Return to Answer

That depends.

Supposed that the ransomware is doing a "good" job, all files will be encrypted with something like AES-GCM, which is (at the time of writing) not (known to be) vulnerable to a known plaintext attack.

In that case the files might not aid much, only to verify the correctness of a brute forced key.

Also, if the ransomware is doing a "good" job, the key will differ on a per-machine basis, so brute-forcing the key will not help much to retrieve other data encrypted on another machine by the same ransomware.

That depends.

Supposed that the ransomware is doing a "good" job, all files will be encrypted with something like AES-GCM, which is (at the time of writing) not (known to be) vulnerable to a known plaintext attack.

In that case the files might not aid much, only to verify the correctness of a brute forced key.

Also, if the ransomware is doing a "good" job, the key will differ on a per-machine basis, so brute-forcing the key will not help much to retrieve other data encrypted on another machine by the same ransomware.

That depends.

Supposed the ransomware is doing a "good" job, all files will be encrypted with something like AES-GCM, which is (at the time of writing) not (known to be) vulnarable to a known plaintext attack.

In that case: the files might not aid much, only to verify the correctness of a brute forced key.

Also, if the ransomware is doing a "good" job, the key will differ on a per-machine basis, so brute forcing the key will not help much to retrieve other data encrypted on another machine by the same ransomware.

That depends.

Supposed that the ransomware is doing a "good" job, all files will be encrypted with something like AES-GCM, which is (at the time of writing) not (known to be) vulnerable to a known plaintext attack.

In that case the files might not aid much, only to verify the correctness of a brute forced key.

Also, if the ransomware is doing a "good" job, the key will differ on a per-machine basis, so brute-forcing the key will not help much to retrieve other data encrypted on another machine by the same ransomware.

That depends.

Supposed the ransomware is doing a "good" job, all files will be encrypted with something like AES-GCM, which is (at the time of writing) not (known to be) vulnarable to a known plaintext attack.

In that case: the files might not aid much, only to verify the correctness of a bruto forced key.

Also, if the ransomware is doing a "good" job, the key will differ on a per-machine basis, so brute forcing the key will not help much to retrieve other data encrypted on another machine by the same ransomware.

That depends.

Supposed the ransomware is doing a "good" job, all files will be encrypted with something like AES-GCM, which is (at the time of writing) not (known to be) vulnarable to a known plaintext attack.

In that case: the files might not aid much, only to verify the correctness of a brute forced key.

Also, if the ransomware is doing a "good" job, the key will differ on a per-machine basis, so brute forcing the key will not help much to retrieve other data encrypted on another machine by the same ransomware.