As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS.
Is it possible to use a bootable recovery OS to recover wannacry encrypted files?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityAs I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS.
Is it possible to use a bootable recovery OS to recover wannacry encrypted files?
The short answer is no. There is some analysis on ransomwaree back then. Ransomware indeed think ahead of undelete tools.
Perhaps you mistaken it with system run under virtual machine (e.g. VM snapshot) ; intrusion monitoring system (that also take snapshot of the machine state or files from time to time, like tripwire, OSSEC); version control system, etc.
As tested in here:
No matter if you have lots of free storage.
File history probably won't work too.