Petya ransomware recovery depends on identifying the exact strain before touching the disk. Some original Petya-family infections had variant-specific recovery research, but NotPetya was built as a destructive attack and does not have a normal pay-and-decrypt path. Isolate the device, preserve a full disk image, and work only on a copy. If the case is NotPetya, a clean rebuild from protected backups is usually safer than experimenting with old decryptors.
Petya or NotPetya: choose the recovery path first
The names are often used interchangeably, even though the recovery decision is very different. Original Petya appeared in 2016 and replaced the Master Boot Record before encrypting the NTFS Master File Table (MFT). The 2017 outbreak commonly called NotPetya reused some of that visual behavior, spread aggressively across networks, and was designed without a dependable victim-specific key delivery process.
- Confirmed original Petya-family variant: Specialist, variant-specific key or MFT recovery may be possible. Preserve the original disk before any attempt.
- Confirmed NotPetya: Do not expect a normal consumer decryptor or working payment path. Prioritize forensic imaging, clean rebuilds, and offline backups.
- Variant is unknown: Treat the disk as evidence. Do not run random repair tools, reinstall Windows, or write a new boot record until the strain is identified.
Petya and NotPetya also belong to a broader ransomware history, but this page focuses on the practical recovery decision rather than the outbreak timeline.
What to do immediately
- Disconnect the computer from wired and wireless networks. On a business network, isolate adjacent systems too. NotPetya used stolen credentials and multiple lateral-movement methods, so one locked workstation may not be the only affected device.
- Photograph the screen and record the time. Capture the exact ransom note, payment address, email, boot message, recent reboot behavior, and any security alerts. Do not type a payment key or download a tool from the note.
- Stop writing to the affected disk. Reinstalling Windows, running CHKDSK, replacing the MBR, or repeatedly booting can overwrite metadata that a recovery specialist needs.
- Create a sector-by-sector image. A qualified technician should image the entire physical disk to separate storage and verify the copy. Keep the original disconnected and unchanged.
- Identify the variant from evidence. Use the ransom-note details, boot behavior, incident date, file hashes, security telemetry, and network indicators. A family name from a screenshot alone is not enough.
Why the MFT matters
The NTFS Master File Table is the index Windows uses to describe files and where their data lives. Petya-style boot malware can make the volume appear empty or unreadable by encrypting MFT records even when much of the underlying file content remains on disk.
This is why an MFT recovery result is not the same thing as a universal ransomware decryptor. Historical research recovered MFT structures and, in controlled cases, portions of file data by deriving keystream bytes from known NTFS patterns. Those techniques depend on the exact variant, disk layout, overwritten sectors, and quality of the preserved image. The public research does not mean that a random script can safely restore every Petya or NotPetya disk.
Never test MFT-repair code against the only copy. If the first sectors, partition metadata, or file content are overwritten, a failed repair can turn partial recovery into permanent loss.
Can a Petya decryptor recover the files?
Possibly, but only after the strain is confirmed. Some early Petya variants had flaws or leaked keys that supported narrow recovery methods. A tool for one build can be useless or destructive against another. NotPetya is different: Microsoft described the 2017 attack as a wiper-like operation with no normal mechanism to generate and deliver individual recovery keys.
Use this test before trusting any decryptor:
- The source is a recognized incident-response team, security researcher, or official project.
- The documentation names the exact Petya variant and the symptoms it supports.
- The tool works on a cloned disk image, not the original evidence drive.
- A small recovered sample can be opened and checked before a broad write operation.
- The download is not a password-protected archive from a forum mirror or an executable promoted through the ransom note.
The same cautious rule applies to other families: check whether a ransomware decryptor really matches the variant before using it, and never assume that removal software can decrypt already damaged files.
Safe Petya and NotPetya recovery steps
1. Preserve the original disk
Make a verified sector image before repair, scanning, or boot changes. If the data is valuable, use a write blocker and document who handled the device. Store the image and its hash separately.
