0

I heard about a ransomware virus going around that encrypts only the first 64 kB of a file. If I was infected with this, would it be realistically possible to retrieve my files?

4

Not really. If the files had a very large common header (64kb or more), you might be in luck, else you're essentially trying to guess 64,000 "characters". Assuming the file used only 64 characters (e.g. it was a Base64 encoded file), for example purposes, that would be 64^64000 possibilities. That's a number with over 100,000 digits in.

Given that guessing a 12 character long password is considered "hard", and that only has 64^12 (4,722,366,482,869,645,213,696 - only 22 digits!) possibilities, you can see the issue. Guessing a 64kb "string" is over 4500 times harder, and that's ignoring that files aren't restricted to 64 characters in reality.

In practice, a lot of file types wouldn't require all the bytes to be guessed, but most file headers are much smaller than 64kb, so there will be quite a lot of unknown data even so.

  • I think the index will contain the previous names for the file (not 100% on how Windows does indexing, though), which would allow you to know what type of file it was. That way you could extract whatever relevant information is left. For video or audio, you could likely extract nearly all of it. – forest Nov 29 '17 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.