSD and VMware ESXi.
Settra Ransomware Recovery: What's Recoverable
Settra appeared in June 2026 and was among the most active groups by September. It gets in with stolen VPN credentials, keeps access with MeshAgent and disables recovery features before encrypting.
0Apt Ransomware Recovery: What's Recoverable
A group that surfaced in early 2026 with a genuinely capable encryptor — and a leak site full of victims that researchers found were mostly invented. Both facts matter if your name shows up on it.
Hunters International Ransomware Recovery: What's Recoverable
A Hive successor that ran from late 2023 until it shut down in mid-2025 and released free decryptors — a rare case where decryption may be possible, though not guaranteed for every file.
Brain Cipher Ransomware Recovery: What's Recoverable
It looks like LockBit because it is built from LockBit's leaked code. That resemblance leads people to the wrong decryptor.
Chaos Ransomware Recovery: What's Recoverable
Not the old Chaos builder from 2021. This is a newer operation that phones staff pretending to be IT support, and it encrypts only part of each large file.
Interlock Ransomware Recovery: What's Recoverable
It usually starts with someone being asked to paste a command to "fix" a web page. Schools, councils and hospitals are its most frequent victims.
AuditTeam Ransomware: What Is Known So Far
A small leak site that went from a handful of victims a month to thirty in September, and whose victim map does not look like most ransomware groups'.
Storm Ransomware: A New Group Hitting US Firms Fast
Eight weeks old and already among the most active leak sites. Almost nothing technical has been published about it yet, and we say so rather than guess.
MetaEncryptor Ransomware Recovery: What's Recoverable
Active since 2023 but sharply busier in September 2026 — a third of its listed victims appeared in the last 30 days.
ShinyHunters: Data-Theft Extortion From Cloud Platforms
The target is not your servers but your cloud platforms — data warehouses and CRMs — reached with stolen passwords or a convincing phone call.
Silent Ransom Group (Luna Moth): Data Theft Without Encryption
No encryptor, no malware in the usual sense — just a phone call from "IT", a remote-access tool and a copy of your client files. Law firms are its main target.
Dire Wolf Ransomware Recovery: What's Recoverable
A small, tightly run group with unusual reach into South and Southeast Asia — and encryption strong enough that recovery depends on what it missed, not on breaking it.
Vexy Ransomware: New Group With India as Its Top Target
A new group whose leak site went up in September 2026 has named more victims in India than anywhere else. Little is public about its encryptor yet — here is what is known, and what to do first.
Payload Ransomware Recovery: What's Recoverable
Payload is another operation built on Babuk's leaked source code, which tells you more about how it behaves against ESXi than its own short history does.
Deadlock Ransomware Recovery: What's Recoverable
Deadlock anchors parts of its infrastructure on a public blockchain, which makes the law-enforcement takedowns that sometimes produce free decryptors less likely to work here.
Krybit Ransomware Recovery: What's Recoverable
Krybit affiliates get encryptors for ESXi and NAS alongside Windows and Linux, so a single intrusion can take out the virtualization layer and the storage holding your backups.
Everest Ransomware Recovery: Decryptor Status, Data Theft and What's Recoverable
Everest is as much a data-theft and access-selling operation as a ransomware one. The first question after an Everest attack is often not "how do we decrypt" but "was anything encrypted at all, and what was taken".
Lynx Ransomware Recovery: What's Recoverable
Lynx shares its underlying codebase with INC Ransom under new branding — which means incidents attributed to either name are worth assessing the same way.
Anubis Ransomware Recovery: What's Recoverable
Anubis can either encrypt a file or wipe it to zero bytes — and no decryption key, however it's obtained, brings back content that was wiped rather than encrypted.
Rhysida Ransomware Recovery: What's Recoverable
Rhysida deliberately encrypts only sections of larger files to move faster and evade detection — which is exactly the gap partial-encryption recovery works from.
Black Basta Ransomware Recovery Guide
Black Basta's own numbers show a 24-day average gap between attack and discovery — plenty of time to reach backups before anyone notices anything is wrong.
LockBit 5.0 Ransomware Recovery: ESXi, NAS and Veeam Backups
LockBit came back after a law enforcement takedown, rebranded, and this time added VMware ESXi to its target list alongside Windows and Linux.
Cl0p Ransomware Recovery: What's Recoverable
Cl0p is best known for exploiting vulnerabilities in widely-used enterprise software to compromise many organizations at once, rather than one target at a time.
Cactus Ransomware Recovery: What's Recoverable
Cactus has been linked by Microsoft to malvertising campaigns — meaning the initial infection sometimes starts with something as ordinary as a malicious search ad.
INC Ransom Recovery: What's Recoverable
INC Ransom has no sector it considers off-limits — with healthcare, government, education and manufacturing among its most frequent targets.
RansomHub Ransomware Recovery Guide
RansomHub explicitly supports Windows, Linux, ESXi and even ARM/MIPS architectures — built to hit every layer of a mixed environment in one incident.
LockBit Ransomware Recovery: What's Recoverable
LockBit's toolkit documents Veeam credential extraction specifically — meaning it doesn't just encrypt your data, it goes after the credentials protecting your backups too.
Medusa Ransomware Recovery: What's Recoverable
CISA issued a formal advisory on Medusa in early 2025 after attacks surged 42% in a year — concentrated heavily in healthcare, education, legal and manufacturing.
SafePay Ransomware Recovery: What's Recoverable
SafePay deletes volume shadow copies as a standard step — so the data itself is often more recoverable than Windows' own "previous versions" would suggest.
DragonForce Ransomware Recovery Guide
DragonForce restructured into a ransomware cartel model in 2025 — and has been linked to breaches at Marks & Spencer, Co-op and Harrods.
Play Ransomware Recovery: What's Recoverable
Play deliberately disables shadow copies and security services before encrypting — meaning the built-in Windows recovery options are usually gone before the encryption even runs.
Qilin Ransomware Recovery: What's Recoverable
Qilin explicitly targets VMware ESXi environments — which matters for recovery, since a fully encrypted datastore behaves very differently to a partially encrypted one.
The Gentlemen Ransomware Recovery Guide
This group's documented playbook specifically includes destroying Veeam backups and compromising hypervisors before encryption — the exact systems where recovery work matters most.
Akira Ransomware Recovery Service: Decryptor Status, Real Cases and What's Recoverable
Akira often encrypts large files only in part. From one Akira-encrypted 43 GB Veeam backup we rebuilt the server's 466 GB virtual disk, with 98% of its data blocks verified intact.
Servers, storage & hardware
NAS and RAID Ransomware Recovery: Synology, QNAP and Server Arrays
NAS ransomware is three different problems: ransomware on the NAS itself, files on its shares encrypted over the network, or encrypted servers on a RAID array. Each has its own way back.
How to Recover Permanently Deleted Files in Windows 10 and 11
A file removed with Shift+Delete, or from an emptied Recycle Bin, is called permanently deleted, but Windows has only marked its space as free. Until something new is written there, the file can usually be brought back.
Recovering Data From an Encrypted Drive
Encryption does not stop a drive failing. It does mean the recovery key becomes as valuable as the drive itself, and a lost key is usually final.
Water Damaged Drive? Don't Power It On
A drive that has been in floodwater is often recoverable. The two things that usually make it unrecoverable are switching it on and trying to dry it.
SAN or Storage Array Offline? What to Do First
When shared storage fails, everything above it fails at once. The most damaging step in the first hour is usually a well-intentioned rebuild.
Server Won't Boot? What to Check First
A server stuck at boot looks like the whole business is down. Often the data underneath is untouched, and the boot failure is a narrower problem than it first appears.
SD Card or USB Drive Not Readable? Do This First
Photos on a card and files on a USB stick often come back, provided nothing new is written to them. The first few minutes decide that.
External Hard Drive Not Detected? What to Do First
An external drive that does not appear is often a cable, port or enclosure problem, and sometimes a failing drive. The order in which you check decides which one you find.
Formatted a Drive or Lost a Partition? Read This
A quick format or a deleted partition usually removes the map, not the data. What you do next decides how much of that data is still there.
NAS Volume Degraded or Crashed? What to Do First
A NAS warning is easy to answer with a repair button. On a device holding the only copy of your data, the first hour matters more than the fix.
SSD Failure Is Different: What to Know Before You Act
A failing hard drive usually gives warnings, such as noise, slowness and errors. An SSD often does not. The rules that protect data on a hard drive do not all carry over.
Deleted Files by Mistake? What to Do First
Deleting a file rarely erases it. It marks the space as available, and the file survives only until something else is written there. What you do next decides how much of it is left.
Hard Drive Clicking or Not Detected? What to Do First
A drive that clicks, will not spin or vanishes from the system is usually failing physically, and every extra power-on can cost data. The most helpful thing to do is often nothing, quickly.
RAID Rebuild Failed or Stuck? Do This Before Retrying
A failed rebuild feels like it needs another attempt. The safer move is usually to stop, record how the array was configured, and copy the disks before anything else touches them.