2. Recover to another drive
Mount or analyze the clone from a clean workstation. Export recovered files to new storage. Do not restore files back onto the affected disk and do not attach the original disk to a production network.
3. Validate recovered files
Opening a directory tree is not proof that the data is intact. Test representative documents, databases, archives, images, and application files. Compare hashes with known backups where possible. Quarantine executable files until they have been scanned.
4. Rebuild instead of trusting a repaired boot
Even if a specialist restores access to the volume, reinstall the operating system from trusted media. A repaired MBR or visible desktop does not prove the loader, stolen credentials, scheduled tasks, services, or lateral-movement tools are gone. Destructive malware can also masquerade as ransomware; the difference is explained in this wiper and fake-ransomware example.
5. Restore from protected backups
Choose a backup created before the compromise and test it in an isolated environment. Restore business services in priority order. Do not connect unverified recovered hosts to the same network segment as clean systems.
Rebuild and verify the clean system
After data is preserved, install Windows from trusted media, apply current security updates, and remove legacy SMBv1 where it is still enabled. In a business incident, reset credentials that were active on affected systems, review domain-controller and remote-execution logs, and look for unusual administrative shares or service creation.
Scan recovered files and the rebuilt system before normal use. Gridinsoft Anti-Malware can check for malicious payloads, hidden files, startup entries, scheduled tasks, services, and other persistence that may have accompanied the visible boot infection. It cannot reconstruct encrypted files or guarantee that credentials were not exposed.
After uninstalling the suspicious app or deleting the visible threat, use Gridinsoft Anti-Malware to check hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and other persistence points that can restore malware.
Download Anti-MalwareKeep the restored system isolated until repeated scans are clean, critical applications work, and account or network investigations are complete. If the incident affected more than one host, treat it as a network compromise rather than a single-PC repair.
What not to do
- Do not pay based on the assumption that Petya and NotPetya have a working recovery service.
- Do not run CHKDSK because a fake disk-check screen appeared. The screen can be part of the encryption routine, not a Windows repair process.
- Do not replace the MBR or reinstall Windows before imaging the disk.
- Do not download a “Petya decryptor” from a random mirror, video description, or file-sharing site.
- Do not reconnect a rebuilt machine until recovered files and credentials have been reviewed.
How to reduce the next recovery cost
Maintain offline or immutable backups, test full restores, restrict administrative credentials, segment critical systems, and patch exposed Windows services. Keep recovery media and backup consoles separate from the production domain so a worm-like outbreak cannot disable the tools needed to rebuild. The historical impact of NotPetya is one reason it remains among the most destructive malware outbreaks despite its ransomware-style screen.
FAQ
Is Petya ransomware decryptable?
Some original Petya-family variants had narrow key or MFT recovery methods. That does not apply automatically to every Petya label, and it does not turn NotPetya into normal decryptable ransomware. Identify the exact variant and work from a disk image.
Can CHKDSK repair a Petya-encrypted disk?
No. The apparent disk-check screen used by Petya-style malware can be part of its own encryption process. Running repair utilities against the original disk can overwrite recoverable metadata.
Should I pay the Petya or NotPetya ransom?
Payment does not guarantee recovery. In NotPetya cases, the attack lacked a dependable victim-specific key process, so paying was not a practical recovery method. Preserve evidence and assess backups or specialist recovery instead.
Can antivirus decrypt Petya files?
Antivirus software can detect malicious components and help verify a rebuilt system, but it cannot promise MFT repair or file decryption. Recovery and malware cleanup are separate tasks.
References
- Microsoft Security Intelligence. “Win32/Petya.” Microsoft, published May 19, 2016; updated September 15, 2017; accessed August 21, 2026. Microsoft threat description.
- Mark Simos. “Overview of Petya, a Rapid Cyberattack.” Microsoft Security Blog, February 5, 2018; accessed August 21, 2026. Microsoft attack and recovery overview.
- Sebastian Eschweiler. “How to Decrypt NotPetya & Petya After an Attack.” CrowdStrike Research, July 10, 2017; accessed August 21, 2026. MFT recovery research.
