Most ransomware only scrambles part of each large file, racing to finish before it gets caught. ScanCrypt reads the locked file or disk, works out which bytes it never reached, and pulls them back, with no key and no ransom. It is not a decryptor. It recovers the data that was never encrypted.
a Windows app, no command line needed · read-only, never writes to the scanned file or disk · Apache 2.0 · no warranty
$ scancrypt DBDATA_D.vhdx size 100.0 GB pattern front-only recoverable 99.87% 99.9 GB encrypted 0.13% 1.0 MB at the front family Makop / Phobos (confirmed) integrity input unchanged (sha256 before = after)
You do not need to touch a terminal. ScanCrypt ships as a single Windows program: download it, double-click, and choose the encrypted file, folder, or disk. It shows you how much is recoverable in a colour map, then pulls the readable files back out for you. There is a command-line version too, for responders who want to script it, but most people never need it.
It reads Hyper-V and VMware virtual disks (VHDX, VHD, VMDK) and copies your files out with their names and folders, even when the disk will not mount because the ransomware wrecked its header. Scan a single file, or point it at a whole share and get one incident-wide figure with a per-file list.
Illustration with example data. No real case is shown.
When ransomware hits, No More Ransom and ID-Ransomware name the strain and hand you a decryptor if a key exists. Usually one does not. Generic file carvers are not ransomware-aware, so they trip over the encrypted regions and carve garbage. Recovery firms do the work by hand, slowly, at a price. The question a victim asks first went unanswered: how much can I get back right now? ScanCrypt answers it, before anyone weighs up a payment.
# the ransom note said the whole file was gone scan: first 4 MB encrypted next 16 GB intact 24/24 spot checks clean result: full transaction log read back.
A triage step you run before you consider paying, and a recovery tool once you decide to.
An entropy scan finds where the encryption starts and stops, then refines down to the byte. A coarse pass can miss a short encrypted region and write off a disk that was almost entirely fine. Getting that wrong is the mistake ScanCrypt was built to prevent. It stays fast on the files that matter, a 300 GB virtual disk is measured in seconds, not read end to end.
Encrypted data and compressed data both look random, so entropy alone confuses them. ScanCrypt runs a chi-square test, and reads the file's own archive headers, to separate real ciphertext from an ordinary zip, image, or database blob. That way it does not write off data that was never locked.
You get a standalone HTML report: the recoverable percentage, a map of the file, the strain, and the limits stated plainly. Point it at a whole share and it rolls the lot up into one figure and a per-file list you can hand to a client or an insurer. When part of a disk did not survive, the file list is marked partial, never passed off as the whole picture.
Extract the intact byte ranges. Pull files out of a Hyper-V or VMware virtual disk (VHDX, VHD, VMDK) with their names and folders, even one whose header the ransomware destroyed, by rebuilding it from the block map that survived. Check a recovered SQL database page by page. Carve loose files with PhotoRec. Every step records hashes as it goes.
ScanCrypt names the strain when it can, from the file extension, an appended marker, or the ransom note. Naming it never changes what comes back, so recovery still works on a family it has never seen. We also say how sure we are: confirmed against a real sample, or taken from public reporting. We do not invent signatures.
the dot marks a family confirmed against a real sample. the rest come from public threat reporting, and say so in the report.
Help ScanCrypt recognise it. Run one command on a single encrypted file and it prints a ready-to-submit fingerprint, the extension, the family's marker bytes, the encryption pattern, and any ransom note. Metadata only: no file contents are read or sent, so it is safe for a victim to share.
$ scancrypt DBDATA_D.newcrypt --fingerprint extension .newcrypt pattern front-only note HOW-TO-DECRYPT.txt → ready-to-paste signature + a pre-filled submission form
ScanCrypt is a single Windows program with nothing to install. It runs fully offline, so you can carry it on a USB stick to an isolated machine, and it never sends your data anywhere.
The point-and-click Windows app. Scan a file, folder, or disk and recover files without ever opening a terminal.
scancrypt-gui.exe (Windows) · scancrypt-macos.zip (macOS) · latest release v1.0.0
A slim console version for DFIR workflows: scriptable, with hash-chained audit logs and incident-wide batch reports.
scancrypt.exe · about 21 MB
Grab scancrypt-gui.exe from the releases page on a machine that was not
infected. Move it across on a USB stick if the affected network is isolated.
Because the app is new and not yet code-signed, your system may warn about an unrecognised app. On Windows, click More info then Run anyway. On macOS, right-click the app and choose Open. Every release is built in the open from the public source on GitHub.
Click Choose file / disk image and pick your encrypted file, virtual disk, or backup, or drag it onto the window. Use Scan a folder to measure a whole share at once.
Click Scan. In under a minute you get a recoverable percentage and a colour map. Then Extract files from volume for a virtual disk, or Extract recoverable data for a single file. The app tells you the best next step for what it found.
Do not pay the ransom. Find out what you can recover for free first, and check the No More Ransom project for a free decryptor. New to responding to ransomware? Read the plain-English guide.
Do not pay the ransom. Paying is never a guarantee that you get your files back, and every payment funds the group to go after the next victim. Find out what you can recover for free first. For help responding without paying, visit the No More Ransom project.
A free triage scan replaces "everything is gone" with an evidenced figure, before the pressure to pay sets in.
Offered as a free community resource. The methodology and the signatures are open to read, reuse, and improve.
Command-line, scriptable, read-only, with hash-chained audit logs. It slots into an evidence chain the way SANS handlers expect.
ScanCrypt gives you the number and the method for nothing. If you would rather hand it over, IronSights does the full job: extraction, database rebuilds, forensic reporting, and the incident response around it. That part is a paid engagement. The tool stays free.