cgsecurity.org

Hi,

I have been, sadly, hit by Qlocker ransomware on my QNAP NAS since January.
Unfortunately, I only found out a week ago as I was away during covid months for remote work.

I have run photorec through Qrescue to recover my files as per some of the user guides however, I realised that none of my ARW files have been retrieved. I had hundreds.
For clarity, ARW is Sony's proprietary raw image file.

I can see in https://www.cgsecurity.org/wiki/File_Fo ... y_PhotoRec that RAW is supported.
So, perhaps I'm doing something wrong or Qrescue isn't using the right format?

Can you please advise. I'm not technical at all but have friends who help me on this.

Thanks

Make sure that you have selected the "tif" family. In QPhotorec 7.2 WIP it is enabled by default.

recuperation wrote: 16 May 2022, 07:13 Make sure that you have selected the "tif" family. In QPhotorec 7.2 WIP it is enabled by default.

Many thanks for your reply.

I don't remember being given a choice of what to enable?
I run Photorec from within Qrescue which is what QNAP recommends on their guide.

Is there a better option?

I am not familiar with the QNAP version of Photorec.
The original Photorec software has a menu where you can enable or disable file format families.

recuperation wrote: 17 May 2022, 21:39 I am not familiar with the QNAP version of Photorec.
The original Photorec software has a menu where you can enable or disable file format families.

I managed to find that Qrescue uses photorec 7.2 WIP.
So, it is the right version. (No menu on Qrescue/photorec for sure)

However, from an initial investigation - no ARW file has been recovered.
I have thousands of recovered files of all sorts just, no ARW (which makes for a big proportion of the data I had prior to the attack).

Any logical explanation or assumptions as to why that would be the case?

Many thanks in advance

Try to open up the tiff files that have been recovered.