Of course, the tools are not perfect: Data recovery depends on the size of the file and requires access to the plaintext of the first 64 encrypted bytes of the target file. Even so, it’s a big win for victims.

“Whether a file is fully or partially recoverable depends on the size of the file,” researchers wrote. “Files below the size of 5000 bytes cannot be recovered. For files between 5000 bytes and 1GB in size, full recovery is possible. For files larger than 1GB, the first 5000 bytes will be lost but the remainder can be recovered.”

The utilities include resources for analyzing encrypted files and determining whether decryption is possible. Access the Black Basta ransomware decryption tools on Github here.

Black Basta’s encryption methodology is effective, but basic.

The ransomware uses a simple additive cipher, which is implemented properly for the first 5,000 bytes of the file. As SRL explains: 

“The keystream, however, is not advanced properly and the same 64 bytes are used for XORing all the blocks to be encrypted. This can be observed particularly well when looking at encrypted zero-bytes. Those encrypted zero-bytes show the very same pattern. Taking such encrypted zero-bytes and using them to XOR the encrypted chunks allows for a nearly full recovery of the file.”

The first 5,000 bytes of each file are lost — but for virtual disk images and other large files, full recovery may be possible. 

Many ransomware variants do not encrypt the entire file.

For ransomware to be effective, it needs to work quickly; full encryption takes time. Many malware programs simply target the first section of a file (in Black Basta’s case, the first 5,000 bytes). The file is effectively useless, and the victim is compelled to pay.

But this creates opportunities for data recovery, particularly if the attackers implement ciphers incorrectly. 

For victims, open-source decryption tools are generally the best option available for file restoration. Paying ransoms does not guarantee recovery, and in many cases, paying for ransomware is illegal. 

Open-source tools are generally safe, though using them often requires a fairly advanced technical understanding of encryption. We strongly recommend making a complete clone of any target media before attempting decryption (or performing any other logical data recovery process). 

Working with a professional data recovery provider can limit the chances of permanent data loss — and help you restore key systems after a ransomware attack without unnecessary downtime.

Related: Are Ransomware Decryption Tools Safe?

Getting Help with a Ransomware Infection

As a world leader in ransomware remediation, Datarecovery.com provides resources for analyzing infections, restoring key systems from backups/archival copies, and where possible, decrypting the infected files. 

All of our data recovery services are supported by a no data, no charge guarantee: If we’re unable to restore your files, you don’t pay for the attempt. To learn more, call 1-800-237-4200 to speak with a ransomware expert or submit a case online.

The post Black Basta Ransomware: Free Decryption Tools Released appeared first on Datarecovery.com.

The Apple iPhone’s Recovery Mode deletes everything on the device. Deleted data is completely unrecoverable under most circumstances.

Deleted iPhone files are unrecoverable for several reasons:

• File-Based Encryption – The iPhone stores most user files with file-based encryption, which means that every file has a unique encryption key. When iOS deletes data, it deletes the encryption key, which makes the data unusable.There are exceptions, however: For devices operating iOS 12 or earlier, the user’s photos, videos, internet browsing history, and text messages may be recoverable after a typical delete command. However, Recovery Mode isn’t a typical delete command — it essentially reformats the device, restoring it to factory settings.
• Flash Media Engineering – iOS devices use NAND flash, a type of non-volatile memory consisting of transistors arranged into a grid. The transistors hold electrical charges to store data. Read more about solid-state storage here.When data is deleted from flash drives, they’re usually gone forever. NAND flash media uses a garbage collection process to improve efficiency and optimize space. This process clears the charges from the transistors, rendering the data permanently unrecoverable.

Following a full restore to factory settings, data recovery engineers may be able to recover metadata from iPhones and other iOS devices. Metadata is typically used for computer forensics cases to provide a record of phone usage, but it isn’t useful for consumers.

The bottom line: You should only use iOS Recovery Mode if you have a full backup of your device. We strongly recommend reviewing your backup before beginning the process — it’s irreversible. After confirming your backup, you can put your iOS device into Recovery Mode by following this guide from Apple.

Can I recover data from an iPhone before using Recovery Mode?

If your iPhone has become unresponsive or if you’re not able to boot past the iOS logo, your data may be recoverable. This is easiest if your computer recognizes the device: Apple provides a guide for transferring photos and videos from iOS devices to a Mac or PC.

However, if your iPhone is completely unresponsive, your options are limited. Unfortunately, consumer data recovery software is not capable of returning results — recovering the files requires low-level access to the device’s data storage, which isn’t feasible outside of a professional data recovery laboratory.

Typically, iPhone data recovery tools don’t actually access the iPhone’s storage: The software recovers files directly from the user’s iCloud Drive. Of course, you don’t need to pay for extra software to download files from your own iCloud, so we recommend saving your money.

Related: A Guide to Mobile Phone Text Message Recovery

My iPhone is broken, and I don’t have a backup. What do I do?

Don’t put the iPhone into Recovery Mode unless you’re 100% sure that you have a backup. Take the following steps to maximize your chances of a full recovery:

• Gather information about the failure. Does the iPhone boot? Is the touchscreen responsive? What happens when you plug it into your computer?
• Try to make a list of important files or file types. For instance, if you just need your photos and videos, that information could be extremely useful for a data recovery engineer.
• Keep the device turned off. Don’t pay for data recovery software — if your phone runs iOS 13 or later, software will not address the problem.
• Work with an experienced data recovery company. Accessing the data will require advanced logical techniques and specialized hardware, so find a provider with an established reputation.

Datarecovery.com is a world leader in iPhone data recovery, and our no data, no charge guarantee gives you peace of mind as your case progresses. To discuss iPhone recovery, call our team at 1-800-237-4200 or click here to submit a case online.

The post Does Recovery Mode Erase Data on an iPhone? appeared first on Datarecovery.com.