Shipwreck Saturday: What It Actually Does and How to Use It
Shipwreck Saturday is a PowerShell-based tool designed to test whether your systems can survive a ransomware-style attack. It was created by security researcher Brian M. as a way to simulate the most disruptive parts of a ransomware event without actually encrypting anything in a destructive way. The tool doesn't use real encryption algorithms. It simply locks access to files using a method that makes them unusable until a specific recovery step is performed.
The general workflow is straightforward. You run the script against a target system or folder structure, it scans for files, applies a locking mechanism, drops a ransom note, and then waits for someone to follow the recovery steps to restore access. This gives you a realistic picture of how quickly your team can detect, respond, and recover from a simulated attack.
Shipwreck Saturday Download and Setup
You can find Shipwreck Saturday on GitHub under the original repository. The typical download involves cloning or extracting the PowerShell script, reviewing it before running anything, and then executing it against a controlled environment. I cannot recommend running this on production systems without explicit authorization and careful planning.
When I first set this up in a lab environment, I hit an issue where the script failed to lock files that were in use by active processes. This is a known edge case. The workaround is straightforward: identify which services or applications have open handles on the target files, stop or redirect those services temporarily, and then run the script again. Running it with elevated privileges also helps, though it is not a guarantee that all files will be locked. The script specifically looks for file locking mechanisms that work at the Windows API level, and any application holding a lock will block that operation.
The script itself is readable enough that you can understand exactly what it does before you execute it. That is one of the advantages over actual ransomware tools. You can trace through the code, verify there is no data destruction beyond the locking behavior, and confirm the recovery process will restore access cleanly.
How the Tool Works Under the Hood
Shipwreck Saturday uses a combination of Windows API calls to make files inaccessible. It does not scramble or overwrite data. Instead, it locks files in a way that prevents normal read and write operations, then generates a ransom note instructing the victim on how to recover. The recovery typically involves deleting the lock state and restoring normal file access, which is why testing recovery procedures matters more than testing the lock itself.
One thing beginners often miss is that the tool is not limited to local file systems. You can point it at network shares, mapped drives, and certain cloud-synced folders. This is useful for testing how widespread the impact could be, but it also means you need to be extremely careful about scope. A misconfigured path could affect systems you did not intend to touch.
Another nuance that many people overlook is the detection aspect. Most endpoint protection solutions will flag Shipwreck Saturday almost immediately because the behavior pattern matches known ransomware indicators. If your goal is to test detection capabilities rather than just recovery, you may need to adjust execution policies, use alternative execution methods, or coordinate with your security operations team to ensure alerts are generated and triaged properly. Without that coordination, the test is less valuable because you are only measuring whether you can recover, not whether you can detect.
Practical Considerations
Running Shipwreck Saturday typically takes anywhere from 10 to 45 minutes depending on the volume of files and the speed of the underlying storage. Locking a folder with tens of thousands of small files will take longer than locking a handful of large ones. The ransom note generation is nearly instantaneous. Recovery time varies based on how your environment is set up. If you have proper backups and tested restoration procedures, recovery can take minutes. If you are improvising, it can take hours.
The main limitations of this tool are fairly obvious. It only works on Windows systems. It does not simulate encryption, which means it cannot test whether your backup encryption or immutable storage is adequate against real ransomware. It also does not cover lateral movement, persistence mechanisms, or data exfiltration, which are all critical components of modern ransomware attacks. A shipwreck simulation using this tool is a narrow slice of the overall problem.
For teams that want a more comprehensive test, combining Shipwreck Saturday with other simulation tools like Caldera, Cylance Ransomware Simulation, or custom PowerShell scripts that cover multiple attack stages is the more realistic approach. But if you need something quick, focused, and easy to understand, Shipwreck Saturday serves its purpose well within its constraints.
The recovery steps are simple enough that anyone on your team should be able to follow them. The real value is not in the tool itself but in the process it forces you to go through: detecting the lock, identifying the scope, communicating the incident, and restoring access from known good sources. That is where the actual learning happens, not in the script output.
