How to recover encrypted data: a practical guide

How to recover encrypted data is a question that arises after a ransomware attack, disk failure, password loss, or errors when working with an encrypted archive. The main rule: do not rush, do not overwrite the media, and do not pay the ransom without analyzing the situation. In this article, we will discuss what recovery scenarios are possible, what to do in the first minutes, how to check backups, where to look for keys, and when to contact specialists.

What does it mean to recover encrypted data

Encrypted data refers to files, disks, archives, or databases that have been transformed by a cryptographic algorithm. Without the correct key, password, or working decryption procedure, such data appear as a set of random bytes.

Thus, recovery can mean different tasks:

• restoring access to files encrypted by ransomware;
• recovering the password or key from the encrypted container;
• retrieving data from a backup;
• restoring a damaged encrypted disk;
• extracting files from an old archive if the password is known;
• regaining access to cloud services or a password manager.

It is important to understand the limitation: modern encryption, when implemented correctly, cannot simply be cracked within a reasonable time. If the key is permanently lost and there are no backups, recovery may be impossible. However, in practice, traces often remain: shadow copies, backups, synchronization, saved keys, old versions of files, operation logs, or a decryption tool for a known family of viruses.

First actions after discovering the problem

If files suddenly have a strange extension, stop opening, or a ransom demand appears on the screen, act cautiously. Incorrect actions may destroy the last chances for recovery.

Step-by-step plan in the first 30 minutes

1. Disconnect the device from the network. Unplug the Ethernet cable, turn off Wi-Fi and Bluetooth. This reduces the risk of spreading the ransomware to network folders and other devices.
2. Do not abruptly shut down the computer if encryption is ongoing. First, disconnect the network. Then assess the situation. In some cases, active memory and current processes may be useful to specialists.
3. Do not delete encrypted files and ransom notes. They may contain victim identifiers, addresses, file extensions, and information about the malware variant.
4. Do not reinstall the system over the old one. Reinstallation may erase shadow copies, logs, and temporary files.
5. Make a copy of the media or important folders. Work with the copy while keeping the original unchanged.
6. Document the signs of the incident. Record the date, time, file extensions, text of the note, names of suspicious processes, and the last actions of the user.
7. Check other devices and network storage. If ransomware has reached a NAS or shared folders, disconnect them from the network.

This order helps preserve evidence and does not worsen the state of the data.

Determine the cause of encryption

The recovery method depends on the cause. Before looking for a decryption tool or running file recovery programs, it is necessary to understand what exactly happened.

Ransomware

This is the most common scenario. The malware encrypts documents, photos, databases, and archives, then demands payment for the key. Signs include:

• files have new extensions;
• folders contain files with payment instructions;
• some programs stopped launching;
• antivirus detected ransomware or suspicious processes;
• network folders and external disks are encrypted.

In this case, the first step is to stop the spreading, identify the malware family, and check for a free decryption tool.

Forgotten password or lost key

Sometimes data is encrypted with a legitimate tool: BitLocker, VeraCrypt, FileVault, 7-Zip, WinRAR, a corporate DLP system, or built-in smartphone encryption. The problem arises when the password is forgotten, the TPM has changed, the recovery key is deleted, or the account is inaccessible.

Here, it is more important to search for keys, check accounts, old records, password managers, and corporate storage.

Damaged media or file system

An encrypted disk may be physically damaged. In this case, the password is known, but the container does not open. The cause may be bad sectors, a controller failure, an update error, or a sudden power outage.

When signs of physical damage are present, do not conduct mass scanning or attempt to mount the disk repeatedly. First, create a sector-by-sector image, if possible, or contact a data recovery lab.

Synchronization or cloud service error

Files may have been encrypted on one device and then synchronized to the cloud. However, many services have version histories and a trash bin. This may become a quick way to revert.

Check:

• the version history of the file;
• the cloud trash bin;
• removed devices in the account;
• the date of the last synchronization;
• the presence of suspicious logins.

What not to do when recovering encrypted files

Some actions may seem logical, but they harm recovery.

Do not:

• format the disk before making a copy;
• run random decryption tools from forums;
• pay the ransom without consultation and risk assessment;
• upload unknown files to suspicious sites;
• follow instructions from the attacker’s note;
• clear temporary files and restore points;
• continue to use the infected computer as usual;
• install recovery programs on the same disk where the data resides.

