RECOVER FROM RANSOMWARERECOVER FROM RANSOMWARERECOVER FROM RANSOMWARE
Have you been targeted by
ransomware? Most forms
target your data rather than
locking you out of your PC.
Typically, you’ll need to use
a rescue disc or boot into
Safe mode with networking
to remove the underlying
infection before you can look
at recovering your files.
If the files have just been
encrypted, you should be
able to restore them from a
recent backup. If your files
are stored in OneDrive and
you have a Microsoft 365
subscription, you should
receive a warning that
files have been changed or
deleted and given the chance
to roll back to earlier,
pre-infection versions.
If the feature doesn’t
appear automatically,
click the OneDrive settingsbutton and choose Options,
then select ‘Restore your
OneDrive’. After verifying
your identity, you’ll be able
to quickly roll back a set
amount of time from the
drop-down menu or choose
‘Custom date and time’ to
review changes on a timeline
and pinpoint the best
moment to roll back to.
If you’ve no backup, or
you’re looking for a quicker
fix, you’ll need to see if
there’s a decryption tool for
the specific ransomware
infection. Your security tool
has hopefully identified the
ransomware type, so visit
http://www.nomoreransom.org/
en/decryption-tools.html
for a comprehensive list of
types, tools from reputable
antivirus vendors, and a
guide to using them.Take care that you have
the right tool or you risk
scrambling the files beyond
any attempt at recovery.
Some vendors such as Trend
Micro’s Ransomware File
Decryptor tool combine
all its known ransomware
decryption tools inside a
single program. Althoughyou’re asked to select the
ransomware type, there’s
a handy ‘I don’t know the
ransomware name’ link.
Click this and you’ll be
prompted to select one of
your infected files. The app
analyzes it to reveal what
ransomware is behind it and
help you restore your files.Ransomware comes in many shapes and forms.recover up to 2GB for free, while
the Pro version costs $70 and
includes free remote consultation
and assistance should you need it.FORENSIC DATA RECOVERY
Recovering accidentally deleted
files is one thing, but what happens
when an entire partition or drive
goes missing? iCare Recovery and
the paid-for tools can help here,
but before shelling out consideranother free tool in the form
of DMDE (https://dmde.com/).
Though not particularly user-
friendly, it not only detects missing
partitions in Windows but is also
a dab hand at detecting partitions
from other operating systems,
even proprietary ones. If you’re
struggling to recover data from an
internal drive rescued from a drive
enclosure or other system, DMDE
is the tool to turn to.Go to http://www.dmde.com/
download.html and click the
‘Download DMDE for Windows’
link. Save the zip file to any drive
other than the one you’re trying to
recover data from. Right-click the
zip file and choose Extract All; once
done, launch DMDE by double-
clicking dmde.exe.
When prompted to select the
drive you wish to recover from,
choose ‘Logical Disks’ followed
by the drive letter, if it’s visible in
Windows. If it isn’t, leave ‘Physical
Disks’ selected. Click each Physical
Drive entry in turn to identify which
one you’re searching for data on.
Click OK when it’s found.
DMDE will scan the drive for
partitions. Click OK to clear any
errors, then several matches—
some similar or seemingly
identical—will appear. Select one
using your target volume name/
drive letter, partition status,
f.system (file system), and size to
identify it. Click Open Volume.
Double-click ‘[All Found +
Reconstruction]’ in the left-hand
pane and click OK. Explore the
$Root directory to view the drive’s
contents or right-click a directory
and choose Find Files... to searchPartition Find
and Mount has
three type of
partition scan.MAR 2022MAXIMU MPC 45
© MICROSOFT, FINDANDMOUNT.COM