Comparing ransomware encrytped files

[megahertz]

A client of mine has been hit with a ransomware virus for the second time now in the last few months.
I have restored their virtual hard drive backup and mounted it to their server and would love to be able to just overwrite all of the encrypted files with backup copies from the backup.
Sadly though the ransomware attack happened 3 weeks ago and they have only just noticed it. So overwriting files could overwrite ones that have been edited since then.

I therefore have the task of manually matching up the encrypted files which now end with a .cry extension, with the original files from the backup.
I am wondering if there is someway of using Beyond Compare to match the files which have different file extensions but same names and overwriting the encrypted files with their originals.

Thanks in advance

[Aaron]

Hello,

Yes, you can use the Folder Compare's Session menu -> Session Settings, Comparison tab, "Align file names with different extensions".

[megahertz]

Hello,

Yes, you can use the Folder Compare's Session menu -> Session Settings, Comparison tab, "Align file names with different extensions".

Thannks Aaron,
Also is there a way to filter files on one side only?
The right hand side is the existing drive/folder structure and I want to filter out all of the .cry files so that I am then able to copy across their unencrypted version over the top of it.

Thanks

[Chris]

It isn't possible to set a name filter for one side only. However, you can select View > Show No Orphans to filter out files that only exist on one side.

For more filtering options, right click on the toolbar and select Toggles. Then deselect the Left Orphans or Right Orphans button.