old variant .herad type encryption

[saki 0]

Hi expert,

I tried using your decrypter but the files remained the same and the following log details were shown.

File: D:\02 10 15\20151002_102347.jpg.herad
Error: Unable to decrypt Old Variant ID: Qs0mSwMtG5SBt1ILK2brrg8vFRhMkL9PKfw2jnpq
First 5 bytes: FFD8FFE102

File: D:\02 10 15\20151002_154453.jpg.herad
Error: Unable to decrypt Old Variant ID: Qs0mSwMtG5SBt1ILK2brrg8vFRhMkL9PKfw2jnpq
First 5 bytes: FFD8FFE139

File: D:\02 10 15\20151002_154512.jpg.herad
Error: Unable to decrypt Old Variant ID: Qs0mSwMtG5SBt1ILK2brrg8vFRhMkL9PKfw2jnpq
First 5 bytes: FFD8FFE13B

File: D:\02 10 15\20151002_154643.jpg.herad
Error: Unable to decrypt Old Variant ID: Qs0mSwMtG5SBt1ILK2brrg8vFRhMkL9PKfw2jnpq
First 5 bytes: FFD8FFE135

File: D:\02 10 15\20151002_154648.jpg.herad
Error: Unable to decrypt Old Variant ID: Qs0mSwMtG5SBt1ILK2brrg8vFRhMkL9PKfw2jnpq
First 5 bytes: FFD8FFE132

but while checking with a pair the variant ID changed as shown below.

• • Starts with the bytes: FFD8FFE17D
• • Were encrypted with ID: jkO9OpMIRJ4FHeGDM7eK5FwJTcY40YKkizu7Zgt1

 

So, please can you help me recover my data.

[GT500 882]

JPG images are going to be more difficult than most other file types, since the first 5 bytes can vary based on what software or device saved them. Fortunately the decrypter tells you the first 5 bytes of each encrypted file it fails to decrypt, so you should be able to group files together by the first 5 bytes and try to find file pairs for each group.

[saki 0]

Sorry expert, I didn't understand what you said. My background is civil engineering, so I don't know how to group files by the first 5 bytes of each encrypted file.

If you don't mind can you elaborate me how to do that. 

And one more thing I have decrypted some JPG files which are having the  ID: Qs0mSwMtG5SBt1ILK2brrg8vFRhMkL9PKfw2jnpq. 

some of my files  getting deleted automatically..

 

[GT500 882]

14 hours ago, saki said:

Sorry expert, I didn't understand what you said. My background is civil engineering, so I don't know how to group files by the first 5 bytes of each encrypted file.

If you don't mind can you elaborate me how to do that.

The decrypter tells you the first 5 bytes of each file it can't decrypt, so the easiest way to handle this is to create a spreadsheet with two columns, one with the first 5 bytes of each JPG image and the next with the file names. Then sort the rows by the column with the first 5 bytes, and that will group together all files in the list that have the same first 5 bytes. Then pick out the best file from each group you can use as a file pair.

 

14 hours ago, saki said:

some of my files  getting deleted automatically..

Due to the way the decrypter works, if you have an original unencrypted file in the same folder as an encrypted copy of the same file, the decrypter will attempt to overwrite the original file if it attempts to decrypt the encrypted copy. It's best to make a backup of any unencrypted files before using the decrypter.