Recover renamed files

[vonronge]

My 8 year old has ruined my day.

He denies it, but someone renamed all the files and folders on my data drive with a utility. I think he was trying to rename mp3's.

Now, I know there must be a way to recover the filetypes. The files I am after are mostly excel files and excel addons, the rest I can get from backups.

So, I have recursive files and folders, some of which are my files, all of which are named something like disc*/rockaby baby*.mp3
How do I find the 10 or so excel files I need?

Any help will be appreciated.

 

[Mohammad Basem]

Hi vonronge,

A starting point could be testing the header of each file to see whether it’s an Excel workbook or not.

Hereunder, the 1st 14 bytes (values in hexadecimal) of some Excel workbooks.

.XLS
D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00

.XLSX, .XLSM, .XLSB
50 4B 03 04 14 00 06 00 08 00 00 00 21 00

Hope this will help.

 

[vonronge]

Thank you Mahammad

I think I figured out a way, but it is a real pain. I am recursively extracting all files on the drive with 7-Zip, and searching for the normal excel file contents. This will lead me down a long path, but I should find them.

 

[Mohammad Basem]

Hi vonronge,

You may use this macro…it is simple and might narrow the scope of your search.

I found that it returns DOCX files as well—it seems the same header.

Specify the name of folder (Bold) you want to search and run it. The found files will be printed in the immediate window.

Good luck!

[FONT=Consolas][SIZE=2][COLOR=Navy]Sub FileType()
 
   Const sFOLDER As String = "[B][B]C:\Users\MBA\Desktop\[/B][/B]"
   Const sOLD_XL As String = "D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00"
   Const sNEW_XL As String = "50 4B 03 04 14 00 06 00 08 00 00 00 21 00"
 
   Dim iFileNumber As Integer
   Dim sFile As String
   Dim bHeader(13) As Byte
   Dim sExcel() As String
   Dim bCount As Byte
 
   sFile = Dir(sFOLDER & "*.*")
 
   While sFile <> ""
      iFileNumber = FreeFile
      Open sFOLDER & sFile For Random Access Read As #iFileNumber Len = 14
      Get #iFileNumber, , bHeader
      Close #iFileNumber
      [COLOR=Green]'[/COLOR]
      [COLOR=Green]' Test for .xls[/COLOR]
      sExcel = Split(sOLD_XL, " ")
      For bCount = 0 To 13
         If Format(Hex(bHeader(bCount)), "00") <> sExcel(bCount) Then Exit For
      Next bCount
      If bCount = 14 Then Debug.Print sFile
      [COLOR=Green]'[/COLOR]
      [COLOR=Green]' Test for .xls?[/COLOR]
      sExcel = Split(sNEW_XL, " ")
      For bCount = 0 To 13
         If Format(Hex(bHeader(bCount)), "00") <> sExcel(bCount) Then Exit For
      Next bCount
      If bCount = 14 Then Debug.Print sFile
      sFile = Dir()
   Wend
 
End Sub[/COLOR][/SIZE][/FONT]

 

[vonronge]

O Sweet, that works a dream!