How to recover some WannaCry ransomware encrypted files

Computer files poisoned by WannaCry blackmail software are encrypted, but tests show that the encryption software encrypts the files first and then deletes the original files.

So we can try to use the hard disk recovery tool to recover some files, because Wannacry is not running in the safe mode of the computer. If you want to recover some files after poisoning, do not write.

On the D disk of a Windows7 computer, there are several important documents. Txt,excel,docx .

Within a few seconds of the virus running, the encrypted file and the original file coexist.

After waiting for Wannacry to start completely, the original file will be deleted.

Computer poisoning.

Restart the computer and press F8 to enter the safe mode of the computer.

After entering safe mode, start the hard disk recovery tool for file recovery. (in safe mode, it is found that Wannacry is not started)

Select a file type

Because it is a file to restore, select the document tired recovery.

Wait for the scan to complete.

The original file encrypted by Wannacry was found.

Restore the files.

Restore to disk c here (if you have a removable hard drive, you can copy the files to an empty removable hard drive)

File restore completed

The original file was restored.

This recovery model depends on the size of the computer Recycle Bin, and if a large number of files are encrypted and deleted, then this method can only recover some files.