12-13-2018, 07:07 PM
Hello,
I don't know if anyone can help but we got hit with Ransomware over the weekend. This has taken out a number of servers and client PC's totalling about 25 hard drives. They have used Diskcryptor to encrypt the all our drives (including all backups, NAS etc).
What we know so far is that the passwords used were only numeric and vary in length from 8 digits to 11 digits. This means that hashcat will be able to find the codes. However our one stumbling block is we do not know how to find the hash from the encrypted drives. We also know they used version 1.1.846.118 of diskencryptor which was the last released in 2014. The source files for this are available on the website.
Any help appreciated as we feel this is the only way forward to retrieve our data and with our rough calcs even an 11 digit number should crack in under 3 days.
Thank you
Ian
I don't know if anyone can help but we got hit with Ransomware over the weekend. This has taken out a number of servers and client PC's totalling about 25 hard drives. They have used Diskcryptor to encrypt the all our drives (including all backups, NAS etc).
What we know so far is that the passwords used were only numeric and vary in length from 8 digits to 11 digits. This means that hashcat will be able to find the codes. However our one stumbling block is we do not know how to find the hash from the encrypted drives. We also know they used version 1.1.846.118 of diskencryptor which was the last released in 2014. The source files for this are available on the website.
Any help appreciated as we feel this is the only way forward to retrieve our data and with our rough calcs even an 11 digit number should crack in under 3 days.
Thank you
Ian