Encrypted file ? Corrupted file ?

[Chess]

All:

I have a friends thumb drive where he is trying to recover his taxes, and a few other items.

I have never seen this before, but I figured I'd ask.

I can access all the data on the drive and copy it to my local drive.
The problem is every file has a dot at the end.
i.e. img001▪.jpg

the ▪ is at the end of every file name.

I thought it may have some encryption so I asked him, he said no, it just stopped working one day. Just very strange... I figured I'd ask here...

 

[mikeymikec]

If you get a command prompt up and get a directory listing on the folder, can you copy and paste the output here?

 

[VirtualLarry]

Cryptolocker-type variant maybe?

 

[Chess]

Cryptolocker-type variant maybe?

@VirtualLarry a bud of mine mentioned that...

@mikeymikec what do you want me to copy and paste.. yeah man I can pull up CMD prmpt, i did a chkdsk as well... said everything is fine... let me get a screenshot

 

[Chess]

https://www.dropbox.com/s/x5yo752qvzpqlu3/dot file name.png?dl=0

 

[mikeymikec]

In the case of your latest screenshot, the dot is at the end of the file name. What happens if you remove the dot, can you open the file then?

 

[mikeymikec]

That 1KB file is a bit suspicious though, there's no chance on the planet that it's a valid spreadsheet. The fact that both files have the exact same modify date makes me think that VL is right, but my previous suggestion won't hurt in any case, just rename it back when you're done if it doesn't work (copy the original filename to the clipboard or a notepad file to assist undo'ing my suggestion).

 

[Chess]

Well i just was able to open an excel file...

Looks like the company he was at encrypted it with EPO........

Looks like there is no way around that since he just left 2 weeks ago... DOH