{"id":4309,"date":"2018-06-25T22:50:38","date_gmt":"2018-06-26T02:50:38","guid":{"rendered":"https:\/\/www.digitalforensics.com\/blog\/?p=4309"},"modified":"2025-04-09T21:07:09","modified_gmt":"2025-04-09T21:07:09","slug":"data-recovery-after-ransomware-that-encrypts-files","status":"publish","type":"post","link":"https:\/\/www.digitalforensics.com\/blog\/software\/data-recovery-after-ransomware-that-encrypts-files\/","title":{"rendered":"Data recovery after ransomware that encrypts files"},"content":{"rendered":"\n

The problem of data recovery<\/a> after ransomware that encrypts files has increased, with more and more cases recently. Help in these cases is not a trivial task.<\/p>\n\n\n\n

<\/span>Challenges in Data Recovery for Ransomware Encrypted Files<\/span><\/h2>\n\n\n\n

\u00a0Let\u2019s consider some sides of this problem. Ransomware usually encrypts the most-used data such as photos, videos, office files, databases, et\u0441. Ransomwares can give different extensions to encrypted data; they are considered as a same mechanism that uses similar algorithms.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Files are encrypted with cryptographic algorithms. Keys consists of a public key and a private key. The public key is generated on the victim\u2019s PC, while the private key is kept in secret and only the fraud perpetrator knows it. The combination of public key with private key is special for each case. It\u2019s impossible to decrypt data without a private key. Solutions offered by well-known anti-virus developers are likely to focus on selection of the private part of the key, by brute force or special heuristic analysis.<\/p>\n\n\n\n

\u00a0We haven\u2019t faced a practical experience of payment to obtain decoder software, but our customers state they had such experiences. Let\u2019s drop the moral side of this problem, such as whether to pay or not to pay. It\u2019s obvious there\u2019s no need to encourage malicious users, but everyone has their own view as to the importance of data.<\/p>\n\n\n\n

\u00a0However, there have been cases of partial decryption of files. Each case was special. Success is possible only if ransomware encrypts not a whole file, but only part. Such an attitude from the hacker has a logical explanation. As data volume increases, time to encrypt files increases, so the risk to be discovered increases as well. That\u2019s why we think only an important part of the data is encrypted, rather than all of it.<\/p>\n\n\n\n

<\/span>Practical Case: Recovering Data from Ransomware Encrypted Files<\/span><\/h2>\n\n\n\n

Here\u2019s a practical case. A ransomware encrypted the beginning of the file, some fragments in small size in the body of the file and added its technical information at the end of the file. We faced some tasks on this step:<\/p>\n\n\n\n