Issue: How to recover files encrypted by GandCrab ransomware?
My computer was infected by GandCrab ransomware. How can I restore encrypted files?
GandCrab is a file-encrypting virus that was noticed spreading at the beginning of 2018 via Rig and GrandSoft exploit kits. This malicious program uses a strong encryption algorithm and adds .GDCB file extension to the targeted data. As a result victim of ransomware cannot open their documents, audio or video files.
However, cyber criminals offer a chance to recover files encrypted by GandCrab. Following data encryption, ransomware creates a ransom note in GDCB-DECRYPT.txt file where victims are asked to pay 1.54 DASH ($1126) in exchange for ransomware decryptor.
Paying the ransom is not the safest and most reliable method to get back access to your files. The purpose of ransomware is to swindle the money from computers users. It means that once they receive a ransom, their goal is achieved. Data recovery remains only the matter of their conscience.
Unfortunately, malware researchers haven’t created an official and safe to use decryptor. Currently, full data recovery is possible only if you have backups. If you have never backed up your data, you can try alternative tools and methods that might help to recover at least some of the files encrypted by GrandCrab ransomware.
Recover your files after GandCrab virus attack
Before proceeding to data recovery, you have to remove GandCrab from the computer. While malware resides on the system, your files might be encrypted every time you reboot the PC. Therefore, use Reimage or another malware removal tool to get rid of the virus and try the methods presented below.
Option 1. Use backups
Using backups is the only way to restore files encrypted by GandCrab ransomware fully. Once your computer is virus-free, plug in the external drive or connect to the cloud storage and copy needed data to the PC.
Option 2. Try Data Recovery Pro
If you do not have backups, you can take advantage of Data Recovery Pro. This tool is created for recovering files after system wreckage or accidental deletion. However, it also helps victims of ransomware to recover some of the lost files too. Follow these steps to get and use this tool:
- Download Data Recovery Pro.
- Double-click on the executable and follow installation instructions on the screen.
- After the installation, run the program and start the system scan. It will find encrypted files and recovers them.
Option 3. Use ShadowExplorer
If GandCrab did not delete Shadow Volume Copies of the targeted files, you should try ShadowExplorer for data recovery. This tool could recover files only if shadow copies were left on the system.
- Download ShadowExplorer from the official website.
- Follow the installation guide and install the program.
- After the installation, open the program.
- In the top left corner, you should see a drop-down menu. Expand it and choose one of the available point-in-time shadow copies.
- Right-click on the file or folder and choose Export.
- Select the folder where you want to save recovered files and click OK.
- Wait until the program finishes data recovery.
Option 4. Take advantage of Windows Previous Versions feature
This method allows accessing and copying individual files that were saved on the computer before ransomware attack. By following the steps provided below, you can restore individual files. Therefore, this method is suitable only if you need to recover the most important files.
Note. This method requires having System Restore function enabled before GandCrab hijack. Otherwise, you won’t be able to take advantage of this Windows feature.
- Right-click on the file or folder you want to restore.
- Click Properties and navigate to Previous versions tab.
- Check copies of the file in Folder versions section and select its version you want to recover.
- Click Restore.
If none of the previous methods helped to recover files encrypted by GandCrab, you should be patient. Backup encoded files and wait until the official decryptor is released.
Recover files and other system components automatically
To recover your files and other system components, you can use free guides by ugetfix.com experts. However, if you feel that you are not experienced enough to implement the whole recovery process yourself, we recommend using recovery solutions listed below. We have tested each of these programs and their effectiveness for you, so all you need to do is to let these tools do all the work.