Virus Adjusts all File Sizes to 16 Kb

[Jared]

Anyone ever seen this before. It seems that a virus went and adjusted all the file sizes in the file table to be the same exact size:

And do you know of an easy way to fix it without manually setting the values or having to resort to RAW recovery?

 

[Jared]

This is a really strange case... all the file starts appear to be where they should be, but the sizes are all set to 16Kb rendering them all useless. It's like it was a chkdisk process gone wrong or something. Though the customer swears it was a virus. I can find all the files in RAW it seems, so it's definitely not Cryptolocker or anything like that (not encrypted).

But I just can't think of any method to link the files found in RAW with the file start locations... any ideas?

 

[DRUG]

I don't want to advertise, but I've had a similar issue in the past. R-STUDIO, GDB and some others were all showing me this. Then I tested with DMDE and all the data had the correct size!