A few days ago a friend brought me her laptop, with her files/documents seriously messed up.
She broke up with her boyfriend 2 weeks ago and he took it badly.
It wasn’t after he had left that she realized her laptop was still in his apartment.
He returned the laptop 3 days later, but meanwhile he had messed with it.
Apparently he knew (or guessed) her password and had some “fun”.
All her documents/pictures/videos in My Documents/My Videos/My Pictures have been renamed to (random) 10-character names and the file-extensions removed.
All files have also been moved in a single folder (called “Fuck you”) inside My Documents and the original folder-structure has been deleted.
For good measure the PowerShell script he used (it was still sitting in the Downloads folder, so I could read through it and see what it had done) also scanned the whole C: drive for any other .DOC?, .XLS? and .PDF files and gave them the same treatment.
Last but not least: Her My Documents was under OneDrive control and the script deleted all online files in OneDrive and then let the new mess sync to OneDrive.
Unfortunately the OneDrive copy was her only backup…
I realize the filenames can’t be recovered, but just getting the file-extensions restored would be a life-saver for her.
At least she can then separate pictures, videos and documents.
Especially getting the Word, Excel and PDF files identified is important, as she needs some of those to do her taxes, which are due in a few weeks.
Doing it by hand (e.g. using the file command in Linux or macOS, or a hex-editor to identify the file-type) is a daunting task as there are about 40,000 files (about 90% pictures).
Does anyone have a means of doing this quickly and mostly automated?
If there is (for some document types) a method of retrieving the internal document-name (e.g the title of a Word document) and change the filename accordingly that would also be of interest.
I have Windows, macOS and Linux systems at my disposal.
