By Ivy / Last update June 10, 2022

How Does Ransomware Encrypt Your Files?

As we all know, once attacked by ransomware, your personal files will be hacked as a hostage for ransom. Generally, there are two ways ransomware will take to hack your important data, by directly encrypting your files or locking your computer screen.

Both ways will result in your files not accessible to you. Yes, your files are still where they are but just can’t be accessed. Thus, you should find a way to get to your files and further decrypt them. Then, how to get to your files? You can create a ransomware rescue disc.

Create Ransomware Rescue Disk

As mentioned above, ransomware steal your files either by directly encrypting them or locking up computer. No matter which way it make use of, you are most likely unable to boot into your Windows operating system and operate your computer. Hence, you need to create a ransomware rescue kit to first boot the failed machine up and then do further rescue to your files.

First of all, to generate a ransomware rescue disk, you should pick up a reliable ransomware protection software free - AOMEI Backupper Free  (especially designed for ransomware), download, install and launch it on a working computer. Also, insert an USB flash drive into the working computer for creating ransomware rescue disc. Then, start creating ransomware rescue kit with it. 

Download FreewareWin 11/10/8.1/8/7/XP
Secure Download

Step 1. It will prompt you about the following window, select “Create Bootable Media”.

Create Bootable Media

Step 2. It will check out whether the current system valid to create ransomware rescue disk or not. If it is, select "Windows PE" and click Next. 

Windows Bootable Disc

Step 3. Tick USB Boot Device option. It’s recommended to create a ransomware rescue USB because USB is convenient for being inserted to the affected computer for rescue data.

Create Bootable USB

Step 4. Click “Next” to make the antivirus rescue USB drive.

After the ransomware rescue disk created successfully and pull out the USB drive.

Get Your Encrypted Files Back

Then just follow the below instructions to get your encrypted files back with antivirus rescue disk (here we take file backup for example):

1. Now, boot the infected computer into the antivirus boot disk, it will isolate the ransomware or virus. When it boots up, AOMEI Backupper will automatically run on your computer.

2. Click Backup tab, and then select File Backup. (or choose system backup, disk backup or partition backup depending on your needs)

File Backup

2. Press Add File or Add Folder to choose the files or folders you want to backup.

Select Files to Backup

3. Click the second box to specify the destination path to receive the file backup image. 

Select Destination

4. Tap Start Backup >> to get your files and folders back with the help of ransomware rescue disk.

Start Backup

With an exact copy of your files, you can choose to restore files from backup on another working computer. You have two ways in the following: 

#1: Directly restore files via Restore tab. You will be asked to select file backup, backup items and destination path, just do as suggested. Finally, click Start Restore. 

Select Folders Files

#2: Use explore image to restore files. Similar to the first, it will ask you to select file backup and backup items, then click Save as and select a path to store your files. The biggest advantages of it is to restore files from other backup images, such as, system backup, disk backup and partition backup. Thus, you don't need to worry about data loss even if you don't have a file backup.

Explore File Backup

★Tips on continuous data protection:

You are a lucky guy if you get the encrpted files back. But if not, you can only pay the ransom, otherwise you will lose them. To avoid this disaster, it's suggested to backup files automatically with the following features, since single backup does not include changes made later.
The Backup Options is capable of commenting, splitting, compress, encrypt the file backup image, enable email or SMS notification, etc. 

AOMEI Email SMS Notification Settings

The Schedule Backup option allows you to backup the files automatically on a regular basis, like daily, weekly, monthly, etc. Among them, the USB plug in is recommended if your target disk is a USB drive and don't want to keep it always connected.

Schedule Settings General

The Backup Scheme options is able to backup only changed files with help of incremental or differential backup. Also, you could choose to delete file backup regularly with one of automatic backup cleanup methods. It's the most effective way to prevent potential issue of schedule backup - backup disk full.

Backup Scheme Cleanup Methods

Conclusion

Create ransomware rescue disk to get encrypted files back is just a part of ransomware rescue plan. And it should only be used as an emergency method because the risks are high.

To minimize data loss risk, it's suggested to backup files daily, weekly, monthly, or based on event trigger or USB plug in. The last one is the easiest way if you want to backup files to USB. And you can set automatic backup cleanup methods to make space for new backups.  Thus, you can easily get your computer back if your computer is infected by ransomware.