How to recover files encrypted by GandCrab ransomware?

by Jake Doe - -
12

Question

Issue: How to recover files encrypted by GandCrab ransomware?

My computer was infected by GandCrab ransomware. How can I restore encrypted files?

Solved Answer

GandCrab is a file-encrypting virus that was noticed spreading at the beginning of 2018 via Rig and GrandSoft exploit kits.[1] This malicious program uses a strong encryption algorithm and adds .GDCB file extension to the targeted data. As a result victim of ransomware cannot open their documents, audio or video files.

However, cyber criminals offer a chance to recover files encrypted by GandCrab. Following data encryption, ransomware creates a ransom note in GDCB-DECRYPT.txt file where victims are asked to pay 1.54 DASH[2] ($1126) in exchange for ransomware decryptor.

Paying the ransom is not the safest and most reliable method to get back access to your files.[3] The purpose of ransomware is to swindle the money from computers users. It means that once they receive a ransom, their goal is achieved. Data recovery remains only the matter of their conscience.

Unfortunately, malware researchers haven’t created an official and safe to use decryptor. Currently, full data recovery is possible only if you have backups. If you have never backed up your data, you can try alternative tools and methods that might help to recover at least some of the files encrypted by GrandCrab ransomware.

recover files encrypted by GandCrab ransomware

Recover your files after GandCrab virus attack

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

Before proceeding to data recovery, you have to remove GandCrab from the computer. While malware resides on the system, your files might be encrypted every time you reboot the PC. Therefore, use Reimage or another malware removal tool to get rid of the virus and try the methods presented below.

Option 1. Use backups

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

Using backups is the only way to restore files encrypted by GandCrab ransomware fully. Once your computer is virus-free, plug in the external drive or connect to the cloud storage and copy needed data to the PC.

Option 2. Try Data Recovery Pro

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

If you do not have backups, you can take advantage of Data Recovery Pro. This tool is created for recovering files after system wreckage or accidental deletion. However, it also helps victims of ransomware to recover some of the lost files too. Follow these steps to get and use this tool:

  1. Download Data Recovery Pro.
  2. Double-click on the executable and follow installation instructions on the screen.
  3. After the installation, run the program and start the system scan. It will find encrypted files and recovers them.

Option 3. Use ShadowExplorer

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

If GandCrab did not delete Shadow Volume Copies of the targeted files, you should try ShadowExplorer for data recovery. This tool could recover files only if shadow copies were left on the system.

  1. Download ShadowExplorer from the official website
  2. Follow the installation guide and install the program.
  3. After the installation, open the program.
  4. In the top left corner, you should see a drop-down menu. Expand it and choose one of the available point-in-time shadow copies.
    Expand the drop-down menu
  5. Right-click on the file or folder and choose Export.
    Choose Export option
  6. Select the folder where you want to save recovered files and click OK.
  7. Wait until the program finishes data recovery.

Option 4. Take advantage of Windows Previous Versions feature

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

This method allows accessing and copying individual files that were saved on the computer before ransomware attack. By following the steps provided below, you can restore individual files. Therefore, this method is suitable only if you need to recover the most important files.

Note. This method requires having System Restore function enabled before GandCrab hijack. Otherwise, you won’t be able to take advantage of this Windows feature.

  1. Right-click on the file or folder you want to restore.
  2. Click Properties and navigate to Previous versions tab.
    Choore Restore Previous Versions option
  3. Check copies of the file in Folder versions section and select its version you want to recover.
  4. Click Restore.

    Restore encrypted file

If none of the previous methods helped to recover files encrypted by GandCrab, you should be patient. Backup encoded files and wait until the official decryptor is released.

Recover files and other system components automatically

To recover your files and other system components, you can use free guides by ugetfix.com experts. However, if you feel that you are not experienced enough to implement the whole recovery process yourself, we recommend using recovery solutions listed below. We have tested each of these programs and their effectiveness for you, so all you need to do is to let these tools do all the work.

Offer
We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software you agree to our privacy policy and agreement of use.
do it now!
Download
recovery software Happiness
Guarantee
do it now!
Download
recovery software Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
Do you have any trouble?
If you are having problems related to Reimage, you can reach our tech experts to ask them for help. The more details you provide, the better solution they will provide you.
Reimage - a patented specialized Windows repair program. It will diagnose your damaged PC. It will scan all System Files, DLLs and Registry Keys that have been damaged by security threats.Reimage - a patented specialized Mac OS X repair program. It will diagnose your damaged computer. It will scan all System Files and Registry Keys that have been damaged by security threats.
This patented repair process uses a database of 25 million components that can replace any damaged or missing file on user's computer.
To repair damaged system, you have to purchase the licensed version of Reimage malware removal tool.
Press mentions on Reimage

About the author

Jake Doe
Jake Doe - Computer technology geek

Jake Doe is a News Editor at Ugetfix. Since he met Ugnius Kiguolis in 2003, they both launched several projects that spread awareness about cybercrimes, malware, and other computer-related problems.

Contact Jake Doe
About the company Esolutions

References

What you can add more about the problem: "How to recover files encrypted by GandCrab ransomware?"