Ransomware Corrupt Video Files

[nostalgia]

So this is a weird one folks...

I have a bunch of video files from a computer that was a victim of a ransomware attack. Basically what happen was all files on the computer were encrypted and you have to pay the ransomers to get the decryptor. In a nutshell this particular person paid the ransomers and did receive the decryptor and ran it; some files work post-decryption, others don't. Some of the .mov and .avi files run fine and some won't open like they are corrupt or something? It's totally random.

Since some of the video files are unplayable and some are fine it looks like the decryption process possibly went too fast and I'm hoping maybe just the headers are just damaged?

Has anyone ever encountered this same issue before where post ransomware decrypted files are not working?

Can anyone assist with this?

Many thanks,
J

[LigH.de]

I can imagine that a decrypter may work incorrectly, like having a 2 / 4 GB file size limit, so that short files or files with headers in front seem to work, but files with headers at the end fail, being still encrypted there.

Backups on not permanently attached devices may have saved a lot of money here.

[TomLes]

What are those video files?
If you have multiple files recorded with the same camera/settings I can try and repair a header of one of the corrupted files, just so you know what's the issue.
I will need a corrupted file + a sample video file (playable) shot with the same camera.
You can upload them to Google Drive or other file sharing service and PM me the link.

[nostalgia]

Thanks TomLes, I'll send you a PM as soon as I get some files uploaded.

So apparently I thought I had "good files" after this whole thing but come to find out the ones that actually play don't have audio.

So I guess I don't have any that aren't screwed up but I can give you a new good file scanned on the same film scanner with same settings etc.