DLA Piper is beginning to restore connectivity following the cyberattack that prompted the firm to shut down its phone and computer systems.

The firm is working with engineers from Microsoft to help with the recovery of its systems, in what is now the fourth day of disruption at the global law firm.

Email coverage is returning "in batches" according to one partner, although there is an expectation that it will take a while for the backlog to clear.

Landline telephones are still down, with lawyers using mobile phones and messaging services such as WhatsApp to communicate.

One DLA partner said: "When you have mobile phones and WhatsApp, it's quite easy to get on with things. It's been quite nice having time without constant calls and emails."

Co-chief executive Simon Levine and senior partner Juan Picon are expected to update lawyers and staff next week on the firm's response to the attack. The firm has been working with law enforcement agencies including the FBI and the UK National Crime Agency.

A statement on the firm's website, which has been updated during the week, says: "Our experts are working to bring our systems back online as quickly and safely as possible and we are aiming for our email system to be up and running today.

"At this time, we have no evidence that the confidentiality of any client data has been compromised."

The Wall Street Journal has reported that the outage is disrupting active litigation, stating that DLA lawyers have sought deadline extensions in "at least five different civil cases in the US, including a patent dispute involving Apple".

The cyberattack that spread across the globe on Tuesday (27 June) appears to have originated in Ukraine, but also affected a number of global companies including Russian oil producer Rosneft and Danish shipping company Maersk.

Although it is not 100% clear who or what caused the attack, reports have pointed to an update to Ukrainian tax accounting software as the source of the virus.

Linklaters technology counsel Peter Church said: "There are reports that one source of the attack is an infected update from a software vendor."

"It is difficult to protect against this type of attack," he added. "Some updates will go through a formal change process that might detect and stop the virus, but not all software updates will."