restore virus corrupted photos

Using PhotoRec to recover lost data
Post Reply
Message
Author
herrdeh
Posts: 2
Joined: 23 Dec 2015, 17:07

restore virus corrupted photos

#1 Post by herrdeh » 23 Dec 2015, 17:26

Hello everybody,

I dear friend of mine - an artist - lost a big amount of photos due to some sort of malware.
Some day, these photos could no longer be displayed by any image viewer, such as gimp, imagemagick, eog etc, and there were text files which said that all these files were 128bit encrypted and she has to visit a certain web page to "purchase them free".
Image viewers throw a message like "Error interpreting jpg file - not a jpg file: starts with 0x4e0x1e"

Here are some samples (of course won't view in browser - must be 2saved as...):
http://verkehrsplanung.com/corrupted_te ... 04_008.jpg
http://verkehrsplanung.com/corrupted_te ... 04_009.jpg
http://verkehrsplanung.com/corrupted_te ... 04_010.jpg
http://verkehrsplanung.com/corrupted_te ... 04_011.jpg

There were backups - but the hard disk in question appeared to be broken... )-:

She asked me for help. My guess is that, that the files were not encrypted, but the jpeg header may have been altered, so image viewers can no longer interpret the image file. But hopefully the jpeg "payload" still is there...

Can photorec / testdisk do something on that problem? - A simple run recovered a lot of pictures, but not the corrupted ones, a run with deleting the corrupted ones first failed as well.

I found this link:
http://www.dpreview.com/forums/post/10291113

but couldnt get along with Hex editors under linux.

Any hints - and other ideas are highly welcome.

Cheers,
Wolf

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3464
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: restore virus corrupted photos

#2 Post by cgrenier » 24 Dec 2015, 14:48

The file is really encrypted, both header and footer are altered.If you know the exact version of the crypolocker trojan, maybe the antivirus editor have reversed the encryption and found how to decrypt them.

herrdeh
Posts: 2
Joined: 23 Dec 2015, 17:07

Re: restore virus corrupted photos

#3 Post by herrdeh » 24 Dec 2015, 20:54

Thank you so much.

I found this page:
https://www.decryptcryptolocker.com/
but I feel, these files are lost forever...

Merry Christmas,
wolf

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests