Recovered .txt Files Have Scrambled Code and Meta Data in Contents.

Page 1 of 2 12 LastLast

  1. Posts : 47
    Windows 10 (64)
       #1

    Recovered .txt Files Have Scrambled Code and Meta Data in Contents.


    I accidentally deleted some .txt and .rtf files from two thumb-drives. I have tried both EaseUse and Lazesoft recovery and both programs managed to retrieve the files with the same results. They all have good names written properly in English. Open them and they have encoded contents! Some of them begin with metadata, and things which have no place in the file (such as the directory folder name they were in or file name and extension; How did that get into the file? ). If they were really damaged data, why are all the hundreds of file names in perfect condition?

    Their content seems to be written in a different language, complete with paragraphs, some sort of computer gobbltyguk. Some of them are partially normal with real English programmer tags < stuff here in English > , and/or metadata inserted before the content continues... as it should, in normal English.

    So... are they really gone? or this an encoding problem? Why do they begin with information that does not belong in them such as their files extensions and real code written in brackets <>.

    Is there some way to decode this back into English?
    hatemf23 said:
    ?{y?U?zUq Uz|_UUi
    - - - Updated - - -

    BTW, the .jpgs are perfect, so... again... is the data really damaged, or is it an encoding problem?

    - - - Updated - - -

    W/5Q5;-=%!57=#15!'=95/=#%!5!'5%=
    /-#)Q-/%!5/=#!#5;-''-!#5;-5#!'--#1!#/5'#5#5=#7!55;-595=577=-'
    /5-)3!%'#5=;'5-5-%'-'
    -#1m#3=9!#5/-7!3/5%!=33-9)575;-5=5-)
    #555=9//=55='573!5#-9%=19!%Ӛe=9/

    If you copy these scrambled bits and paste it in a txt file, you can then open that file in a tool like WinHex or Hex Workshop.
    Need help! Recovering scrambled bits! Forensic Software Forensic Focus Forums
    put these bits in a txt file and open it with WinHEX tool. ... shift one bit to left or to the right .... .... shift 1, 2, until 10 bits to the left or to the right.
    Hmmm..... sounds difficult. Does anyone have experience with this? I'm looking at 18,000 files, God knows how many bits to the side got pushed.

    - - - Updated - - -

    There's got be a program out there that can read binary and detect where the English words are -- right?
    I mean, isn't it like 8 bits is a letter?
    There's got to be a program that says "these bits make words".

    If someone can go make that, I'll wait... I don't mind if it takes 5 years.
    I can hold these drives like my own thumbs! In a way, they kind of are.
      My Computer


  2. Posts : 1,244
    Windows 10 Pro x64 21H2 (Build: 19044.1415)
       #2

    Can you zip up and attach just one file that you think does not contain anything personal or sensitive?
      My Computer


  3. Posts : 47
    Windows 10 (64)
    Thread Starter
       #3

    UPDATE: I'm discovering now, that they have the wrong names. The bits defiantly got pushed. I've got personal stuff in these business tiles.

    and... there is business in all these personal things.

    @zebal apparently not, the titles are... no longer accurate. I'll try to find something but it'd be a guess.
      My Computer


  4. Posts : 1,244
    Windows 10 Pro x64 21H2 (Build: 19044.1415)
       #4

    Good luck with you issue, you'll have to trust someone (or something) to at least diagnose why this happened.
    Apparently you already trusted some programs, so that may be the answer why such things do happen.

    1. It could be bad USB (unlikely because you mentioned 2 sticks)
    2. It could be ransomware (very likely - it encrypts data and ask for payment)
    3. It could be bad encoding such as BOM (less likely)

    Did anyone ask you to pay for recovery?
      My Computer


  5. Posts : 47
    Windows 10 (64)
    Thread Starter
       #5

    Okay, here's two with contents that don't match their titles. These are clear enough to read. https://mega.nz/file/o4lEWR6J#PP29jl...EcsqF89tciyxSs
    https://mega.nz/file/808GnJYL#zfYHgl...s3tGZBWIOg0-B0
    They are not very good examples of the unreadable characters, which I'd be more hesitant to share.

