What evidence may show file encryption?¶
The practical answer¶
File encryption should be supported by evidence that files were transformed so they could no longer be used normally without the relevant key or recovery process.
The key evidential caution¶
The dangerous assumption is that changed extensions or inaccessible files prove ransomware encryption.
They may not.
Files can become unavailable because of corruption, permission change, deletion, storage failure or application error.
Relevant evidence¶
Useful evidence may include:
Key points¶
- changed file content
- new extensions
- encryption process activity
- mass file modification
- ransomware notes
- key or configuration artefacts
- security detections
- system and application errors
- comparison with known good copies
- specialist analysis
What investigators should establish¶
Investigators should identify:
Key points¶
- which files were affected
- when changes began
- which process performed them
- which account context applied
- whether the process completed
- whether some files were skipped
- whether backups or replicas were also affected
Evidential limits¶
Do not assume that every changed file was encrypted by the same process.
Likewise, a malware sample being capable of encryption does not prove it encrypted these files.
Preserve representative encrypted files and known good originals where available.
Do not alter the affected data unnecessarily during recovery attempts.
Where recovery tools alter encrypted files, preserve representative originals first. Later decryption success may confirm the encryption method, but failed recovery does not by itself prove the files are permanently unrecoverable or that the offender’s claimed decryptor would work.
File extension changes should be treated cautiously. Some ransomware changes extensions consistently, while other incidents leave original names or affect only selected file types. The underlying content and process evidence are more reliable than appearance alone.
Operational takeaway¶
Prove encryption through file change, process and timing evidence, and distinguish encryption from corruption, deletion, permission change and general unavailability.