Hello. I write this in case it can help someone. My computer was infected with this ransomware in 2018. I recovered almost everything thanks to having a backup. But some photos in NEF (Nikon RAW) format of which I did not have a copy were encrypted and I could not recover them.
From time to time I check this forum to see if there is any tool to recover them and I never found anything until recently.
I thought that instead of trying to decrypt them I had to treat them as corrupted files and so I found the solution. I have managed to "recover" those photos thanks to several programs that allow extracting the BMP file that is inside the NEF file despite being encrypted. I don't know how they do it, but it works.
I mention this as it can be useful when trying to recover other types of encrypted files. The applications I use are PixRecovery and Stellar Photo Recovery. I only put their names because I don't want to spam. I am not the creator of those applications and I have nothing to do with them either.
I only put a solution that allowed me to recover some photos encrypted with Dharma and maybe it can be useful to someone or it can open a new path of investigation to try to decrypt files infected by ransomware.
Back to top
