ENTROPY TRIAGE: A METHOD TO REPAIR FILES CORRUPTED BY FAILED RANSOMWARE ENCRYPTION

Summary from the TLDR InfoSec newsletter

Sometimes after an organization pays a ransom and receives a decryptor, the decryption process may still fail due to the encryption process failing or being interrupted. Researchers from MOXFIVE have developed a technique called entropy triage that processes each block of a file by comparing the Shannon entropy before and after decryption and writing the lower entropy block to disk. MOXFIVE has had success with this method but notes that it requires skilled cryptographers and data to be sufficiently encrypted or decrypted for the analysis.