So it happened. Your data has been encrypted. If you don't want to pay the ransom, then you have basically two options: entrust recovery of this data to a company, which specializes in data recovery by performing such services several times a week - or try to recover them yourself, with a better or worse results, but without paying anyone. If you choose the latter, ask yourself a few simple questions, ideally before you start:
1. Which tools do you want to use? Have you ever used them? Do you have any action plan?
2. Do you want to recover the data to the same drive, or do you have a separate one?
3. Should the infected computer should be still turned on?
These questions are important, because Your data in original, unencrypted form, most likely are still on the disk - statistically means, the more free space was available on each partition, the more original data are still not overwritten. But if you:
- install any programs on the same drive
- try to recover the data to the same drive
- keep Windows running (or worse: rebooting) and writing various logs and other files
...then all these actions lead to further overwriting data that otherwise would be still recoverable.
