Page 1 of 1

*.kexjat recovery

Posted: 25 Jun 2019, 09:56
by toiletrunner
I have lost files with kexjat extension.
Those are files encrypted by GrandCrab ransomware.
Can I recover them with photorec?
I have few files left that I haven't lost.

Re: *.kexjat recovery

Posted: 25 Jun 2019, 15:53
by cgrenier
You can always try PhotoRec to recover your lost files but recent cryptolocker usually use a "secure" deletion method that prevent recovery.
Be careful to store the recovered files on a partition different than the source.

Re: *.kexjat recovery

Posted: 26 Jun 2019, 04:09
by toiletrunner
Cryptolocker had encripted my files and puted kexjat extension. In panic I have deleted them and formated hard drive. can I search for files with only thet extension and ignore others. Thing is, that drive that i want to recover is 1TB, but I only have 70GB available for recovered files on the other hard drive.

Re: *.kexjat recovery

Posted: 26 Jun 2019, 06:32
by cgrenier
You can use TestDisk, Advanced, Undelete to recover the files you have deleted.
To try to recover the files deleted by the cryptolocker, use PhotoRec.