Recovering Files After Ransomware Rewrites Their Headers

Ransomware can damage files in two distinct ways. It may encrypt the contents, or it may rewrite the file signature—the small header that tells Windows or macOS whether an item is a photograph, document, archive or database. When the extension is also changed, a file may look unfamiliar even when some of its original data remains intact.

Recovery is safest when the affected computer is isolated and the original evidence is preserved. Do not rename files repeatedly, run random “decryptors”, or save recovered material back to the same drive. The right approach depends on whether the ransomware used strong encryption, corrupted only the headers, or left usable copies in backups, cloud storage or temporary folders.

What A Changed File Header Means

A file signature, sometimes called a magic number, appears near the beginning of many file types. For example, JPEG images usually begin with specific hexadecimal bytes, while PDF, ZIP and Microsoft Office formats have their own identifying patterns. If ransomware replaces these bytes, ordinary software may report that the file is corrupt or use an incorrect application to open it.

Changing an extension from .docx to a ransom-related suffix is usually cosmetic; changing the internal header is more serious. A photo may still contain much of its image data, but a damaged header can prevent Photos, Preview or image-editing programs from recognising it. Some malware also appends encrypted blocks or truncates the file, making a simple header repair ineffective.

Before testing recovery tools, disconnect the device from Wi-Fi and Ethernet. If other computers on a home network in Sydney, Melbourne or Brisbane share folders, isolate them as well. Keep a copy of several affected files and the ransom note on an external drive for analysis, while avoiding any action that modifies the originals.

Identify The Ransomware And Preserve Evidence

Record the changed extension, ransom-note wording, contact addresses, file names and the approximate time the incident began. A reputable ransomware identification service or an Australian incident-response provider may match these clues to a known family. The Australian Cyber Security Centre also provides reporting and guidance for individuals and organisations affected by cybercrime.

Do not pay before checking whether a legitimate decryptor exists. Payment does not guarantee a working key, and some operators deliver malware disguised as a recovery program. If the incident began after a suspicious download or a compromised shared folder, scan other devices only after they are safely disconnected; information about common worms can help explain how an infection moved across a network.

Make a forensic image of the affected drive when the files are business-critical. A professional can then work on a copy rather than the original disk. This is particularly important for Australian small businesses holding invoices, payroll records or BAS information, where careless experimentation can destroy useful remnants and complicate insurance or regulatory reporting.

Check Backups And Previous Versions

Look for offline USB backups, external hard drives, Time Machine snapshots, Windows File History, system restore points and cloud version history. A backup that was connected during the attack may also be encrypted, so inspect it from a clean computer before restoring anything. NBN-connected households often rely on automatic cloud synchronisation, but a synced encrypted file may overwrite a healthy online version unless version history is available.

Business users should check Microsoft 365, Google Workspace, Dropbox or other managed storage for earlier revisions. Do not reconnect a backup drive to the infected computer until the ransomware has been removed and the system has been checked. For family photos, tax documents and school files, make a separate copy of any healthy material before beginning restoration.

File recovery software can sometimes retrieve deleted originals, temporary Office files or unallocated data. Its chances fall sharply if the disk has continued operating, especially on solid-state drives where discarded blocks may be cleared. Install recovery software on another drive and save recovered files to a separate destination.

Repair Headers Carefully

Header repair works best when the ransomware changed only the first few bytes and left the remainder of the file untouched. A specialist may compare the damaged file with a clean file created by the same program and reconstruct the correct signature. This can help with selected JPEG, PNG, PDF, ZIP or Office files, but it is not a universal decryption method.

Use a hex editor only on duplicated samples, because an incorrect byte change can make analysis harder. Test repaired copies with several trusted applications and compare their file sizes, previews and internal structure. For large collections, automated scripts can process matching file types, but a mistake in the script may overwrite thousands of files.

Some ransomware families have public decryptors released by security researchers or law-enforcement partnerships. Download tools only from a recognised security vendor, verify their documentation and scan the tool before use. Browser pop-ups claiming that a computer is infected can lead to secondary theft, so review guidance on fake system alerts before trusting a recovery advertisement.

Prevent A Second Loss

After preserving evidence, rebuild or thoroughly clean the operating system rather than assuming that deleting the ransom note solved the problem. Change passwords from a separate clean device, enable multifactor authentication and check email forwarding rules, browser extensions and remote-access accounts. If a browser hijacker or malicious extension was involved, investigate browser hijackers as part of the wider cleanup.

Australian organisations should consider whether personal information was exposed and seek advice about obligations under the Privacy Act and the Notifiable Data Breaches scheme. Report serious cyber incidents through the ACSC, and use Scamwatch for scam-related intelligence. Keep records for insurers, IT providers and, where relevant, customers or clients.

Recovery Priorities To Follow

• Isolate infected computers and shared drives before opening or copying more files.
• Preserve ransom notes, changed extensions and sample files, then work from forensic copies.
• Check offline backups and cloud version history before attempting header reconstruction.
• Use decryptors and recovery utilities only when their source and ransomware match are verified.
• Restore clean systems with patched software, multifactor authentication and routinely tested backups.