Guest Palmbsea Posted July 30, 2007 Posted July 30, 2007 I recently tried to open a document and found that it was filled with symbols looking like a 'y'. I finally determined that I had a large number of similar documents (word, excell, jpegs, publisher files) that were all unreadable. The file names are all ok (e.g. mydoc.doc for a word file). 1. They were scattered in many folders adjacent to readable files. 2. All unreadable files had the modified date of 05/01/2007 3:35 am (any file with another date was readable; any file of any type with this date was not). 3. The word documents of this type were unreadable with 'recovery' software or word's own recovery system. 4. I have had continuously running and updated virus software with daily 'clean' scans. 5. I did a Dell diagnostics on the computer and their extensive hard disk scan - no problems. 6. I do have online back up software but it, unfortunately, backed up the corrupted files since they were "modified." 7. My windows event log doesn't show anything happening at the time of this mass file modification. 8. Though the files (per word) have 1 character, their windows xp explorer size is normal for the file type so I suspect that the contents are still there. Any ideas on what might have happened and how I can recover from this? Thanks!
Guest HeyBub Posted July 30, 2007 Posted July 30, 2007 Re: help - unreadable files with same modified date Palmbsea wrote: > I recently tried to open a document and found that it was filled with > symbols looking like a 'y'. I finally determined that I had a large > number of similar documents (word, excell, jpegs, publisher files) > that were all unreadable. The file names are all ok (e.g. mydoc.doc > for a word file). > > 1. They were scattered in many folders adjacent to readable files. > 2. All unreadable files had the modified date of 05/01/2007 3:35 am > (any > file with another date was readable; any file of any type with this > date was not). > 3. The word documents of this type were unreadable with 'recovery' > software or word's own recovery system. > 4. I have had continuously running and updated virus software with > daily 'clean' scans. > 5. I did a Dell diagnostics on the computer and their extensive hard > disk scan - no problems. > 6. I do have online back up software but it, unfortunately, backed up > the corrupted files since they were "modified." > 7. My windows event log doesn't show anything happening at the time > of this mass file modification. > 8. Though the files (per word) have 1 character, their windows xp > explorer size is normal for the file type so I suspect that the > contents are still there. > > Any ideas on what might have happened and how I can recover from > this? Thanks! The "y" business is, I bet, the best rendition of a hex "FF", that is, all bits on in a byte. This is one method by which files are rendered unreadable, or "wiped." If this is the case, some program has over-written every byte in the file with a binary '1111 1111' to erradicate whatever information was there. If this is the case, your only recourse is retrieval from a backup.
Guest Palmbsea Posted July 31, 2007 Posted July 31, 2007 Re: help - unreadable files with same modified date > The "y" business is, I bet, the best rendition of a hex "FF", that is, all > bits on in a byte. > > This is one method by which files are rendered unreadable, or "wiped." If > this is the case, some program has over-written every byte in the file with > a binary '1111 1111' to erradicate whatever information was there. > > If this is the case, your only recourse is retrieval from a backup. > Unfortunately, I think you are right. I checked...the character, a y with an two dots over it (umlot or something like that) has code '00FF' in the Microsoft Word symbol table. Given I've had no indication of a virus (and daily clean scans), I wonder what did this and how to prevent it from happening again. Thanks for your help! >
Recommended Posts