Windows File Contents

Matthew Roessner
Matthew Roessner used Ask the Experts™
on
I have a friend who has a file on her computer that is 57 GB. It is listed as a FILENAME.XLS

The friend also has another system that has two of these ".XLS files" on them with similar file names that are 932 GB and 157 GB.

The file is definitely NOT a XLS file...  

Does anyone have any ideas on how to figure out what this file is?  My initial thought is that it might be some kind of video archive or something (based only on the file size).

Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
I googled "opening unknown files" and see a few suggestions. Based on the size Im imagining iso files
Matthew RoessnerSenior Systems Programmer

Author

Commented:
I attempted to change it to .iso - thinking the same thing.  That didn't get me anywhere....
Top Expert 2016
Commented:
you could try opening it with a hex editor like xvi or notepad++.   what you need to look at are the initial bytes of the file.

XLS first 2 byes D0 CF  ascii NONE
XLSX first 2 bytes 50 4B ascii PK (this is a zip archive)
.exe 4D 5A ascii MZ

I would treat these files as being very suspicious and run an anti virus and antimalware (Malware Byes) and maybe even rootkit reveal-er.. move  these files to a usb drive and reboot the system and see if they get recreated..
Matthew RoessnerSenior Systems Programmer

Author

Commented:
I have the files on a USB Drive already.  The current theory is that these are video archive containers that have been encrypted.  I had previously opened up the file using a hex editor (they are too big for notepad++ to handle). The first two bytes are: 5F 45  of which I couldn't find any real information on.

I did find some metadata related to the files that suggested they may have been created with either TrueCrypt or VeraCrypt - so currently attempting to download those and see if I can get to the bottom of the mystery...

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial