All my raw files from multiple cameras seem to be corrupted but jpeg ok...

[wisebug]

Good find.

If the OP is using a QNAP NAS, could be they were hit with ransomware: https://www.dpreview.com/forums/post/65875532

That would have changed all the extensions, too.

yeah extensions are ok, all videos and jpeg are ok, i'm thinking sync job encryption



the hex match

 

[mdmarqphoto]

Possibly if you could share one or two files, then we may see how they fare on our computers.

If you have the corresponding JPEG you can make sure that it is not a compromising photo of your wife

I already did that with couple friends and one member here, I also checked a good file and one of mine with a hex editor and the header is just a bunch of garbage

https://1drv.ms/u/s!Ag7qBOqotc1EiLlyeo2yh0Er6PUswQ?e=Cu7Kb7

No idea what they are but should be sfw

I'm trying to understand what happened and if it could be related to onedrive somehow

Looks like file encryption. See:

https://gist.github.com/dguerri/92d9330bf9e8f1303b4004ddd4e00f00

There are some magic numbers at the very beginning of the encrypted files. This is what I know:

# Magic - Version 1 5f 5f 51 43 53 5f 5f # Magic - Version 2 - Compressed 4b ca 94 72 5e 83 1c 31 01 01 # Magic - Version 2 - Not Compressed 4b ca 94 72 5e 83 1c 31 01 00

Your headers: 4B CA 94 72 5E

I think you are into something, I used a sync job between a qnap and onedrive at some point.

QNAP? Better check the link I just posted. May have nothing to do with onedrive, other than encrypted files being backed up with it.

 

[wisebug]

Possibly if you could share one or two files, then we may see how they fare on our computers.

If you have the corresponding JPEG you can make sure that it is not a compromising photo of your wife

I already did that with couple friends and one member here, I also checked a good file and one of mine with a hex editor and the header is just a bunch of garbage

https://1drv.ms/u/s!Ag7qBOqotc1EiLlyeo2yh0Er6PUswQ?e=Cu7Kb7

No idea what they are but should be sfw

I'm trying to understand what happened and if it could be related to onedrive somehow

Looks like file encryption. See:

https://gist.github.com/dguerri/92d9330bf9e8f1303b4004ddd4e00f00

There are some magic numbers at the very beginning of the encrypted files. This is what I know:

# Magic - Version 1 5f 5f 51 43 53 5f 5f # Magic - Version 2 - Compressed 4b ca 94 72 5e 83 1c 31 01 01 # Magic - Version 2 - Not Compressed 4b ca 94 72 5e 83 1c 31 01 00

Your headers: 4B CA 94 72 5E

I think you are into something, I used a sync job between a qnap and onedrive at some point.

QNAP? Better check the link I just posted. May have nothing to do with onedrive, other than encrypted files being backed up with it.

Yeah that's very possible, i'm not sure why i didn't think of this before. thank you so much

 

[Colin Creevey]

I just noticed that every single raw file I have won't open anymore. I noticed the issue a couple weeks ago trying to look into some old travel pictures but I assumed it was just a windows 11 codec problem and I didn't bother investigating.

But today I tried multiple computers and I can't open any of them from Nikon NEF (D40,D7000,D750) to Fuji RAF (XT1-XT2), I checked the backup on my NAS and it's the same issue, I had a backup on onedrive and same issue.

I got rid of my internal hdd recently and rebuilt a new NAS so it's possible the data accross everything is basically the same as I lost track at some point.

All the jpeg are opening no problem, I'm panicking a bit and not sure what to do next, the data probably got corrupted between my pc and the nas and all that got mirrored on the external backup and the cloud, but i didn't check the data before getting rid of the hdd in my pc, I feel very stupid right now assuming the backups were all ok.

I'v been away from photography for a while now so I never really interacted with this data beside moving it to a new drive.

No idea if it is relevant but I had an issue a while back where I dumped my SD card onto the HDD but LR wouldn't recognise any of the photos. Tried copying a fresh version from the SD card and same thing happened. Used the version from my other memory card (camera has dual memory card slots) and that version was recognised fine.

It was very strange. I formatted the SD card and have used it since without issue. To this day I still have no idea what was happening.

 

[Joep van Steen]

Good find.

If the OP is using a QNAP NAS, could be they were hit with ransomware: https://www.dpreview.com/forums/post/65875532

That would have changed all the extensions, too.

yeah extensions are ok, all videos and jpeg are ok, i'm thinking sync job encryption

the hex match

Yeah, this isn't ransomware I think.

