recover.exe

  • File Path: C:\WINDOWS\SysWOW64\recover.exe
  • Description: Recover Files Utility

Hashes

Type Hash
MD5 89DA1734EAA590115A227C8E60E6C7B9
SHA1 886C428C20A4AC98B8AE940FA56F211DB88A731D
SHA256 E1E9C5AE4D6C5D0EACC305C9147FC34D72F616F8BC7866509D212F6401CF45C9
SHA384 AB276CEB1F545E4F94535224037279798E831AB554B2D679335D302DE8A90A855062E4C94CC3182F9B87CA88C0950BC4
SHA512 07E3F9C7FC1F010B51CE4D3381557348485D1BD431F8F575CE112A2D58F43CB1EDF43AC18A6EF268241017439B0CE55548A765ECA0040619B7CF30A9D6299DD1
SSDEEP 192:ziiU4v5m0us/ppTgY1Qqp8DNt2rYvk2TWlnWVMcSkt:z9jv5QCptgiQqp4212TWlnWacv

Runtime Data

Usage (stdout):

Access Denied as you do not have sufficient privileges or
the disk may be locked by another process.
You have to invoke this utility running in elevated mode
and make sure the disk is unlocked.

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Recover.Exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.18362.1 (WinBuild.160101.0800)
  • Product Version: 10.0.18362.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\recover.exe 30

Possible Misuse

The following table contains possible examples of recover.exe being misused. While recover.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma azure_keyvault_key_modified_or_deleted.yml - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION DRL 1.0
sigma azure_keyvault_secrets_modified_or_deleted.yml - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION DRL 1.0
sigma proc_creation_win_sqlcmd_veeam_dump.yml - https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html DRL 1.0
atomic-red-team T1048.003.md 3. Once the data is received, use the below command to recover the data. MIT License. © 2018 Red Canary
atomic-red-team T1110.002.md <blockquote>Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping is used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1485.md RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover. MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


recover

Recovers readable information from a bad or defective disk. This command reads a file, sector-by-sector, and recovers data from the good sectors. Data in bad sectors is lost. Because all data in bad sectors is lost when you recover a file, you should recover only one file at a time.

Bad sectors reported by the chkdsk command were marked as bad when your disk was prepared for operation. They pose no danger, and recover does not affect them.

Syntax

recover [<drive>:][<path>]<filename>

Parameters

Parameter Description
[<drive>:][<path>]<filename> Specifies the file name (and the location of the file if it is not in the current directory) you want to recover. Filename is required and wildcards aren’t supported.
/? Displays help at the command prompt.

Examples

To recover the file story.txt in the \fiction directory on drive D, type:

recover d:\fiction\story.txt

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.