2

There is a virus that my brother got in his computer and what that virus did was to rename almost all files in his computer. It changed the file extensions as well. so a file that might have been named picture.jpg was renamed to kjfks.doc for example.

so what I have done in order to solve this problem is:

remove all file extensions from files. (I use a recursive method to search for all files in a directory and as I go through the files I remove the extension)

now the files do not have an extension. the files now look like:

enter image description here

I think this file names are stored in a local database created by the virus and if I purchase the anti virus they will be renamed back to their original name.

since my brother created a backup I selected the files that had a creation date latter than when my brother performed the backup. so I have placed that files in a directory.

I am not interested in getting the right extension as long as I can see the content of the file. for example, I will scan each file and if it has text inside I know it will have a .txt extension. maybe it was a .html or .css extension I will not be able to know that I know.

I belive that all pdf files should have something in common. or doc files should also have something in common. How can I figure what the most common types (pdf, doc, docx, png, jpg, etc) files have in common)

Edit:

I know it will probably take less time to go over all this 200 files and test each one instead of creating this program. it is just that I am curios to see if it will be possible to get the file extension.

Improve this question
0

3 Answers 3

Reset to default
5

In unix, you can use file to determine the type of file. There is also a port for windows and you can obviously write a script (batch, powershell, etc.) or C# program to automate this.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

I don't know why I took the long run maybe because it was interesting. But why to reinvent the wheel. I downloaded the executable from the second link you provided. I am having a hard time passing the parameters that I need. I also have not been able to find an example on how to use the file.exe . a short example will be helpful
4

First, congratulate your brother on doing a backup. Many people don't, and are absolutely wiped out by these problems.

You're going to have to do a lot of research, I'm afraid, but you're on the right track.

Open each file with a TextReader or a BinaryReader and examine the headers. Most of them are detectable.

For instance: Every PDF starts with "%PDF-" and then its version number. Just look at those first 5 characters. If it's "%PDF-", then put a PDF on the filename and move on.

Similarly: "ÿØÿà..JFIF" for JPEG's, "[InternetShortcut]" for URL shortcuts, "L...........À......Fƒ" for regular shortcuts (the "." is a zero/null, BTW)

ZIPs / Compressed directories start with {0x50}{0x4B]{0x03}{0x04}{0x14}, and you should be aware that Office 2007/2010 documents are really ZIPs with XML files inside of them.

You'll have to do some digging as you find each type, but you should be able to write something to establish most of the file types.

You'll have to write some recursion to work through directories, but you can eliminate any file with no extension.

BTW - A great tool to help pwith this is HxD: http://www.mh-nexus.de/ It's what I used to pull this answer together!

Good luck!

Improve this answer

Comments

3

"most common types" each have it's own format and most of them have some magic bytes at the fixed position near beginning of the file. You can detect most of formats quite easily. Even HTML, XML, .CSS and similar text files can be detected by analyzing their beginning. But it will take some time to write an application that will guess the format. For some types (such as ODF format or JAR format, which are built on top of regular ZIPs) you will be also able to detect this format.

But ... Can it be that there exists such application on the market? I guess you can find something if you search, cause the task is not as tricky as it initially seems to be.

Improve this answer

1 Comment

that is interesting. I will analyze the first 100 bytes of several common files and try to see if there is a pattern. If that program does not exist I will try to create it!

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.