I know there are many companies that say that they can help to recover from ransomware attack or can detect and protect.

What I am curious about is, can we find out whether a file has been attacked, by some open-source or tools?

Maybe we can know by the file extension being changed or data can't be opened by the application.

Any other way to know by software whether the file is under ransomware attack? Check the header? Check whether it was encrypted by AES or other crypto algo?

1 Answer 1


It depends. As with all modern encryption you have three main ways of action to decrypt something.

Attack a faulty implementation or algorithm

With ransomware, it is not uncommon that an very old implementation was used which may have a weakness and allows recovery of the the decryption key.

There is no single software solution for something like that, not one that I'm aware of anyway. It boils down to detecting the usage of a faulty and then writing your own tool based on a cryptolibary.

Attack the key or passphrase itself

Sometimes the decryption master key has leaked, was leaked intentionally or discovered by brute-forcing.

Rainbow Crack and John the Ripper can both be used for doing that. But it's likely that professional firms use home-brewed scripts and software for problems like this.

Hope that encryption was not applied to all data

Some ransomware was also know for only encrypting certain parts of a system, like the partition table - meaning that the data was still there, unencrypted - but the average user didn't have the knowledge on how to recover it.

In such a case, the Sleuthkit is a very useful collection of forensic tools that can be used for recovery.

As for detecting that a file is encrypted: Most software will simply detect it by the header. Modern encryption basically looks like random data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.