Ransomware identification with limited information

Ransomware identification is crucial to determine if encrypted files can be recovered or decrypted for free. The ransomware executable is often not available for incident responders and even ransom notes may be missing. Which tools and key points can be used to identify the ransomware family correctly?