As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS.

Is it possible to use a bootable recovery OS to recover wannacry encrypted files?

  • 4
    This is a Q&A site. Half of this post is a request to do some work for you. What's remaining is a question: "is it possible" the answer is "it depends", on a lot of factors.
    – techraf
    May 25, 2017 at 0:50
  • @techraf If you are sure about the dependencies I would glad to give you the right answer. but please consider the real behavior of Wannacry not just guessing.
    – M at
    May 25, 2017 at 1:04
  • 2
    No, I think you misread my comment. I did not try to answer, I explained why I think this question should be closed. Which I already voted for.
    – techraf
    May 25, 2017 at 1:05
  • @techraf As there is no documentation for viruses you can't be sure of the behavior without testing it. As you can see at the answer bellow, I wanted to be sure if the idea works or not. What else can I do ?
    – M at
    May 25, 2017 at 1:08

2 Answers 2


The short answer is no. There is some analysis on ransomwaree back then. Ransomware indeed think ahead of undelete tools.

Perhaps you mistaken it with system run under virtual machine (e.g. VM snapshot) ; intrusion monitoring system (that also take snapshot of the machine state or files from time to time, like tripwire, OSSEC); version control system, etc.

  • Just read about file history and video linked in my answer, I saw lots of viruses that won't overwrite original file and just remove them. But this thing is more advanced.
    – M at
    May 26, 2017 at 17:34

As tested in here:

  • Wannacry overwrites your data.
  • You cannot use recovery applications.

No matter if you have lots of free storage.

File history probably won't work too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .