Hello,
I am trying to recover a web dedicated server after all files have been deleted because of a hack. The website was in WordPress and I need to recover the whole directory /home/web/www
When I recover the files (600k files) I found that names of the files have been changed (for example, it became f1522512.JPG), also the name of the directory. Is there anyway to recover with the same old structure
Files lost thier names after recovery
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
recuperation
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Files lost thier names after recovery
You used Photorec which is the recovery program of last resort that comes at a price of loosing file names and folder information.
Please use Testdisk first.
Please use Testdisk first.
Re: Files lost thier names after recovery
Actually I used testdisk
-
recuperation
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Files lost thier names after recovery
In that case the attacker changed your files so that they resemble the Photorec naming convention.
If this is an individual hack you won't be able to restore the original file names.
If this is an ransomware attack, you sometimes find descriptions on the net how to deal with some known encrypting attacks.
Otherwise I do not see a chance for file name and folder name recovery.
If this is an individual hack you won't be able to restore the original file names.
If this is an ransomware attack, you sometimes find descriptions on the net how to deal with some known encrypting attacks.
Otherwise I do not see a chance for file name and folder name recovery.