Description

JpegMedic ARWE

JpegMedic ARWE is a tool for 100% automatic batch recovery of JPG files partially encrypted by ransomware. The utility is a small brother of JpegMedic, a professional tool to recover damaged JPG files. JpegMedic recover JPG images encrypted by ransomware too, but it offers more control and more recovery features compared with JpegMedic ARWE.

Ransomware is a type of malware that encrypts some of your crucial files and then ransoms for money to decrypt them. The type and amount of damages to a file caused by encryption depend on what ransomware did it. However, many types of ransomware widespread in the wilderness today only encrypt the beginning of a file. Supposedly, they do it to speed up the encryption of the system. While for many files such damage would be critical, JPG files can be recovered with JpegMedic ARWE.

JpegMedic ARWE has two basic file recovery modes. The first one requires one non-damaged JPG file created by the same camera with the same settings as damaged images. Then, with quantization tables, Huffman tables and other technical parameters borrowed from the healthy file the program attempts to recover the non-encrypted part of the encrypted file. The second mode does not require a correct file. Instead, it uses complex heuristic algorithms to identify technical parameters of the image. This method is able to recover non-encrypted part of the encrypted file completely automatically. The drawback of the second mode is its relatively low operation speed. However, no matter which method you choose, you end up with a restored image that only lacks a few first lines and has slightly different gamma.

Also, JpegMedic ARWE can be used to extract JPG thumbnails from encrypted RAW files created by modern digital cameras. The size of such JPG files is comparable with the size of the photograph. If the beginning of the thumbnail is partially encrypted, such thumbnail can be restored using the same principles as for a regular JPG file. That is, you need one correct RAW file created by the same camera with the same settings as the damaged RAW file. The program was tested with the following types of RAW files: 3FR, ARW, CR2, CR3, CRW, DNG, NEF, NRW, ORF, PEF, PTX, RAF, RAW, RW2, RWL, SR2, SRF, X3F.

Currently, there is no complete list of ransomware that only encrypts the beginning of a file. JpegMedic ARWE was tested and successfully recovered JPG files with the following extensions after encryption:

If you managed to recover JPG files with other additional extensions using the program, please let us know about that and we will add this information to the list. This will allow other users to quickly find a solution if their system will also fall a victim to some ransomware.

If you do not see the file extension of the encrypted file in the list, and JpegMedic ARWE produces an error message if you attempt to recover such a file, you can send to us several samples of encrypted files. We will analyze them and if possible will add the support for such files to the program. Please don’t forget to send us a correct non-encrypted file created by the same camera with the same settings because it is required to analyze the encrypted image.

Some ransomware encrypt not only the beginning of the file, but also fragments in the middle and in the end of the file. This makes automatic recovery of such files impossible. But in some specific cases you still can attempt to recover such files manually. Modern cameras can add to the JPG files additional thumbnails in a relatively good resolution. Such thumbnails are written after the main image to the same file. And ransomware encrypts the beginning and the middle of the original image plus the end of the thumbnail. So the original image can be manually recovered using JpegMedic by merging non-damaged parts of the main image and the thumbnail. Unfortunately, such recovery is more of an art than of a craft, so it hardly can be automated. For more information about non-standard recovery, please refer to the.