none
I am looking for a bulk file re-dater RRS feed

  • Question

  • Hi All,

    A new customer called that is recovering from a ransonware attack. He now has thousands of files with the wrong date on them. He needs all the dates set back to the original.

    He has come up with a away to see the creation date and set it back, but only one at a time.

    Anyone know of a utility to do this in bulk?

    Many thanks,
    -T
    Wednesday, October 16, 2019 6:41 PM

Answers

  • This looks like what the customer needs:

    https://www.infonautics-software.ch/filedatecorrector/

    • Marked as answer by ToddAndMargo3 Friday, October 18, 2019 10:10 PM
    Thursday, October 17, 2019 4:55 PM

All replies

  • BulkFileChanger v1.65

    S.Sengupta,Microsoft MVP Windows and Devices for IT, Windows Insider MVP

    Thursday, October 17, 2019 12:22 AM
  • Given a CSV file named C:\temp\files.csv with contents like this:

    Name,Date
    C:\Temp\file1.txt,01/01/2019 10:10 am
    C:\Temp\xxxxxxxx\file2.txt,01/01/2019 10:10 am

    This Powershell script will change the date.

    $l = import-csv -path C:\temp\files.csv
    $l | foreach {
         $(Get-ChildItem -Path $_.Name).CreationTime = $_.Date
    }

    Thursday, October 17, 2019 1:05 AM
  • BulkFileChanger v1.65
    Maybe I am misreading it, but that look like it will change the date to the same date on everything, not set each back to its individual creation date.
    Thursday, October 17, 2019 4:09 PM
  • Given a CSV file named C:\temp\files.csv with contents like this:

    Name,Date
    C:\Temp\file1.txt,01/01/2019 10:10 am
    C:\Temp\xxxxxxxx\file2.txt,01/01/2019 10:10 am

    This Powershell script will change the date.

    $l = import-csv -path C:\temp\files.csv
    $l | foreach {
         $(Get-ChildItem -Path $_.Name).CreationTime = $_.Date
    }

    The customer need to set each file back to its original creation date
    Thursday, October 17, 2019 4:10 PM
  • This looks like what the customer needs:

    https://www.infonautics-software.ch/filedatecorrector/

    • Marked as answer by ToddAndMargo3 Friday, October 18, 2019 10:10 PM
    Thursday, October 17, 2019 4:55 PM
  • Why doesn't he just restore the files from backup? That should put all of the file dates back. 

    Let me guess..... he paid the ransom because he doesn't have a backup.... 


    • Edited by MotoX80 Thursday, October 17, 2019 11:03 PM
    Thursday, October 17, 2019 10:50 PM
  • Hi,

    Based on my knowledge, the only advice we can provide is to restore from your backup. 

    To correct the file creation date to original, you can try some third-party tools. 

    Best regards. 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, October 18, 2019 7:54 AM
  • Why doesn't he just restore the files from backup? That should put all of the file dates back. 

    Let me guess..... he paid the ransom because he doesn't have a backup.... 


    Do you know how randomware works?

    Friday, October 18, 2019 10:08 PM
  • Hi,

    Based on my knowledge, the only advice we can provide is to restore from your backup. 

    To correct the file creation date to original, you can try some third-party tools. 

    Best regards. 



    He is trying the one I posted

    https://www.infonautics-software.ch/filedatecorrector/

    Friday, October 18, 2019 10:09 PM

  • Do you know how randomware works?

    The ransomware that we got hit with on our file servers encrypted the files and added files/folders that told us that we were screwed and demanded payment. We just deleted the folders and restored from backup. The users lost any data that they had saved between the last backup and the time that they discovered the infection. I'm sure that there are other mechanisms that malware uses, but that is the one that I am most familiar with.    
    Friday, October 18, 2019 11:39 PM

  • Do you know how randomware works?

    The ransomware that we got hit with on our file servers encrypted the files and added files/folders that told us that we were screwed and demanded payment. We just deleted the folders and restored from backup. The users lost any data that they had saved between the last backup and the time that they discovered the infection. I'm sure that there are other mechanisms that malware uses, but that is the one that I am most familiar with.    

    You got extremely lucky the criminals did not encrypt your backup as well, as did happen  to my customer.

    Thank you for the clarification by the way.  I almost reported you as abuse.



    Friday, October 18, 2019 11:44 PM
  • I almost reported you as abuse.



    Luckily for me, there is no option to report me as "lame attempt at being funny". 

    The place I worked at was rather large and the backups were written to tape. We used Commvault for the data centers and BackupExec for remote offices. End users, desktop admins, and file server admins did not have any access to the backup servers. 

    I should also mention that any account that had access to email was not allowed to have administrator access on any server. That was the result of a virus infection years ago where a file server admin clicked on something and the virus zeroed out every Office document on every file server.  I logged on to my desktop as Dave, but for servers I had to RDP as Dave-ADM.

    • Edited by MotoX80 Saturday, October 19, 2019 12:31 AM
    Saturday, October 19, 2019 12:19 AM
  • I almost reported you as abuse.



    Luckily for me, there is no option to report me as "lame attempt at being funny". 

    The place I worked at was rather large and the backups were written to tape. We used Commvault for the data centers and BackupExec for remote offices. End users, desktop admins, and file server admins did not have any access to the backup servers. 

    His was a USB Stick and as luck would have and 6000 U$D later, that was the one night her forgot the pull the stick out after the backup.

    On one of my other customers, I have backing up to an internal FTP server. And to mess with the criminals minds even more, I have it so I can set it to write only if I want.  (You have to first read to encrypt.)

    Other customers, I have set to write to a hidden partition.

    This customer only became a customer after the ransomware attack

    Saturday, October 19, 2019 12:32 AM