    - - - Updated - - -

    Here's a copy of a note which I'd recently written into a .txt file.
    It now contains only this:

    < x s l : f o r - e a c h s e l e c t = " @ a d v a n c e d - o p t i o n s " >

    < m e t a k e y = " F 8 " a c t i o n = " a d v o p s " / >

    < m e t a k e y = " F 1 0 " a c t i o n = " b o o t o p s " / >

    < / x s l : f o r - e a c h >

    < x s l : f o r - e a c h s e l e c t = " @ n o k e y b o a r d - r e c o v e r y - o e m " >

    < m e t a k e y = " W I N D O W S " a c t i o n = " r e c o v e r o e m " / >

    < / x s l : f o r - e a c h >

    < x s l : f o r - e a c h s e l e c t = " @ k e y b o a r d - r e c o v e r y - o e m " >

    < m e t a k e y = " E S C " a c t i o n = " r e c o v e r o e m " / >

    < / x s l : f o r - e a c h >


    - - - Updated - - -

    zebal said:
    Did anyone ask you to pay for recovery?
    Nope, just me, and that's free.
      My Computer


  6. Posts : 1,244
    Windows 10 Pro x64 21H2 (Build: 19044.1415)
       #6

    Noninvasive said:
    Okay, here's two with contents that don't match their titles. These are clear enough to read. https://mega.nz/file/o4lEWR6J#PP29jl...EcsqF89tciyxSs
    https://mega.nz/file/808GnJYL#zfYHgl...s3tGZBWIOg0-B0
    They are not very good examples of the unreadable characters, which I'd be more hesitant to share.
    Just to make sure, this are original files? you did not copy/paste text to another file and you did not modify those files in any way?

    Otherwise it would be useless data.
      My Computer


  7. Posts : 47
    Windows 10 (64)
    Thread Starter
       #7

    Here are two more:
    https://mega.nz/file/ZxMR2AJI#HMI1Pv...DNENDfhIF2WpzI
    https://mega.nz/file/lsUxEYZb#7DVB_m...HHhLQuAp-ufWvM
    Both of them have what seems to be recovery computer talk instead of content. The words in the Sumerian one which says:
    "!L!This program cannot be run in DOS mode.
    $ ٙ|||.|. |Rich"
    Those lines appear in another file as well. Incidentally it's a credit card payment file.

    well... I guess it's not, since they've all got the wrong names. Who knows where that went.

    - - - Updated - - -

    I didn't copy past file contents -- that's plagiarism. I right clicked the originals and left clicked "send to >> zip". Megashare encrypts them but I don't think it edits the bits in the zip right?
    Last edited by Noninvasive; 20 Mar 2021 at 10:13.
      My Computer


  8. Posts : 9,794
    Windows 10 Home 64bit Version 21H2
       #8

    Check whether this helps. 3 Ways to Recover Deleted Files from USB Flash Drives [2020] .And this one says "Dont attempt to copy data from the flash drive to a different location because you would most likely only make everything worse."

    Well, I copied two *.txt files to a 32GB FAT32 flash drive.Immediately after deleting the files, I used Glary Utilities to recover the files. Glary Utilities found the deleted files with their original file names but said the files had been overwritten ( how come?). Notwithstanding, I recovered the files copying it to a destination folder on my data drive. When I opened it was all gibberish like in your case.
    Anyway, try the three methods enumerated therein.

    Note: 1. I haven't used Disk Drill anytime.
    2. How to Geek writeup says "
    when you delete a file from a USB flash drive, external solid-state drive, SD card, or another type of solid-state memory, your deleted files sit around in memory and can be recovered." Shows Recuva can recover deleted files. You may try that also. https://www.howtogeek.com/187104/warning-anyone-can-recover-deleted-files-from-your-usb-drives-and-external-ssds/
      My Computer


  9. Posts : 9,794
    Windows 10 Home 64bit Version 21H2
       #9

    TestDisk also recovered the file. But it was all gibberish.
    Recovered .txt Files Have Scrambled Code and Meta Data in Contents.-20-03-2021-21-43-02.jpg
      My Computer


  10. Posts : 1,244
    Windows 10 Pro x64 21H2 (Build: 19044.1415)
       #10

    @Noninvasive
    Sorry for late reply, I just could not find my old projects related to character encodings and similar after searching for some time.. looks like I never made a backup of these.

    Noninvasive said:
    Those lines appear in another file as well. Incidentally it's a credit card payment file.
    I suggest you to remove any files that are too sensitive to share for experimentation, very likely nobody will ever recover them but you never know.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 20:34.
Find Us




Windows 10 Forums