Local service guide
Data Recovery and Backup in Chicago
For Data Recovery and backup in Chicago, choose a provider by the problem you need to solve: recovering files from a device, restoring a known backup, or responding to a security incident. Ask for a written evaluation scope, approval limit, data-handling terms, and a plan to verify your priority files before accepting the work. For suspected ransomware, arrange incident response alongside recovery; CISA recommends isolating affected systems and preserving evidence. [3]
Choose the right scope before handing over equipment
Tell the provider what happened, which device or account holds the missing data, and what you tried afterward. Describe deletion, an error message, water exposure, or a ransom note without guessing at the cause. Ask the evaluator to explain the proposed method and obtain your approval before work that changes the original device.
Prepare a short priority list: accounting records, current customer jobs, payroll, or another business need. Include folder names, file types, and the date of the last usable version. Define success around those files. Ask how the provider will let you check that recovered documents open and contain the information you need.
For a suspected cyberattack, ask whether the provider can coordinate containment and evidence preservation. CISA advises responders to isolate affected systems, examine logs, and identify earlier compromise before rebuilding from backups. A file-recovery assignment should include a named person responsible for the wider incident when that work is necessary. [3]
Compare written quotes and handoff terms
Request separate amounts for evaluation, recovery work, return storage, transport, and backup installation. Ask which charges apply if you decline the recovery proposal or the provider cannot recover your priority files. Define partial recovery in writing, including whether you can review a file list before authorizing payment.
Ask the provider to distinguish the evaluation date from the expected recovery and verification dates. State your business deadline and request an update schedule. If the provider proposes expedited work, ask what the extra charge changes and what happens if the provider misses the agreed milestone.
Record the device model, serial number, condition, accessories, and recipient at handoff. Ask where the work will occur, whether another lab will receive the device, and who can access your files. Agree on encryption for returned data, a secure route for sharing credentials, and a date for deleting the provider's working copies.
For ongoing backup management, put security responsibilities in the contract. CISA recommends contract language for third-party security requirements and limiting provider access to devices and servers within the provider's role. Ask who owns the backup account and how you will retrieve your data if you change providers. [3]
Specify a backup you can restore
Ask the installer to document what the backup covers: local files, shared storage, business applications, and cloud accounts. Identify the person who checks failed jobs and the person who approves restoration. Set your acceptable amount of lost work and downtime before choosing a backup schedule.
CISA recommends offline, encrypted backups because ransomware variants may delete or encrypt accessible backups. Its guidance also discusses cloud-to-cloud backups, version control, and protections against deletion. Ask the provider to explain which copies remain protected if an attacker gains access to your everyday accounts. [3]
Include a witnessed restore in the installation scope. Choose representative files and, where relevant, a business application. Ask the provider to restore them to an agreed test destination, check the contents with you, and document the steps and elapsed time. Keep recovery instructions and the needed account access available to an authorized backup contact.
Ask for a repeat testing schedule and a written result after each test. CISA recommends testing backup procedures and checking availability and integrity in a disaster-recovery scenario. For ransomware recovery, it directs responders to restore on clean systems and take care to avoid reinfection. [3]
Prepare for flood-related pickup and business interruption
NWS reports that the worst flooding on July 2, 2023 occurred on Chicago's west and southwest sides and in nearby west and southwest suburbs, where roads and homes flooded. Use that history to discuss equipment placement and a backup copy outside the premises with your installer. Ask how you would restore if you could not enter the building. [1]
For a device exposed to floodwater, describe the exposure before arranging transport and request handling and packaging instructions from the receiving specialist. Confirm the pickup location and a fallback handoff point. NWS documented closures on I-55 and I-290 during the same event; check current access conditions when scheduling a flood-related pickup. [1]
Rainfall at Chicago airports during the July 2, 2023 flood
Local details that affect your job
Chicago flood history changes backup placement
The July 2, 2023 event affected homes and transport routes, with the worst impacts on the west and southwest sides and nearby suburbs. If you keep business equipment or backup drives in a basement, ask the installer to assess their placement and arrange a separate off-site copy. Include a restore procedure you can carry out from another location. This historical event supports contingency planning; it does not establish your property's flood risk. [1]
Illinois personal-information incidents need a reporting review
The Illinois Attorney General explains that entities conducting business in Illinois and handling nonpublic personal information must disclose qualifying breaches involving Illinois residents without unreasonable delay. Certain businesses and state agencies must also notify the Attorney General. For suspected theft of customer or employee information, assign a reporting review alongside recovery and use the office's Data Breach Notice System when applicable. The office provides discussion assistance at 1-800-243-0618. Ask your adviser to determine your obligations rather than applying the page's state-agency deadlines to your business. [2]
Match the assignment to the problem
| Situation | Scope to request | Acceptance question |
|---|---|---|
| Missing files without signs of an attack | Device evaluation and recovery of named priority files | Can I review and open the priority files before accepting the result? |
| A usable backup is available | Restoration to an agreed destination and verification | Can you demonstrate that the required files and applications work? |
| Ransomware or suspected intrusion | Incident response, evidence preservation, and recovery on clean systems | Who will confirm containment before systems reconnect? |
| Flood-exposed equipment | Specialist evaluation, transport instructions, and off-site backup planning | How should I hand over the device, and where can we restore operations? |
| Possible exposure of personal information | Technical investigation and an Illinois notification review | Who will assess resident and Attorney General notification obligations? |
Your hiring checklist
- List priority files, business applications, and the last known usable versions.
- Record symptoms, exposure, error messages, and previous recovery attempts.
- Obtain evaluation charges and an approval limit before authorizing recovery.
- Define partial recovery and how you will verify returned files.
- Record device custody and agree on access, encryption, and deletion terms.
- Confirm pickup access, the receiving location, and transport instructions.
- Specify backup ownership, failure alerts, and a witnessed restore.
- Assign an incident-response contact if you suspect unauthorized access.
Frequently Asked Questions
Can I get a reliable price before evaluation?
Ask for the evaluation fee, the charges that apply if you decline further work, and a written approval limit. Request a recovery proposal after evaluation. Compare providers using the same priority-file list and acceptance terms; the sources used here do not establish local recovery prices.
Should I shut down a computer showing a ransom note?
CISA recommends isolating affected devices from the network first. It advises powering down only when you cannot disconnect them, because shutdown loses potential evidence in volatile memory. Contact your incident-response lead and avoid connecting backup media until the responder approves. [3]
What should I require from a backup installer?
Require a documented coverage list, ownership and access terms, failure-alert responsibility, and a demonstrated restore. CISA recommends offline, encrypted backups and tests of their availability and integrity. Ask the installer to explain how the proposed setup meets those needs. [3]
Does recovering files resolve a possible data breach?
Arrange a separate assessment of exposure and notification duties. The Illinois Attorney General describes disclosure requirements for qualifying breaches involving Illinois residents. CISA also warns that ransomware incidents can involve stolen data, so restoration alone does not answer whether someone accessed personal information. [2] [3]
Sources and scope
This guide combines the sources below with practical planning guidance. Figures apply to the stated geography and period; request a written quote for your property.