Ransomware infections have been going around for some time now and they have been spreading at an alarming rate. What is interesting is that during the past few years we have also seen ransomware viruses designed to attack Mac systems as well. While some of the viruses like thePadlock virus were from the screenlocker type, some viruses, like KeRanger we have also detected to directly encrypt the files on the Macs that were compromised. In this article we aim to explain in detail how you can deal with ransomware viruses for Macs and how you can try and recover your files if you have not made a backup.
How Does a Mac Ransomware Virus Encrypt Your Files
Encryption by theory is basically the process of enciphering data so that only users with access can unlock and read this data. This means that when a ransomware virus infects your Mac, it will run a set of scripts and processes that will attack the file structure of your files. Usually, there are a lot of encryption algorithms and they have evolved over the past few years, but the main ones in use by ransomware viruses are RSA (rivest-shamir adleman) and AES(advanced encryption standard) algorithms. They aim to either overwrite the file or delete it and create it’s encrypted copy on the victim’s compuer. Then, the ransomware virus creates a decryption key which is either a symmetric key or a private key. The newest trend with ransomware viruses nowadays is to use combination of several encryption algorithms to make decryption this more difficult. For more info on how ransomware encryption works, you can check the following article underneath:
How to Try and Recover Encrypted Files on Your Mac (Methods)
After we have explained to you what encryption is, now it is time to explain what options do you have to get them to work once again. In the accordion below, we have created different methods that aim to help you by explaining what you can do to try and recover your files. To lift your hope, we will say that based on the type of virus which demolished your files and on the situation at hand, you may recover all your files, but do not raise your hopes that high, because you may also not be able to recover your data. And before you begin reading about the decryption methods underneath, we recommend that you try and use the method that is most appropriate for your situation. Let’s start!
|Method||By using Apple Time Machine|
|Appropriate Situation||When you have setup Time Machine.|
Step 1: Open Time Machine by clicking on the refresh icon on the top right and clicking on “Enter Time Machine”.
Step 2: Either navigate to previous versions of your Mac in different time or choose a restore point from the bars on the bottom right, next to the navigation arrows:
Step 3: Select a file, you want to restore by marking it with your mouse. Use the bottom-right arrows to select the date from which you want to restore it. After you have done this, click on the Restore button on the bottom right of your screen and the files will automatically restore: