Zero size files

[pclab]

Hi Guys

I'm working on a drive here (a WD USB), that the issue is some reading problems on head 3.
After mapping the files/folders with Data Extractor, I imaged everything without any major problems.
But when analyzing the results, I can see that many files have 0 size.... These files didn't gave me any problems imaging...
Do you have any ideas??

Thanks

 

[lcoughey]

I recently encountered a NAS recovery where ransomware from a workstation, edited files and wrote them back with no data before deleting them. Is it possible to be the case for this? Though, it is odd that the dates showing are quite old.

 

[pclab]

HI Luke

I don't think that was the problem. The client's problem was that the drive was not being recognized (because of that problematic head 3)...

 

[Jared]

I've seen this happen twice, where a ton of files were suddenly 0 byte size for no explainable reason. But, I think both of those cases were fully functioning drives and some poorly coded program just went haywire on the filesystem.

I think both cases were resolved by just scanning the drive in multiple DR software until one found the correct sizes. Give UFSExplorer a try first, I think that's the one that helped my cases.

 

[pclab]

So, an update.
After calling the client, she said that particular folder was already copied from another bad HDD, so probably it was not well copied.
The data she wanted (and that it's OK), are the photos.
So, case closed :mrgreen:

 

[Pende]

hello I have a similar problem in windows, a client came to me with his head damaged disk, when he changed the head and took out his information I was surprised that his files have an .mzlq extension, I would like to know if someone knows how to view his documents , thanks

 

[pclab]

Those are encrypted files with ransomware.
Try this: https://malwarewarrior.com/how-to-remov ... zlq-files/

 

[Pende]

Hello, I did not come out with those tutorials, and I tried with several forums and nothing in case I attached 2 files maybe they can do it, thanks

https://drive.google.com/drive/folders/ ... sp=sharing

 

[pclab]

You don't have a txt file with the ransom demands?
Post it here, or go here: https://id-ransomware.malwarehunterteam.com/ and see if there's a decrypt tool available.

 

[Pende]

hello not , The hard drive is damaged and only the image and video files have been recovered