--
Joep

 

[wisebug]

Thank you all so much, and a huge thanks to Joep van Steen for steering me in the right direction, I plugged my old qnap... thank god nobody bought it on marketplace, all I had to do is sync the data from onedrive back to it using the same admin password and all the file are getting decrypted.

you have no idea and grateful I am thank you so much

 

[foot]

Thank you all so much, and a huge thanks to Joep van Steen for steering me in the right direction, I plugged my old qnap... thank god nobody bought it on marketplace, all I had to do is sync the data from onedrive back to it using the same admin password and all the file are getting decrypted.

you have no idea and grateful I am thank you so much

no text

 

[Joep van Steen]

Awesome!

 

[D Cox]

Thank you all so much, and a huge thanks to Joep van Steen for steering me in the right direction, I plugged my old qnap... thank god nobody bought it on marketplace, all I had to do is sync the data from onedrive back to it using the same admin password and all the file are getting decrypted.

you have no idea and grateful I am thank you so much

That is as near to a miracle as we are likely to see in our lifetime.

Don

 

[tkbslc]

Thank you all so much, and a huge thanks to Joep van Steen for steering me in the right direction, I plugged my old qnap... thank god nobody bought it on marketplace, all I had to do is sync the data from onedrive back to it using the same admin password and all the file are getting decrypted.

you have no idea and grateful I am thank you so much

That is awesome!

Now take this as a lesson to keep an offline backup. I suggest making a full copy as soon as you get the data back and verify that the copy is good and readable.

 

[Bob A L]

Sounds like a good reason to always save photos in jpeg even if you do the raw thing.

 

[tkbslc]

Sounds like a good reason to always save photos in jpeg even if you do the raw thing.

This was a unique situation. It could have easily been the other way around, or both got corrupted or deleted or infected. Really the moral is you never know what can happen to your data, so keep a clean backup somewhere offline.

 

[Bob Janes]

Thank you all so much, and a huge thanks to Joep van Steen for steering me in the right direction, I plugged my old qnap... thank god nobody bought it on marketplace, all I had to do is sync the data from onedrive back to it using the same admin password and all the file are getting decrypted.

you have no idea and grateful I am thank you so much

Wonderful news!

 

[D Cox]

Sounds like a good reason to always save photos in jpeg even if you do the raw thing.

This was a unique situation. It could have easily been the other way around, or both got corrupted or deleted or infected. Really the moral is you never know what can happen to your data, so keep a clean backup somewhere offline.

And avoid any kind of "backup" that compresses the files. Larger hard drives are worth the money when they allow you to save your files intact.

Don

 

[wisebug]

It's at this moment you realise... onedrive download speed with qnap sync are 2-3 mbps... that's going to take a while.

 

[wisebug]

Sounds like a good reason to always save photos in jpeg even if you do the raw thing.

This was a unique situation. It could have easily been the other way around, or both got corrupted or deleted or infected. Really the moral is you never know what can happen to your data, so keep a clean backup somewhere offline.

And avoid any kind of "backup" that compresses the files. Larger hard drives are worth the money when they allow you to save your files intact.

Don

This is the odd part, compression / encryption was turned off, no idea why it did it with all "unknown" file extention ( RAW )

I'm going to go back to my old way of doing things, 1:1 copy on multiple hdd/ssd that i take off side, I stopped doing this cause I used to bring them to work but i'v been working from home and had to take all my stuff with me, I'm going to blame covid for it all ;p

 

[wisebug]

Ok found a better way to do this:

Using windows onedrive app to sync folder to local mvme ssd ( way faster d/l speed from microsoft server) then using QENC Decrypter from Qnap.

 

[Rolling Estonian]

So glad you got this worked out!

I'm a musician/recording hobbyist, was going to pipe in about One Drive as I've heard of folks having a real hard time with backed up music files (like raw, all different and proprietary) but not common codecs (wav, mp3 etc).

Glad we all now know. Hopefully these last couple days hasn't shortened your life due to the stress, I couldn't even imagine.

M

 

[wisebug]

So glad you got this worked out!

I'm a musician/recording hobbyist, was going to pipe in about One Drive as I've heard of folks having a real hard time with backed up music files (like raw, all different and proprietary) but not common codecs (wav, mp3 etc).

Glad we all now know. Hopefully these last couple days hasn't shortened your life due to the stress, I couldn't even imagine.

M

I think case it wasn't onedrive itself as I suspected but qnap hybrid backup unwanted encryption.