Fake decryption tools are especially dangerous. They may further steal passwords, install miners, or re-encrypt files. Use only verified sources: antivirus developer websites, ransomware fighting projects, official documentation from vendors.

How to recover encrypted data after a ransomware attack

Below is a safe sequence of actions. It does not guarantee success, but it helps use all real options.

Step 1. Isolate the infected system

Disconnect the network and external drives. If the computer is in an office, inform the administrator. In a corporate environment, it is important to quickly block accounts, check shared folders, and disable compromised machines.

If the ransomware is still running, processes must be terminated carefully. For a home user, it is usually safer to disconnect the network and turn off the computer after documenting signs. For businesses, it is better to preserve the system state until an incident response specialist arrives.

Step 2. Create a copy of the data

Copy the encrypted files, ransom notes, and a few unencrypted originals, if available. Store the copy on a separate disk. If possible, create an image of the entire media.

You should work with the copy. This is important because some decryption tools can damage files if the ransomware family is incorrectly selected or the key is incomplete.

Step 3. Identify the type of ransomware

To identify it, you need:

• the extension of the encrypted files;
• the text of the note;
• email addresses or websites from the ransom demand;
• an example of an encrypted file;
• an original unencrypted file of the same version, if available.

Check the information only on authoritative resources. Many antivirus companies publish databases of known ransomware and free decryption utilities. If a decryption tool exists, carefully read the instructions and first test it on copies.

Step 4. Check backups

A backup is the most reliable way to recover after ransomware. But it also needs to be checked. Sometimes ransomware deletes local backups or encrypts an attached USB drive.

Check:

• external drives that were not connected during the attack;
• NAS with state snapshots;
• cloud copies;
• version history in OneDrive, Google Drive, Dropbox, and other services;
• backups in Windows, macOS, or Linux;
• corporate backup systems;
• old project archives.

Do not connect the backup drive to the infected system. First, clean the computer or use a separate secure environment.

Step 5. Look for shadow copies and previous versions

In Windows, some versions of ransomware delete shadow copies, but not all do it successfully. Check the previous versions of files and folders. You can also explore restore points if they were enabled.

On macOS, check Time Machine. In Linux, pay attention to Btrfs, ZFS, LVM snapshots, or backup tools that were used previously.

If shadow copies are available, first restore a few test files. Then ensure that the system is already free from malware.

Step 6. Check cloud version history

If files were synchronized with the cloud, reverting versions may help even when local copies are encrypted. Many cloud services allow you to restore a file to its state before a certain date.

Do this:

1. Log into the cloud from a clean device.
2. Change the password and enable two-factor authentication.
3. Check login history and connected apps.
4. Find folders where the encrypted files appeared.
5. Use previous version restoration or mass rollback if the service supports it.
6. Download the restored data to a secure drive.

Step 7. Use a free decryption tool if available

Free decryption tools exist only for some families of ransomware. They appear when researchers find a flaw in the encryption implementation, obtain keys from law enforcement, or analyze the attackers' infrastructure.

Before running:

• ensure that the decryption tool is specifically designed for your variant;
• download the tool from the official site;
• make copies of the encrypted files;
• read the requirements for source files;
• test it on a small folder.

If the decryption tool does not work, do not run dozens of similar utilities in a row. This may damage the file structure and complicate analysis.

Step 8. Clean the system and restore data

After confirming the recovery source, you need to remove the malware. A reliable option is a complete system reinstallation from a verified medium and installing updates. Then, you can restore data from a clean backup.

If you are dealing with a business, additionally check:

• domain accounts;
• RDP, VPN, and remote access;
• login logs;
• email attachments;
• permissions to network folders;
• the presence of other infected nodes.

Restoring files without addressing the cause can lead to re-encryption.

How to recover access with a forgotten password or key

If the data was encrypted by you or your organization, start by searching for legitimate keys. This is safer and more efficient than brute forcing.

Check password managers and records

Look for the password in:

• password manager;
• browser storage;
• notes on the phone;
• paper records;
• old emails;
• corporate knowledge base;
• hint files;
• backups of the user profile.

Also, recall any patterns you used when creating the archive or container: language, keyboard layout, dates, special characters, old password versions.

Locate the BitLocker recovery key

For BitLocker, the recovery key may be stored in several places:

• in your Microsoft account;
• in Azure AD or Entra ID for work devices;
• in Active Directory;
• on a printed copy;
• in a file on a USB drive;
• from the system administrator;
• in the device documentation if encryption was enabled during setup.

