Free tool · Open source · Built by IronSights
Read back the data the ransomware never touched.
Ransomware is in a race. Encrypting terabytes takes hours, so to finish before anyone notices it scrambles only part of each large file, then renames everything so it all looks equally dead. It usually isn't.
ScanCrypt measures exactly which bytes survived and pulls them back out. No decryption key, no ransom. We built it for our own recovery work, and we gave it away so that a business without an incident response retainer gets the same answer we would give a client.
Apache 2.0 · Windows & macOS · read-only · runs fully offline · no signup
Example scan. No real client case is shown.
Why it exists
The first question a victim asks had no answer.
When ransomware hits, the question is never academic. It is how much can I get back right now, and it gets asked in the hours when someone is deciding whether to pay.
Nothing answered it. No More Ransom and ID Ransomware name the strain and hand over a decryptor if a key exists, and usually one does not. Ordinary file carvers know nothing about ransomware, so they trip over the encrypted regions and carve garbage. Recovery firms do the work properly, by hand, slowly, and at a price that assumes you can afford them.
So an organisation with no retainer and a failed backup gets told everything is gone, and pays a criminal for a key it may never receive. In our experience that assessment is often just wrong. We have watched a business database and a domain controller come back from a Makop attack without paying and without breaking the encryption, because most of the data was still sitting there.
ScanCrypt is that technique, packaged so anyone can run it. It replaces “everything is gone” with a number somebody has actually measured, before the pressure to pay sets in.
The longer version of why we open-sourced it rather than keeping it in-house: We built a ransomware recovery tool, then gave it away →
The engagement it came out of is documented in full, including the validation discipline that separates a real recovery from one that quietly hands back the wrong data: Reading Around Ransomware →
“73% of your data, including the database, comes back for free.” An evidenced figure changes the conversation.
Especially the one where someone is about to wire a ransom.
What it actually does
Four steps, and it never writes a single byte.
Map what was actually encrypted
It measures where the encryption starts and stops, down to the byte. On a 100 GB file that often means a sliver at the front and everything else untouched. The whole file had been written off as lost.
Tell scrambled from simply compressed
Encrypted and compressed data both look like noise. Getting that wrong means writing off data that was never encrypted at all, so ScanCrypt tests the difference rather than guessing.
Give you a number
One figure for a file, or one figure across an entire share, with a per-file breakdown you can hand to your insurer. It is a measurement, not a promise.
Get the data back out
It copies files out of a virtual disk with their names and folders intact, even when ransomware wrecked the disk header and nothing will mount it. Recovered databases get a structural integrity check before anyone relies on them.
An app, not a command line
Point it at the file. Click Scan.
You do not need to touch a terminal. Download one file, double-click it, and choose the encrypted file, folder, or disk. It shows you how much is recoverable as a colour map, then pulls the readable files back out.
It reads Hyper-V and VMware virtual disks and copies your files out with their names and folders intact, even when the disk will not mount because the ransomware wrecked its header. There is a command-line version for responders who want to script it, but most people never need it.
New to this? Start hereRunning without Administrator rights: files and disk images scan fine. A raw drive needs an elevated launch.
Rebuilding the disk from its surviving block map… done.
98.6% of this virtual disk is recoverable (137 GB of 140 GB)
This is a virtual disk (.vhdx). ScanCrypt can read the files straight out of it, even if it will not mount. Best next step: click Extract files from volume and choose an empty destination folder.
Ransomware family: Makop / Phobos, confirmed (matched on footer_magic, extension)
Disk type: dynamic VHDX, 140 GB, header encrypted, rebuilt from surviving BAT
Filesystem: NTFS volume found, 138 files ≥ 1 MB
Illustration with example data. No real case is shown.
If you do not have an IR team on retainer
The work you would otherwise be paying someone else to do.
These are the jobs that normally mean engaging a specialist recovery firm at a day rate, because the tools that do them are not the ones sitting on your workstation.
Your VM will not mount. It reads the files out anyway.
Ransomware often wrecks the header of a virtual disk, so Hyper-V or VMware refuse to open it and you get told the disk is gone. ScanCrypt rebuilds the disk from the block map that survived and copies your files straight out of the NTFS volume, names and folders intact. VHDX, VHD and VMDK. If you only need three files, name them and it pulls just those.
Find out whether the database you recovered is any good.
Getting a database file back is not the same as getting a working database. ScanCrypt checks a recovered SQL Server file page by page and tells you how many pages are valid and what it thinks you are holding, so nobody discovers the problem after the restore.
One number for the entire share.
Point it at a whole encrypted share and get a single incident-wide figure, with a per-file breakdown as CSV or a standalone HTML report. That is the thing your insurer, your board or your client actually asks for.
Fast enough to use while you are still triaging.
A 300 GB virtual disk is measured in seconds, because finding the encryption boundary does not mean reading the whole disk. Scan the things that matter first and still be answering questions in the first hour.
Is it safe to trust a free tool right now?
Fair question, in the middle of the worst week of your year.
Read-only, always
It never writes to the file or disk it scans, and it proves it: the hash before the scan matches the hash after. Your evidence is unchanged.
Fully offline
No account, no upload, no phone-home. Carry it on a USB stick to an isolated machine. Your data never leaves the room.
Open source
Apache 2.0. Every line is public, every release is built automatically from that public source, and every download ships with a checksum.
Built for an evidence chain
Hash-chained, tamper-evident audit logs with case and examiner fields, so a scan holds up in the same workflow a DFIR handler already runs.
Strains that leave data behind
It names the family, and sets expectations.
Recovery itself does not depend on the identification: a wrong or unknown family guess never changes what comes back. Naming the strain only tells you what to expect. Families matched against a real sample are marked as confirmed; the rest come from public threat reporting, and the report says so.
confirmed against a real sample. the rest come from public reporting.
Honest limits
What it will not do.
When someone is frightened and out of options, the last thing they need is a tool that flatters them. ScanCrypt would rather hand you a disappointing number than a hopeful one, so recoverability is reported as most, not all, with the measured percentage, and a partial file list is flagged as partial instead of passed off as complete.
- It is not decryption. It recovers bytes that were never encrypted; the rest stays locked.
- Recovery is most, not all. You get a measured figure, never a promise that every file opens.
- Small files are usually encrypted end to end. The value is in the big ones: databases, VM disks, backups, media.
- Some encryption patterns recover far less cleanly than others, and the report says which one you have.
- No warranty, no liability. Authorised systems only.
Free to download, nothing to sign up for
Take it. It costs nothing and it owes us nothing.
ScanCrypt is offered as a free community resource, aligned with the work of the No More Ransom project. The methodology and the signatures are open to read, reuse and improve. Use it on your own incident or on a client's. Put it in your responder kit and never think about us again. We do not want a referral for it.
And whatever the scan says: do not pay the ransom. Payment is never a guarantee your files come back, and every payment funds the group to go after the next victim.
Windows & macOS · single portable file · nothing to install · code-signed · every release ships with a checksum
Common questions
Asked by people mid-incident.
Not in this list? Call 1300 004 766. If you are in the middle of an incident, say so and you will not wait.
Is it really free, or is there a catch?
It is free. Apache 2.0 licensed, with no account and no trial period. We are not even asking for a referral. We built it for our own recovery work and decided more people should have it than just our clients.
Will it decrypt my files?
No, and nothing else will either unless a key has been published for your strain. ScanCrypt does something different. It finds the parts of your files the ransomware never got to and copies those out, which on a large database or virtual disk is often most of the file.
My Hyper-V or VMware disk will not mount any more. Is that recoverable?
Often, yes, and this is the thing ScanCrypt is best at. Ransomware tends to encrypt the front of a virtual disk, which is where the header lives, so the hypervisor refuses to open it and the disk looks like a total loss. The data behind that header is usually untouched. ScanCrypt rebuilds the disk from the block map that survived and copies the files out of the NTFS volume with their names and folder structure, which means you can hand them straight back to the application that needs them.
Is it safe to run on the server that was hit?
It only ever reads. It never writes to the file or disk it scans, and it hashes the input before and after so you can prove nothing changed. It also runs completely offline. Where you can, work from copies rather than originals, which is good practice whatever tool you use.
How much of my data will actually come back?
That depends on the strain and the size of your files, which is why the tool measures it instead of guessing. Big files tend to do well, because the attacker was in a hurry. Small files are usually encrypted end to end and come back with nothing. You will see a real percentage rather than somebody's estimate.
Do I need to be technical to run it?
No. Download one file, double-click it, and pick the file or folder you want checked. There is a command-line version for responders who want to script it, and you can safely ignore that.
Windows warned me when I opened it. Is that normal?
Yes, for any new release. The Windows builds have been code-signed with a DigiCert certificate since v1.0.1, but SmartScreen keeps flagging software until enough people have downloaded it. Click More info, then Run anyway. If you would rather check for yourself, every release is built automatically from the public source by GitHub Actions and ships with a SHA-256 checksum.
Can my IT provider use it, even if they compete with you?
Please do. Take it and use it on your own clients. If it stops one of them paying a ransom, that is the whole point of having written it.
The scan says a lot is recoverable. Should I still pay?
No. A ransom payment buys a promise from the people who just attacked you, and plenty of victims pay and still do not get their data back. If you are in this position right now, talk to us or to the ACSC before you decide anything. You may also have reporting obligations that do not disappear because the incident was handled quietly.
What does IronSights get out of this?
Some goodwill, and occasionally a phone call. What people actually hire us for is everything after the scan: proving the recovered data is correct, and working out how the attacker got in.
The scan is the easy part
It says your data is recoverable. Want it handled?
Getting the number is free and always will be. Turning it into a restore you can actually trust, and working out how they got in, is the part people call us for.