Recover zero byte files (malware)
Posted: 24 Sep 2016, 23:20
Hello,
I'm not sure which is the best forum on this site for this question, so if another one is better, please point me in the right direction.
Some malware went through 3 hard drives on my computer (5 partitions) and left me with many files that have the same filename, but are zero bytes in size. I don't believe the entire contents were written over on disk, as the program only ran for 18 minutes and due to the number and size of files, I think whatever it did was done with minimal writing. I don't know if that means the files were deleted and then recreated in the same location as empty, or if it modified the cluster chain in such a way that the OS just doesn't know where to find the data, but knows the filename.
1) Is there any option in PhotoRec or TestDisk that will be able to recover these files?
2) Is there any feature in the software (or any other software) that would allow me to manually follow the links and reconstruct the files?
Thanks for any help you can provide. These are family photos and videos as well as many other document files.
David
I'm not sure which is the best forum on this site for this question, so if another one is better, please point me in the right direction.
Some malware went through 3 hard drives on my computer (5 partitions) and left me with many files that have the same filename, but are zero bytes in size. I don't believe the entire contents were written over on disk, as the program only ran for 18 minutes and due to the number and size of files, I think whatever it did was done with minimal writing. I don't know if that means the files were deleted and then recreated in the same location as empty, or if it modified the cluster chain in such a way that the OS just doesn't know where to find the data, but knows the filename.
1) Is there any option in PhotoRec or TestDisk that will be able to recover these files?
2) Is there any feature in the software (or any other software) that would allow me to manually follow the links and reconstruct the files?
Thanks for any help you can provide. These are family photos and videos as well as many other document files.
David