)Does anyone know if the ransomware encryption encrypts the file to a new file, then deletes the old one (giving me the possibility of deleted file recovery)? If so, what software is recommend for an Windows NTFS system (so far, Recuva and R-Studio have found squat).
I am surprised it encrypted the entire drive. Everything I have read, or been told it involved the user files. I have never heard of a single instance where the victim was able to recover their files without the key. I have read about people who pay up but still don't get the key which didn't surprise me. Even large companies, hospitals, and government agencies have been unable to overcome this, and usually pay up. I bet a lot of IT employees loose there jobs over being so unprepared to deal with this.
2)If he decides to pay the ransom and take his chances, what are legit sites to purchase bitcoin (never done that before)?
I have read that the ransom note often tells the victim how to go about getting and transferring bit coin. Which make a lot of sense given that bit coin is so esoteric and most of the victims are naive about basic PC stuff. I have also heard of bit coin machines in places like NYC.There are legit banking sites on line to do this... I would Google it. I understand that I think it is Citibank that now deals with bitcoin.
Sorry I don't have the answers you are looking for and too bad they can't put these criminals in prison.... for a very long time.
