LockBit Rescue

At a glance

• Editor score
  7.2 / 10
• Pricing
  Free plan
• Best for
  Linux users with eligible LockBit 3.0 files
• Free plan
  Yes
• Paid from
  Free
• Supported strains
  LockBit 3.0 (Black); CriptomanGizmo
• Facts checked
  5 Oct 2026

• Where it wins

  • Groups files by RSA-encrypted key fingerprint to target recovery.
  • Can resume interrupted runs by skipping files already on disk.
  • Verifies recovered files using libmagic.

• Where it doesn't

  • Supports only Linux x86_64.
  • Recovery is limited to eligible LockBit 3.0 (Black) and CriptomanGizmo files.
  • Recovery depends on filename lengths and encrypted-batch conditions.

Our verdict on LockBit Rescue

LockBit Rescue is a free, open-source command-line toolkit for attempting to recover files encrypted by LockBit 3.0 (Black), including the variant it calls CriptomanGizmo. It is aimed at Linux x86_64 users who can work with command-line setup and have an encrypted batch that meets the tool’s recovery conditions. Rather than requiring attackers’ private keys, it uses a documented keystream-reuse weakness to recover a subset of files. That narrow scope makes it a fit for people dealing with these supported strains, not a general-purpose ransomware recovery tool.

Its recovery process groups files by RSA-encrypted key fingerprint, then uses the longest-named file in a group as a known-plaintext oracle. If the footer data fits the recovered keystream, the tool can decrypt eligible files in that group. It automatically detects the ransomware’s random nine-character file extension, and command-line options cover extension and size filters, scratch location, and timeout. Runs can resume by skipping files already on disk, while libmagic is used to verify recovered files. These features provide control over scanning and recovery, but eligibility depends on filename lengths and batch conditions; files outside eligible groups may remain unrecoverable.

The project is free and MIT-licensed, with no paid tiers described. Deployment is self-hosted, and Linux x86_64 is the supported operating system, so Windows or macOS users should look elsewhere. LockBit Rescue makes most sense when the strain and files match its limited recovery method and a command-line workflow is acceptable. It should not be treated as a guarantee that an encrypted batch can be restored: its own method recovers only eligible files. For other ransomware strains or files that do not meet those conditions, a broader recovery option is more appropriate.

Your product? Our editors can test LockBit Rescue in depth and publish a review, labelled as paid · from $149/mo →

LockBit Rescue pricing

LockBit Rescue fact sheet

Alternatives to LockBit Rescue

• ADAvast Decryption ToolsA free collection of strain-specific Windows tools, with coverage limited to supported variants.9.3
• TMTrend Micro Ransomware File DecryptorA free Windows decryptor with broad family coverage, but recovery depends on the infection.9.1
• KRKaspersky RakhniDecryptorA broad free decryptor with drive scanning and command-line recovery controls.9.0

See all LockBit Rescue alternatives →

Featured on iTechGuides

LockBit Rescue is listed in our Ransomware Decryption Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/lockbit-rescue/"><img src="https://www.itechguides.com/best/badge/lockbit-rescue.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 29 Oct 2026 · How we research and update