How to recover from ransomware - Lessons from real recoveries