Advanced

Experts crack Petya ransomware, enable hard drive decryption for free

Posted by bob on · 1 comment
CSO; By Lucian Constantin 		Mail this story
Print this story

Security experts have devised a method that allows users to recover data from computers infected with the Petya ransomware program without paying money to cybercriminals.

Full Story

  Nav
» Read more about: Story Type: Security

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (1)

dotmatrix ·
CSO Article wrote: Computer experts from the popular tech support forum BleepingComputer.com confirmed that the technique works, but it requires extracting some data from an affected hard drive: 512 bytes starting at sector 55 (0x37h) with an offset of 0 and an 8-byte nonce from sector 54 (0x36) offset 33 (0x21).

If that sounds complicated, no worries: Fabian Wosar from security firm Emsisoft created a simple and free tool that can do it for you. However, because the infected computer can no longer boot into Windows, using the tool requires taking out the affected hard drive and connecting it to a different computer where the tool can run. An external, USB-based hard drive docking station can be used.


Instead... use a different computer to download a GNU/Linux distro 'live' image and create a bootable USB stick.

dd the MBR...

https://wiki.archlinux.org/index.php/Master_Boot_Record

And go from there... no removal of HDD needed.

***

GNU/Linux making things simple in order to recover Windows...

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post