One of my friends was hacked, all of his disk was encrypted. The hackers are requesting money, that obviously we don't want to pay.

I am wondering if it's possible to decrypt everything, given that I have some original backed up files (plaintext) and their encrypted versions.

Is there a way to do it without too much complexity? Or if anyone can help me with this? I can provide both set of encrypted and decrypted files.

  • 2
    No, you can't find the decyption key simply by comparing the 2 versions of the files. At least, not without extreme levels of expertise and a super computer. However, check out nomoreransom.org/en/index.html to see if the key is already known.
    – schroeder
    Nov 23, 2022 at 12:03
  • 2
    What you are describing is known as a 'known plaintext attack'. Modern encryption algorithms (such as those used in ransomware) are designed to be resistant to this type of attack. See en.wikipedia.org/wiki/Known-plaintext_attack for more info.
    – mti2935
    Nov 23, 2022 at 12:37

1 Answer 1


Having a sample of the plaintext allows performing a known-plaintext attack against the underlying cipher. Unfortunately for ransomware victims, the ciphers typically used by attackers, such as AES, are not vulnerable to known-plaintext attacks in any way that matters. If you cannot obtain the key, you're out of luck. You can only use this as a learning experience and keep more backups.

A known-plaintext attack involves an attacker (in this case, you) being given input/output pairs for an unknown key but being unable to feed arbitrary inputs (or outputs) into the cipher. This kind of attack is useful for performing linear cryptanalysis, a powerful attack that can break some ciphers. AES is not vulnerable to linear cryptanalysis. Even if you could adapt inputs arbitrarily based on the outputs, you could perform more powerful differential cryptanalysis, but AES is not vulnerable to that either.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .