±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 4 Overall: 36205
New Yesterday: 1 Visitors: 169

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

X-Ways export list deleted files with orig name

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Opie328
Newbie
 

X-Ways export list deleted files with orig name

Post Posted: Oct 15, 19 16:56

Using X-Ways 19.8, analyzing Windows 10 Enterprise computers. I am trying to export a list of deleted files with the original names according to the file system (from before being moved to the Recycle Bin and assigned a $R... name). I have recovered a number of deleted files from unallocated disk space, filtered for the types and description to get the deleted files I want and X-Ways shows the files when exploring recursively in the directory browser. Under Name, it displays the file name (for example; $R2QB45X.pdf) along with the original filename in brackets and light green if it was able to recover it (for example; [Important_Document.pdf]. If the file is selected and Details Mode is chosen, the "Important_Document.pdf" is listed as the "Name according to the file system." I assume it's pulled from the information in the $I file since INFO2 is no longer in use. The problem is that when I select the file, right click and choose Export list, even if I highlight all of the fields, the "Important_Document.pdf" is not included in the data exported; only "$R2QB45X.pdf" is copied. Any ideas how to get that included?  
 
  

nightworker
Senior Member
 

Re: X-Ways export list deleted files with orig name

Post Posted: Oct 16, 19 07:12

you should recover $I files and copy spesific bytes each of them to export full list.
but if you want more raw recovery doesnt contain file path  
 

Page 1 of 1