There is some points that I don't understand yet about ransomwares :
- the attacker generally put his bitcoin address in the malware, can this address be used to identify and reach him ?
- on the assumption that the malware use symmetric encryption, can we use reverse engineering to retrieve the key ?
- on the assumption that the malware use asymmetric encryption, can we use the server which deliver the decryption key after payment to reach the attacker ?
- as far as I know practically the files themselves aren't encrypted, but another file is created using the secret key then the original file is deleted, so can we use a file recovery program to recover everything ?