If the system asks for a key after changing the BIOS, TPM, or boot order, first revert the settings. Sometimes this resolves the issue without manual decryption.

Check FileVault keys and Apple ID

On Mac, the FileVault key may be associated with the Apple ID or saved as a recovery key. Check trusted devices, Apple ID settings, corporate MDM profiles, and documents created when encryption was turned on.

If the user password is known but the disk does not open, try booting into recovery mode and using the standard macOS tools. If there are hardware signs of malfunction, first make a disk image.

Assess the feasibility of brute forcing the password

Brute forcing is only possible with weak or partially known passwords. For example, if you remember the base of the password but forgot the year or a symbol. For a long random phrase, brute forcing is almost useless.

Legitimate brute forcing is acceptable only for your own data or with the official permission of the owner. Do not use dubious online services where you must upload a confidential archive. It is better to work locally and with a copy of the file.

Recovery of encrypted data from damaged media

When a disk clicks, disappears from the system, works very slowly, or shows reading errors, the main task is not to further damage the media.

Signs of physical malfunction

Consult specialists if you notice:

• strange sounds from the hard drive;
• a burning smell or signs of overheating;
• the disk is recognized intermittently;
• reading speed drops to zero;
• SMART shows critical errors;
• the drive was submerged in water or dropped;
• SSD suddenly becomes inaccessible.

For encrypted disks, a physical error is especially dangerous. Even minor damage to the container header, service area, or metadata can block access to everything.

Why you need an image first

A disk image is a sector-by-sector copy. It can be worked with repeatedly, without burdening the original media. For damaged disks, tools are used that can skip bad sectors and return to them later.

If the password is known, the usual sequence is:

1. Create as complete an image of the media as possible.
2. Save the original without further experiments.
3. Check the integrity of headers or the container.
4. Attempt to mount the copy.
5. Restore the file system within the decrypted image.

If the password is unknown and the media is damaged, the task becomes significantly more complicated. In this case, it is better not to experiment.

Comparison of recovery methods

Below is a brief table that helps choose the path depending on the situation.

Situation	Best first step	Chance of success	Risk
There is a clean backup	Clean the system and restore the backup	High	Low
Known ransomware	Find the official decryption tool	Medium	Low when working with a copy
Unknown ransomware	Identification and consultation with a specialist	Depends on the family	Medium
Forgotten archive password	Search for hints and local brute force by mask	Low or medium	Low
Lost BitLocker key	Check Microsoft account, AD, or Entra ID	Medium	Low
Damaged disk	Create an image or contact a lab	Depends on the damage	High with self-attempts
Files are encrypted and synced to the cloud	Rollback the version history	Medium or high	Low

Is it worth paying the ransom

Paying the criminals does not guarantee recovery. Even if the key is sent, the decryption tool may work slowly, corrupt part of the files, or not fit your variant. Moreover, payment supports the criminal scheme and may violate internal company rules or regulator requirements.

Before making any decisions, assess:

• whether there are backups;
• whether there is a free decryption tool;
• which data is truly critical;
• how long recovery from backups will take;
• whether there are legal restrictions;
• whether clients, partners, or regulators need to be notified;
• whether data was stolen prior to encryption.

For organizations, it is important to involve a lawyer, an information security specialist, and management. Sometimes the incident is not only related to loss of access but also to data leakage.

How to increase the chance of successful recovery

Even if the situation has already occurred, some actions increase the likelihood of success.

Preserve all artifacts

Keep ransom notes, file samples, logs, emails with suspicious attachments, a list of extensions, and screenshots. They help determine the ransomware family and understand the penetration path.

Look for unencrypted originals

Original files may remain:

• in email attachments;
• on phones;
• in messengers;
• on old laptops;
• with colleagues;
• on USB sticks;
• in application caches;
• in the downloads folder;
• in the cloud trash bin.

Sometimes a decryption tool requires one encrypted file and its original version. Therefore, do not delete duplicates.

Separate recovery and investigation

The goal of recovery is to restore working data. The goal of investigation is to understand how the incident occurred. These processes are related but should not interfere with each other. For example, you can quickly restore a service from a clean copy while preserving the infected server as an image for analysis.

Prevention: how not to lose encrypted data again

The best way to recover encrypted files is to have a pre-prepared plan. It should be simple and verifiable.