Multi-Disk RAID Failure: What's Actually Recoverable
A single disk failure in a redundant array is usually just an inconvenience. A second failure during rebuild is where most real data loss happens — and where the wrong next step matters most.
Databases & applications
Recover a Dropped, Truncated or Deleted Oracle Table Without Backup
A dropped, truncated or deleted Oracle table is rarely erased on the spot. The rows stay in the datafile blocks until Oracle reuses the space, so what you do in the first hour decides how much comes back.
Recover Deleted Records or a Dropped Table in SQL Server
SQL Server has no recycle bin, but a DELETE, TRUNCATE or DROP TABLE does not wipe the data either. The rows stay on the database pages until the space is reused, so the first hour decides how much comes back.
MDF File Recovery: How to Repair a Corrupted SQL Server MDF File and Get the Data Back
A corrupted MDF file is rarely corrupted everywhere. SQL Server stores data in 8 KB pages that each describe themselves, so the intact pages can be found, checked and turned back into tables even when the database will not attach.
SQL BAK File Recovery: Getting Data Out of a Corrupted or Ransomware-Encrypted SQL Server Backup
A SQL Server .bak file is mostly a copy of the database's own 8 KB pages. When RESTORE gives up on a damaged backup, those pages are usually still inside the file, and they can be found, checked and turned back into tables.
How to Recover an MSSQL Database After a Ransomware Attack
Ransomware encrypted your SQL Server? In most cases the MSSQL database is not gone. Here is the order of steps that saves the most data, and what we do when no clean backup is left.
How to Recover MySQL Data from .ibd Files
The server is gone or will not start, but the .ibd files are still in the data folder. The table data is in them, and it can often be brought back.
SQL Server Database in SUSPECT or RECOVERY PENDING: What to Do
A SQL database marked SUSPECT or RECOVERY PENDING has not lost its data yet. What you do in the next hour decides how much of it you keep.
Ransomware-Encrypted SQL Server Database Recovery: MDF and BAK Files
When ransomware hits a SQL Server, the database isn't always gone. Large MDF files are often only partially encrypted — and where that's true, much of the data can be recovered directly from the file, without the key.
Oracle Database Ransomware Recovery: Datafiles and DMP Exports
When ransomware encrypts an Oracle database, it isn't always gone. Large datafiles are often only partly encrypted — and recovery can read the surviving blocks and exports directly, without the key.
1C Infobase Won't Open? What to Check First
1C's own Test and Repair tool fixes small problems well. On serious corruption it can delete what it cannot repair — which is why the order of steps matters.
Tally Company Data Corrupted? What to Do First
Tally's corruption message often appears long before the data is genuinely lost. What matters is what you run next — some repair steps discard the very data you want back.
Exchange Won't Mount or PST Corrupted? First Steps
A mail store that won't open is rarely empty underneath. Exchange EDB files and PST/OST files corrupt in predictable ways, and most of a mailbox is usually still there.
SAP HANA Won't Start? What to Check First
An SAP HANA instance that won't start looks alarming, but the cause is often a service or configuration fault sitting on top of intact data, not damage to the data itself.
SQL Server Database Will Not Attach: What to Check
An MDF file that will not attach usually has one of a handful of causes. Working through them in order, on a copy, avoids turning a simple problem into a data-loss one.
Dropped or Truncated a Table? What to Do First
The first few minutes after an accidental DROP, TRUNCATE or mass DELETE decide how many recovery routes stay open. Most of them are closed by the database carrying on as normal.
Oracle Data File Corruption: Steps Before You Repair It
Errors like ORA-01578 and ORA-01110 point at a specific block in a specific data file. What you do next, and in what order, decides whether that block can be restored or is lost for good.
PostgreSQL Will Not Start: Before You Reset the WAL
pg_resetwal will usually get a broken PostgreSQL server to start. It does that by discarding part of the write-ahead log, which is why it should come after a copy of the data directory, not before.
MySQL InnoDB Corruption: Before You Force Recovery
When MySQL crashes on startup, the fastest-looking fix is usually the one that does the most damage. A few minutes spent copying the data directory first keeps every recovery option open.
SQL Server Corruption: Steps Before You Make It Worse
DBCC CHECKDB's REPAIR_ALLOW_DATA_LOSS option does exactly what its name says. It's often run under pressure, before anyone has checked whether there's a safer path back to zero data loss.
Virtualisation
VMware Snapshot Chain Broken: Consolidation and CID Mismatch Errors
A broken snapshot chain looks like a lost virtual machine, but the data is almost always still in the base disk and the delta files. The risk is in the fixes people try first.
