Your files have strange extensions, there is a ransom note on the desktop, and someone above you wants answers. This page is the short version: what to do in the first hour, and how to find out, for free, how much of your data can come back without paying anyone.
Modern ransomware is in a race. Encrypting terabytes takes hours, and the longer it runs the more likely it gets caught. So most strains cheat: they fully encrypt small files, but only scramble part of each large one, the first chunk, or stripes through it, and rename it so everything looks equally dead.
That means your Word documents and spreadsheets are probably gone without the key. But the big things, the SQL databases, the virtual machine disks, the backup archives, the file server's video and design files, are often mostly intact underneath. ScanCrypt is a free, open-source tool that measures exactly that: it scans an encrypted file, maps which bytes were actually touched, and tells you what percentage is still readable. It can then pull those bytes back out. No key needed, because the data it recovers was never locked in the first place.
Instead of telling your boss "it's all gone, they want $500k", you can say "78% of our data, including the finance database, is recoverable for free, here is the report." That is a very different meeting.
Copy the encrypted files you care about most to a spare drive or a clean machine, and work there. ScanCrypt itself only ever reads (it never writes to the file it scans, and proves it with before-and-after checksums), but a golden rule of any recovery is that the originals stay untouched until the incident is fully understood.
Grab scancrypt-gui.exe from the
releases page on a
machine that was not infected. It is a single portable file, nothing to install, and it
works completely offline, so you can move it across on a USB stick to an isolated network.
Open the tool and point it at the thing that matters most: the database file, the VM disk, the backup archive. In under a minute you get a verdict: a recoverable percentage and a colour map of the file, green for readable, red for encrypted.
The command-line version can sweep an entire folder tree and roll it up into one figure with a per-file list:
That report is a single HTML file you can email to management, your insurer, or a responder. It states its limits honestly and never overclaims.
Your most important data usually lives inside a virtual machine disk (a
.vhdx, .vhd, or .vmdk) or a database file. Ransomware
often wrecks a VM disk's header so it won't even mount, but ScanCrypt rebuilds it from the
parts that survived and lists the files inside, then copies out the ones you choose, names
and folders intact. Point it at the encrypted VM disk, click Extract files from
volume, and pick an empty destination. It will tell you honestly if part of the disk
could not be read.
For files the scan marks as mostly intact, ScanCrypt can extract the readable bytes to a new file. Understand what you get: a video plays with a corrupt patch, a database usually needs a repair or rebuild step before it opens (ScanCrypt can check a recovered SQL Server database page by page so you know what you have), and a file that was 40% encrypted may not be usable at all. The scan tells you where you stand; extraction is where you may want experienced hands.
Healthy paranoia. You have just been burned by hostile software, so here is exactly what you are running:
It never writes to the file or disk it scans, and records before-and-after SHA-256 checksums so you can prove the evidence was not altered.
No account, no upload, no phone-home. Your data never leaves the machine you run it on.
Apache 2.0 licensed. Every line of code is public on GitHub for you or your security team to inspect.
Built and maintained by IronSights, an Australian cyber security firm, as a community tool. The scan and the recovery features cost nothing.
Run the scan yourself, always. But consider professional help when there are no usable backups and the recoverable data is business-critical, when a recovered database will not open, when you need the incident investigated properly (how they got in matters as much as the files), or when insurers and lawyers need defensible forensic reporting.
IronSights, the team behind ScanCrypt, does this for a living: incident response, full extraction, database rebuilds, and the reporting that goes with it. The tool stays free either way.
Stuck on the tool itself — it will not run, or you are not sure what the output means? That help is free too: email support@scancrypt.org or open a GitHub issue.