Jigsaw Ransomware Data Recovery

Jigsaw is ransomware that was first seen in the wild in April 2016. It gets its name from the fact that it uses the Jigsaw puzzle piece image as its ransom note. Jigsaw is unique in that it deletes files every hour until the ransom is paid, and also threatens to delete more files if the victim tries to remove the ransomware or kill the process.

Jigsaw Ransomware was updated in November 2016 to include new features such as stealing victims’ data and providing a victim with a “survival kit” of sorts, which includes instructions on how to buy Bitcoin and pay the ransom, as well as links to relevant sites.

What encryption algorithm does it use?

Jigsaw Ransomware, Jigsaw (Updated) Ransomware uses the AES-256 encryption algorithm. This is a strong encryption algorithm that is very difficult to break.

How does Jigsaw Ransomware spread?

Someone typically spread Jigsaw via email attachments or malicious links. The email will often masquerade as being from a legitimate company or organization, and may even use language that suggests urgency or importance (e.g., “Your order has shipped!” or “You’ve been selected for a survey!”). Once the victim clicks on the attachment or link, Jigsaw will begin encrypting their files.

How do I know if I have Jigsaw?

Jigsaw will encrypt your files and append the “.fun” extension to them (e.g., “sample.jpg” would become “sample.jpg.fun”). It will also create a text file named “How_to_back_files.hta” in each folder that contains encrypted files, which contains instructions on how to pay the ransom and decrypt your files.

Ransom amount and payment method

The ransom for Jigsaw is 1 Bitcoin, which is currently worth around $1,000. Jigsaw accepts payments via Bitcoin, GreenDot MoneyPak, and Ukash.

It is important to note that paying the ransom does not guarantee that your files will be decrypted. There have been reports of victims who have paid the ransom but still did not get their files back.

What should you do?

If attackers infected you with Jigsaw Ransomware, it is always advisable to attempt to restore your files from a backup first before considering paying the ransom.

If you do not have a backup, you may be able to use file recovery software to recover some of your deleted files. You can try SalvageData data recovery software.

You should run a trusted antivirus program to remove the ransomware and help protect your computer in the future.

Also, you may want to try using a Jigsaw decryption tool. However, there is no guarantee that this will work and you could end up losing your files permanently if the tool does not work.

Public decryption tool

Emsisoft Jigsaw Decryptor

Instructions:

1. Download and run the Jigsaw decryption tool from the link above.
2. Select the encrypted files you wish to decrypt and click on the “Decrypt” button.
3. The tool will attempt to decrypt your files. If successful, you should now be able to access them again.

If you are still unable to access your files after trying the steps above, then it is likely that they have been permanently lost and you will not be able to recover them. In this case, we advise you to focus on preventing Jigsaw from infecting your computer in the first place by following the tips below.

Prevention tips:

1. Keep your anti-virus and anti-malware software up to date.
2. Do not open email attachments from unknown senders.
3. Do not click on links in emails from unknown senders.
4. Do not download software or files from untrustworthy websites.
5. Back up your important files regularly to an external drive or cloud storage service.

Contact a data recovery service

If you have tried all the steps above and you are still unable to access your files, then you may need to contact a data recovery service. Data recovery services specialize in recovering lost or deleted data, and they may be able to help you recover your Jigsaw-encrypted files.

SalvageData is a reputable data recovery service that offers a free consultation to Jigsaw victims. To learn more, you can visit their website or call 1-888-872-3282.