Using X-Ways 19.8, analyzing Windows 10 Enterprise computers. I am trying to export a list of deleted files with the original names according to the file system (from before being moved to the Recycle Bin and assigned a $R… name). I have recovered a number of deleted files from unallocated disk space, filtered for the types and description to get the deleted files I want and X-Ways shows the files when exploring recursively in the directory browser. Under Name, it displays the file name (for example; $R2QB45X.pdf) along with the original filename in brackets and light green if it was able to recover it (for example; [Important_Document.pdf]. If the file is selected and Details Mode is chosen, the "Important_Document.pdf" is listed as the "Name according to the file system." I assume it's pulled from the information in the $I file since INFO2 is no longer in use. The problem is that when I select the file, right click and choose Export list, even if I highlight all of the fields, the "Important_Document.pdf" is not included in the data exported; only "$R2QB45X.pdf" is copied. Any ideas how to get that included?
you should recover $I files and copy spesific bytes each of them to export full list.
but if you want more raw recovery doesnt contain file path
Just to update in case someone else looks for this. Stefan & crew at X-Ways added this as an option to display the original filename starting with v19.9. Thanks!