User avatar
Jared
Forum Admin
Posts: 3584
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Virus Adjusts all File Sizes to 16 Kb

Mon Feb 16, 2015 5:28 pm

Anyone ever seen this before. It seems that a virus went and adjusted all the file sizes in the file table to be the same exact size:

Image

And do you know of an easy way to fix it without manually setting the values or having to resort to RAW recovery?

User avatar
Jared
Forum Admin
Posts: 3584
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: Virus Adjusts all File Sizes to 16384

Tue Feb 17, 2015 10:13 am

This is a really strange case... all the file starts appear to be where they should be, but the sizes are all set to 16Kb rendering them all useless. It's like it was a chkdisk process gone wrong or something. Though the customer swears it was a virus. I can find all the files in RAW it seems, so it's definitely not Cryptolocker or anything like that (not encrypted).

But I just can't think of any method to link the files found in RAW with the file start locations... any ideas?

User avatar
DRUG
Data Recovery Noob
Posts: 28
Joined: Wed Apr 13, 2016 8:01 pm
Location: Porto, Portugal
Contact: Website Skype

Virus Adjusts all File Sizes to 16 Kb

Wed Apr 13, 2016 8:38 pm

I don't want to advertise, but I've had a similar issue in the past. R-STUDIO, GDB and some others were all showing me this. Then I tested with DMDE and all the data had the correct size!

Return to “Cyber Security & Malware”

Who is online

Users browsing this forum: No registered users and 0 guests