Trying to recover from an infected Cryptowall hard disk

[faraflunz]

Hello,

 

I have a hard disk infected with Cryptowall, so files are encrypted and have a random 7-digits extension at the end of the name.

Cryptowall encrypts data then deletes the original files, so I'm trying Recuva to recover them.

It seems to work, but when I restore files, Windows says that files are "damaged or corrupted" or something similar. Inside files are garbage,

It seems to me that Recuva restores the file name leaving data encrypted. It happens with all files.

 

I tried Photorec: it  works, so restored files are readeable, but this software can't recover directory structure or file names, so I get something like 100.000 or more recovered files to check inside to find my data :-(

 

Any help, advice, suggestion, doc link or psychological support will very apreciated.

 

Have a nice day!

 

Daniele

[hazelnut]

This is the go-to forum for files encrypted by malware eg. Cryptowall, Tesla Crypt etc.

 

http://www.bleepingcomputer.com/forums/f/45/general-security/

 

You cannot recover encrypted files using Recuva.

 

They need to be decrypted using one of the tools provided at that site.

 

Note not all encrypted files have decrypters available.

 

A post from that forum I linked to which may prove helpful

 

http://www.bleepingcomputer.com/forums/t/602695/cryptowall-trojan-ransonware-virus/?do=findComment&comment=3912460

 

Good luck.

[faraflunz]

Thank for you reply Hazelnut :-)

 

I don't want to decrypt encrypted data.

I want to recover original (unencrypted) files deleted by Cryptowall.

This the 2nd method mentioned in this bleepingcomputer FAQ:

 

www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#restore

 

For some reason, Recuva recovers deleted files, but they seems encrypted because their content is garbage.

This is my problem.

 

Daniele

[hazelnut]

That is why you really need to post over at Bleepingcomputer forums as this is a specialist area (recovering encrypted files) and you are having issues doing it. It is not set in stone that those deleted unencrypted backups are recoverable.

 

It is beyond the scope of the forum to give advice on this (I wish I could say otherwise Daniele)

[faraflunz]

Thanks again and have a nice day

[hazelnut]

Please let us know how you get on and good luck