I'm looking for a tool to identify which files have been encrypted, by scanning a possibly contaminated hard drive installed in a newly formatted computer which was not the one originally infected. I think I managed to catch Cryptowall before it encrypted my whole computer, luckily I have several terabytes of storage. Also all my primary drives (C:, scratch drive, etc) are SSD's which I think saturated my serial controller and prevented Cryptowall from getting to my storage drives I don't care about them I'll just nuke them with Dban or parted magic. I currently have my storage drives removed and installed in a clean computer I'm looking for a way to find which files are encrypted. I'm already running Malwarebytes trying to find any remnants of Cryptowall 3.0 To give you the backstory, I installed a windows update yesterday evening. When I turned my computer back on I was prompted with the Cryptowall 3.0 ransom message, I quickly disable my internet connection and powered down the system. I don't know how the virus got onto my system, prior to installing the windows update I was streaming internet radio from 8tracks, but I did not check any emails, or download any files so I'm unsure of how the virus was acquired or activated.
