Windows File Contents

I have a friend who has a file on her computer that is 57 GB. It is listed as a FILENAME.XLS

The friend also has another system that has two of these ".XLS files" on them with similar file names that are 932 GB and 157 GB.

The file is definitely NOT a XLS file...  

Does anyone have any ideas on how to figure out what this file is?  My initial thought is that it might be some kind of video archive or something (based only on the file size).

Matthew RoessnerSenior Systems ProgrammerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I googled "opening unknown files" and see a few suggestions. Based on the size Im imagining iso files
Matthew RoessnerSenior Systems ProgrammerAuthor Commented:
I attempted to change it to .iso - thinking the same thing.  That didn't get me anywhere....
David Johnson, CD, MVPRetiredCommented:
you could try opening it with a hex editor like xvi or notepad++.   what you need to look at are the initial bytes of the file.

XLS first 2 byes D0 CF  ascii NONE
XLSX first 2 bytes 50 4B ascii PK (this is a zip archive)
.exe 4D 5A ascii MZ

I would treat these files as being very suspicious and run an anti virus and antimalware (Malware Byes) and maybe even rootkit reveal-er.. move  these files to a usb drive and reboot the system and see if they get recreated..

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Matthew RoessnerSenior Systems ProgrammerAuthor Commented:
I have the files on a USB Drive already.  The current theory is that these are video archive containers that have been encrypted.  I had previously opened up the file using a hex editor (they are too big for notepad++ to handle). The first two bytes are: 5F 45  of which I couldn't find any real information on.

I did find some metadata related to the files that suggested they may have been created with either TrueCrypt or VeraCrypt - so currently attempting to download those and see if I can get to the bottom of the mystery...
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.