white-phoenix¶

Category: IR

Homepage: https://github.com/cyberark/White-Phoenix

Vendor: CyberArk

License: Apache License 2.0

Source: Python

Profiles: Full, Basic

File Extensions: .encrypted, .locked, .enc

Tags: ransomware, encryption, decryption, forensics, data-recovery

White-Phoenix is a tool that recovers content from files encrypted by Ransomware using intermittent encryption. It is designed to help incident responders and forensic analysts to retrieve data from encrypted files when the decryption key is not available.