*.kexjat recovery

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
toiletrunner
Posts: 2
Joined: 25 Jun 2019, 06:33

*.kexjat recovery

#1 Post by toiletrunner » 25 Jun 2019, 09:56

I have lost files with kexjat extension.
Those are files encrypted by GrandCrab ransomware.
Can I recover them with photorec?
I have few files left that I haven't lost.

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 4995
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: *.kexjat recovery

#2 Post by cgrenier » 25 Jun 2019, 15:53

You can always try PhotoRec to recover your lost files but recent cryptolocker usually use a "secure" deletion method that prevent recovery.
Be careful to store the recovered files on a partition different than the source.

toiletrunner
Posts: 2
Joined: 25 Jun 2019, 06:33

Re: *.kexjat recovery

#3 Post by toiletrunner » 26 Jun 2019, 04:09

Cryptolocker had encripted my files and puted kexjat extension. In panic I have deleted them and formated hard drive. can I search for files with only thet extension and ignore others. Thing is, that drive that i want to recover is 1TB, but I only have 70GB available for recovered files on the other hard drive.

User avatar
cgrenier
Site Admin
Posts: 4995
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: *.kexjat recovery

#4 Post by cgrenier » 26 Jun 2019, 06:32

You can use TestDisk, Advanced, Undelete to recover the files you have deleted.
To try to recover the files deleted by the cryptolocker, use PhotoRec.

Post Reply