Monday, 3 January 2011

How I Manually Recovered the Virus Infected Digicam Files

Just this morning, one of my students approached and asked me if can I help to get her Digicam pictures from its memory card back. Without hesitation I asked her back rightaway what has happened and when did it happen. She told me that she has used it earlier and was still able to see the pictures but when her digicam's memory card was plugged in to the other pc, everything that was in the memory card where replaced by folder links. All the files in the memory card where replaced by files with .lnk file extensions indicating that they are link shortcuts. Obviously, the digicam's memory card is virus infected. My student then asked me if can there still be a chance to get her pictures back and I just answered "We'll try".

So I plugged in her memory stick to my computer while pressing the "Shift" key. Pressing the shift key avoids autoruns. Upon checking the contents of her memory card (do not click on the memory card's icon in "My Computer", Use the folder tree at least)I noticed that there where six lnk files with zero bytes of file size. But I checked properties of the memory card , it shows more than 400 MB of used file size out of the total of 2 GB capacity. This is odd, so I checked on for the folder options if there are hidden files but I found none. The other option to check if files are given with attributes is by using the NT Command Prompt.


To Use the NT Command Prompt

1. Press "Win+R" then type in "cmd"

2. Once your are in the command prompt, go to the root directory of your memory card and in my case it's on dive e:. So typed in "e:"

3. It should now display E:\> and type "attrib/s". You should see some files with attributes like "r","a","s","h". If you see such attributes, remove them by typing in "attrib/s -r -a -s -h".

4. Once the attributes are removed, type "dir" to see all files. As I executed this, I found seacao.exe and jauaco.exe. These files are not familiar and just as I suspected. I found out by searching on google that these are worms. So I deleted them by typing in "del seacao.exe,juauco.exe".

5. As I deleted those files, the lnk files still remained and still not pictures found. So I decided to to check each lnk file to be treated as a directory.

6. So I typed in "cd documents.lnk" where "document.lnk" is the name of one of the lnk files. To my surprise, I was able to enter "documents.lnk" directory. So I then checked for possible files by typing in "dir". Then I saw a lot of files with .jpg and .mov file extensions, at last I found them! And so I copied the files by typing in "copy *.* d:" where d: is the directory where I'll be placing the recovered image files so I can format the memory card.

I was then able to format the memory stick and transferred the recovered image files from drive d: back to the newly formatted memory card successfully and returned it its owner. If you feel this method is way too technical for you, you might want to consider using a good software to automatically recover your corrupted digital camera files.

0 comments:

Labels

(Electronics) 2011: 2012: 3.4GHz 400MHz 4x512 AMD's AMD’s ASRock Adapter Alienware Amd processors Analysis Android Angry Announced Announcement Antec Apple Apple's Arctic Arrives Aspire Athlon Audio Battle Benchmarked Biostar Blackberry Blu-ray Bluetooth Bridge Broadband Browser Budget Cache Chromebook Compound Computer Computers) Computex Concept Cooler Corsair Crysis Dell's Design Desktop Desktops Details Devices Diamond Digital Display Download Drive External Extreme Facebook First Fujitsu Fusion Future Galaxy Gaming GeForce Gigabyte HSFPHASECM Honeycomb India Indian Keyboard Keyboards Keypad Kingston LGA1155 LGA1366 LGA775 Laptop Laptops Latitude Leaked Lexmark's Light Llano Logitech M2N-SLI MSI's MSM8660 MacBook Master Medal Media Medion Mini-Review Mobile MotherBoard's Motherboard Motherboards Motorola Mouse Multimedia NC215S NTLDR NVIDIA NVIDIA's National Netbook Netbooks Nexus Nokia Non-ECC Notebooks Offers Optical Optimus Option Overclock Overclocked PC2-5300 PC2-6400 Panda Panel Patriot Pavilion Performance Phone Plans PlayStation Portable Postpaid Power PowerPC Preview Preview: Price Prices ProBook Processor Processors Project Projector Propus Qosmio Quad-Core Qualcomm Quick RadTech Radeon Rates Razer Registry Released Releases Retail Review Review: Reviews Rupees Rupess SDRAM SODIMM Samsung SandForce Sandy Satellite Seagate Select Sensitive Series Series™ Server Shuttle Silent Silicon Silver Single Small Smartphone Smartphones Socket Solar Solid Speakers Specifications Specs Speed Store Super Tablets Tariff Technology Tegra Testing Thermal ThinkPad Thunderbolt Toshiba TouchPad TouchSmart Touchscreen Tower Troubleshooting Tutorial: Ultimate Ultra Update Verizon Vertex ViewSonic Viliv Vista Vodafone Voodoo Western Wi-Drive Wi-Fi WiMax Windows Wireless Workstations: World Writer Xperia Zotac acpi_call all-in-one announces business camera feature features flash iPad iPhone latest launched launches mobiles module nFORCE notebook omnia overview panasonic player release shutdown special tablet takes touch toughbook unveils webOS white www.phoronix.com

About This Blog

Blog Archive

  © Blogger templates The Professional Template by Ourblogtemplates.com 2008

Back to TOP