Recovery and remediation from ransomware attacks