Use the 3-2-1 rule

Keep at least three copies of data on two different types of media, one of which should be off the primary system. For example: a work computer, an external drive, and cloud storage with version history.

To protect against ransomware, immutable copies are especially useful. These are backups that cannot be changed or deleted by a regular account. In business, WORM storage, deletion-protected snapshots, and separate accounts for backups are used.

Test recovery, not just backup creation

A backup is only valuable when it can be restored from. Therefore, regularly conduct a test:

1. Select a few important files.
2. Restore them into a separate folder.
3. Check if they open.
4. Compare dates and versions.
5. Document the recovery time.
6. Update the instructions if there were any issues.

Such a test takes little time but shows weak points in advance.

Limit access rights

Ransomware usually acts with the rights of the user who launched it. If a user has access to all network folders, the damage will be greater. Use the principle of least privilege: access only to the data needed for work.

Also, disable unnecessary remote access, protect RDP and VPN with multi-factor authentication, update systems, and filter email attachments.

Store recovery keys separately

BitLocker keys, FileVault, VeraCrypt, and archive passwords should be stored separately from encrypted data. A good option is a reliable password manager with backup access, a printed emergency kit in a safe, or a corporate secrets storage.

Do not store the recovery key in a text file on the same encrypted disk. In the event of a failure, it will be inaccessible.

Frequently asked questions about recovering encrypted data

Is it possible to recover encrypted data without a key

Sometimes it is possible, but not by cracking strong encryption. Real options include a backup, cloud version history, shadow copies, a found key, a flaw in the ransomware, or an official decryption tool. If the algorithm is implemented correctly, the key is lost, and there are no copies, recovery may be impossible.

Will a program for recovering deleted files help

It may help if the original files were deleted after creating encrypted copies and their location on the disk has not yet been overwritten. But with SSDs using TRIM, the chance is lower. It is important to install the program on another disk and scan a copy of the media, not the original.

Can files be decrypted after ransomware for free

Yes, if a free decryption tool exists for a specific ransomware family. It needs to be searched on the websites of well-known antivirus companies and specialized projects. If a decryption tool is not available, free recovery is possible through backups, shadow copies, or cloud versions.

What to do if photos on the phone are encrypted

First, disconnect the internet and do not delete files. Check for cloud copies: Google Photos, iCloud, OneDrive, or another service. Look at the trash bin and edit history. If a memory card was used, create its image and work with a copy. Do not install unknown decryption applications.

Is it possible to recover data after formatting an encrypted disk

Sometimes it is possible if the formatting was quick and the key is known. But if the headers of the encrypted container are deleted or the metadata is overwritten, the task becomes more complicated. After formatting, immediately stop writing to the disk and create an image.

Should one contact the police

In the case of a ransomware attack, this is a sensible step, especially for companies. Reporting helps document the incident and may be necessary for insurance, regulators, or internal investigations. Additionally, law enforcement sometimes obtains keys from known groups.

When to consult specialists

Self-actions are suitable if you have a backup, a clear scenario, and no signs of physical failure. But professional help is needed when:

• data is critical for business;
• servers, databases, or financial records are encrypted;
• there are signs of information leakage;
• the disk is damaged;
• there are no backups;
• the type of ransomware is unknown;
• evidence needs to be preserved;
• complex infrastructure restoration is required.

When choosing a contractor, ask how they work with copies, whether they provide a diagnostic report, maintain confidentiality, and do not require handing over the original media without describing the procedure.

Short recovery checklist

Use this list as a quick reference:

1. Disconnect the infected device from the network.
2. Do not delete encrypted files and notes.
3. Create a copy of the data or a disk image.
4. Determine the cause: ransomware, forgotten key, media failure, or cloud synchronization.
5. Check backups and version history.
6. Find recovery keys and passwords.
7. Check for an official decryption tool.
8. Recover only in a clean environment.
9. After recovery, eliminate the cause of the incident.
10. Set up secure backups and key storage.

Conclusion

Recovering encrypted data is not always possible, but the correct sequence of actions significantly increases the chances. First, isolate the device, save copies, and identify the cause. Then, check backups, cloud versions, recovery keys, and official decryption tools. If the data is important or the media is damaged, do not experiment: consult specialists and work only with copies. Start with the checklist above right now — it is the safest path to recovery and future data protection.