How to Repair a VHDX File That Will Not Mount
A VHDX that will not mount is rarely empty. The virtual machine's data is usually still inside; the damage is in the small structures that describe it.
VMware ESXi Ransomware: Encrypted VMDK Recovery
Ransomware on an ESXi host can take out every VM at once — but that rarely means every byte is gone. On large virtual disks, the families that target ESXi encrypt only part of each file, and that is what makes recovery possible.
Hyper-V Ransomware: Encrypted VHDX Recovery
Ransomware on a Hyper-V host encrypts the files that make up each VM — but large VHDX disks are often only partly encrypted, and the guest filesystem can be reconstructed from the surviving regions.
ESXi Datastore or VM Missing? Check This First
A datastore that disappears from the vSphere client rarely means the storage behind it is gone. Most of the time the files are still there, and the inventory is what's wrong.
Deleted a Virtual Machine? Your Recovery Options
Deleting a virtual machine can mean very different things depending on the platform and the option chosen. The first job is to find out what was actually removed.
Hyper-V VM Will Not Start: Broken AVHDX Checkpoints
A Hyper-V virtual machine with checkpoints is really a chain of disk files. When one link is changed, merged or removed outside Hyper-V, the chain stops matching and the VM stops starting.
VMware Datastore Corruption: VMFS & vSAN Recovery
A VM that won't power on because of a datastore error is rarely a lost cause — but recreating VMDK descriptor files or re-signaturing a datastore from memory is one of the fastest ways to make it one.
Backup & disaster recovery
Veeam Backups Deleted by Ransomware or by Mistake: How to Recover Deleted VBK and VIB Files
Attackers delete the Veeam backups before they encrypt the servers. Deleting a file does not erase it, so the backups are often still on the repository disks, until something new is written over them.
Corrupted Veeam Backup File (VBK or VIB): What the Errors Mean and What Can Be Recovered
"Backup file is corrupted" rarely means everything is gone. A Veeam file is built from thousands of self-checking blocks, so the damage can be measured block by block and the intact part recovered.
Ransomware-Encrypted Veeam VBK Recovery: Akira, LockBit and Others
When a Veeam VBK is found encrypted, it's tempting to write it off. Big backups are often only partially encrypted — but whether the file is recoverable depends on its size and whether the backup's metadata survived.
Microsoft 365 Is Not a Backup
Microsoft keeps the service running. Keeping your data is largely your responsibility, and most organisations discover the distinction after a deletion.
Your Recovery Time Is Longer Than You Think
A recovery target written in a document is a statement of intent. Until something has actually been restored and timed, it is not a measurement.
Acronis Backup Won't Restore? What to Do First
A corrupted-archive message from Acronis is often a problem with part of the archive, not all of it. What you do next decides how much of the rest is still usable.
How to Test a Disaster Recovery Plan and How Often
Most disaster recovery plans read well and fail when used. Testing is how you find out which is true, at a time when finding out is cheap.
IT Disaster Recovery Plan: What It Must Include
A disaster recovery plan is the document you open when the systems are down. If it is vague, out of date or stored on the servers that failed, it will not help when it is needed.
Test Your Database Backups Before You Need Them
A backup that has never been restored is an assumption. Most failed recoveries are not caused by missing backups, but by backups that were never proven to work.
Veeam Backup Will Not Restore: Common Causes
A Veeam restore that fails is usually failing for a specific reason: a broken chain, a missing file, or a password nobody can find. Knowing which one narrows the options quickly.
SQL Server Backup Will Not Restore: What to Try
A restore error is information. It usually names the reason: version, encryption, a missing file in the set, or damage in the backup itself. Reading it carefully saves time.
The 3-2-1 Backup Rule: Why It Still Works in 2026
Most backup failures aren't caused by not having a backup. They're caused by having one backup that turned out to depend on the same thing that failed.
Choosing help
Free Data Recovery Software: What It Can and Cannot Do
Free data recovery software comes in three kinds: fully free tools, free editions with a size limit, and free scans that show what is recoverable before you buy. Knowing which one you have saves time and, sometimes, the data.
How to Choose Data Recovery Software
Most data recovery software looks similar in a screenshot. The differences that matter — read-only scanning, honest previews, and knowing its own limits — only show up once you're using it on a real drive.
Choosing a Data Recovery Provider: 10 Questions to Ask Before You Send Anything
Data recovery has no licence requirement and a huge range of skill behind very similar websites. Ten concrete questions — and the answers you should expect — separate the providers who can measure your damage from those who will guess.