none
I am looking for a bulk file re-dater RRS feed

  • 问题

  • Hi All,

    A new customer called that is recovering from a ransonware attack. He now has thousands of files with the wrong date on them. He needs all the dates set back to the original.

    He has come up with a away to see the creation date and set it back, but only one at a time.

    Anyone know of a utility to do this in bulk?

    Many thanks,
    -T
    2019年10月16日 18:41

答案

全部回复

  • BulkFileChanger v1.65

    S.Sengupta,Microsoft MVP Windows and Devices for IT, Windows Insider MVP

    2019年10月17日 0:22
  • Given a CSV file named C:\temp\files.csv with contents like this:

    Name,Date
    C:\Temp\file1.txt,01/01/2019 10:10 am
    C:\Temp\xxxxxxxx\file2.txt,01/01/2019 10:10 am

    This Powershell script will change the date.

    $l = import-csv -path C:\temp\files.csv
    $l | foreach {
         $(Get-ChildItem -Path $_.Name).CreationTime = $_.Date
    }

    2019年10月17日 1:05
  • BulkFileChanger v1.65
    Maybe I am misreading it, but that look like it will change the date to the same date on everything, not set each back to its individual creation date.
    2019年10月17日 16:09
  • Given a CSV file named C:\temp\files.csv with contents like this:

    Name,Date
    C:\Temp\file1.txt,01/01/2019 10:10 am
    C:\Temp\xxxxxxxx\file2.txt,01/01/2019 10:10 am

    This Powershell script will change the date.

    $l = import-csv -path C:\temp\files.csv
    $l | foreach {
         $(Get-ChildItem -Path $_.Name).CreationTime = $_.Date
    }

    The customer need to set each file back to its original creation date
    2019年10月17日 16:10
  • This looks like what the customer needs:

    https://www.infonautics-software.ch/filedatecorrector/

    2019年10月17日 16:55
  • Why doesn't he just restore the files from backup? That should put all of the file dates back. 

    Let me guess..... he paid the ransom because he doesn't have a backup.... 


    • 已编辑 MotoX80 2019年10月17日 23:03
    2019年10月17日 22:50
  • Hi,

    Based on my knowledge, the only advice we can provide is to restore from your backup. 

    To correct the file creation date to original, you can try some third-party tools. 

    Best regards. 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    2019年10月18日 7:54
  • Why doesn't he just restore the files from backup? That should put all of the file dates back. 

    Let me guess..... he paid the ransom because he doesn't have a backup.... 


    Do you know how randomware works?

    2019年10月18日 22:08
  • Hi,

    Based on my knowledge, the only advice we can provide is to restore from your backup. 

    To correct the file creation date to original, you can try some third-party tools. 

    Best regards. 



    He is trying the one I posted

    https://www.infonautics-software.ch/filedatecorrector/

    2019年10月18日 22:09

  • Do you know how randomware works?

    The ransomware that we got hit with on our file servers encrypted the files and added files/folders that told us that we were screwed and demanded payment. We just deleted the folders and restored from backup. The users lost any data that they had saved between the last backup and the time that they discovered the infection. I'm sure that there are other mechanisms that malware uses, but that is the one that I am most familiar with.    
    2019年10月18日 23:39

  • Do you know how randomware works?

    The ransomware that we got hit with on our file servers encrypted the files and added files/folders that told us that we were screwed and demanded payment. We just deleted the folders and restored from backup. The users lost any data that they had saved between the last backup and the time that they discovered the infection. I'm sure that there are other mechanisms that malware uses, but that is the one that I am most familiar with.    

    You got extremely lucky the criminals did not encrypt your backup as well, as did happen  to my customer.

    Thank you for the clarification by the way.  I almost reported you as abuse.



    2019年10月18日 23:44
  • I almost reported you as abuse.



    Luckily for me, there is no option to report me as "lame attempt at being funny". 

    The place I worked at was rather large and the backups were written to tape. We used Commvault for the data centers and BackupExec for remote offices. End users, desktop admins, and file server admins did not have any access to the backup servers. 

    I should also mention that any account that had access to email was not allowed to have administrator access on any server. That was the result of a virus infection years ago where a file server admin clicked on something and the virus zeroed out every Office document on every file server.  I logged on to my desktop as Dave, but for servers I had to RDP as Dave-ADM.

    • 已编辑 MotoX80 2019年10月19日 0:31
    2019年10月19日 0:19
  • I almost reported you as abuse.



    Luckily for me, there is no option to report me as "lame attempt at being funny". 

    The place I worked at was rather large and the backups were written to tape. We used Commvault for the data centers and BackupExec for remote offices. End users, desktop admins, and file server admins did not have any access to the backup servers. 

    His was a USB Stick and as luck would have and 6000 U$D later, that was the one night her forgot the pull the stick out after the backup.

    On one of my other customers, I have backing up to an internal FTP server. And to mess with the criminals minds even more, I have it so I can set it to write only if I want.  (You have to first read to encrypt.)

    Other customers, I have set to write to a hidden partition.

    This customer only became a customer after the ransomware attack

    2019年10月19日 0:32