Hex Editor for Hire

[Bryan Pringles]

I have an encrypted .7z file that is corrupted. I considering myself pretty smart but I don't know how to edit hex code.

I read the www.7-zip.org/recover.html . When opening my file in 7-Z File Manager it says "Can not open the file as [7z] archive. Is not archive.

I can confirm the file size is correct from what I can remmber. From what I understand I need to make sure the starting header needs to link to the end header. Not sure how to accomplish that.

There is some personal data on this file so I don't feel comfortable sharing this with anyone but I am willing to pay for some assistance. If you can help me rebuild this file I will be willing to pay you $150.

Please email me if you can help.

[Igor Pavlov]

Show first 48 bytes, and last 128 bytes in hex.

[Bryan Pringles]

excuse my ignorance but can you give an example of how many hex pairs is 48 bytes & 128 bytes?

I was going to start doing the research but im strapped for time...

[Bryan Pringles]

is this right?

4C 4D 9F 2D 46 32 6D DC EF 30 B1 A5 35 DC E5 6A 8B D4 E7 FA 34 2B 7B C3 B2 34 40 7D 97 95 A8 1D 1E 5F 54 3C CC 4E DC 65 6C D0 99 A8 DA C0 FD DF 9C 02 EE A5 D8 E0 19 8C 00 A7 55 5F 8F 66 6C EF CA A7 D9 9B 38 2B 2A 40 19 F8 0C 1A 9E 4D 28 EE 97 FE FF AE C1 81 77 15 DB 99 77 8A 09 D2 01 12

EC 30 D2 78 57 28 AB E7 4B C2 09 5D 98 74 46 6E 48 6F 37 D5 5B 89 1C 8F 07 44 99 DB B1 50 DC 65 E0 35 FC F7 73 4B 39 A4 5E B9 D3 83 24 12 65 EF DD D1 32 B5 E2 70 1C 13 54 E9 DD A2 5E E9 F2 15 C7 13 C3 86 C9 10 2E 20 7E E2 D9 60 85 13 FB 7B 92 A3 E6 DF F6 FF 76 78 8E C2 8D 37 62 5F 24 3D FB C2 E7 AB C4 C8 04 7B 0E E5 55 D0 1C B8 9C 2D 44 10 57 85 C0 80 67 7C 79 19 DC DB 05 9B 6F 19

[Igor Pavlov]

There are no 7z signatures in that data. So no way to recover.
To check that you do it correctly, create some another 7z archive, and you will see 7z signatures in start. Example of first 48 bytes in good 7z archive:

0000000000: 37 7A BC AF 27 1C 00 04 B2 42 72 20 C8 A7 0F 00
0000000010: 00 00 00 00 26 00 00 00 00 00 00 00 5B 70 88 E0
0000000020: 00 04 92 58 BD DF 61 DC DB B6 D4 BF 00 52 BF 78

[Bryan Pringles]

So is it impossible to add that information to the beginning of this file?

[Bryan Pringles]

I should mention that the file size is correct. From what I read on their recovery webpage it said it could be fixed by connecting the start header to the end header. clearly I trust your analysis but I just wanted to ask those questions.

[Igor Pavlov]

Header can help, if another data after header is OK.
But your data is not archive. It's some another data. So header can't help in that case.

But check it again. Create good 7z archive and look first 48 bytes and last 128 bytes.
In case of good archive, you will see header and footer.
If you don't see header in "bad" archive, then you can't recover.
In some cases it's possible to search 7z headers (signatures) in raw HDD or file image. But it can be difficult to recover that way.

[Bryan Pringles]

if i send it to you can you give it a try?

[Igor Pavlov]

I can't find 7z signatures in that file.
No way to recover from that file.