X-Ways export list ...
 
Notifications
Clear all

X-Ways export list deleted files with orig name

3 Posts
2 Users
0 Likes
1,832 Views
(@opie328)
Posts: 7
Active Member
Topic starter
 

Using X-Ways 19.8, analyzing Windows 10 Enterprise computers. I am trying to export a list of deleted files with the original names according to the file system (from before being moved to the Recycle Bin and assigned a $R… name). I have recovered a number of deleted files from unallocated disk space, filtered for the types and description to get the deleted files I want and X-Ways shows the files when exploring recursively in the directory browser. Under Name, it displays the file name (for example; $R2QB45X.pdf) along with the original filename in brackets and light green if it was able to recover it (for example; [Important_Document.pdf]. If the file is selected and Details Mode is chosen, the "Important_Document.pdf" is listed as the "Name according to the file system." I assume it's pulled from the information in the $I file since INFO2 is no longer in use. The problem is that when I select the file, right click and choose Export list, even if I highlight all of the fields, the "Important_Document.pdf" is not included in the data exported; only "$R2QB45X.pdf" is copied. Any ideas how to get that included?

 
Posted : 15/10/2019 4:56 pm
nightworker
(@nightworker)
Posts: 134
Estimable Member
 

you should recover $I files and copy spesific bytes each of them to export full list.
but if you want more raw recovery doesnt contain file path

 
Posted : 16/10/2019 7:12 am
(@opie328)
Posts: 7
Active Member
Topic starter
 

Just to update in case someone else looks for this. Stefan & crew at X-Ways added this as an option to display the original filename starting with v19.9. Thanks!

 
Posted : 06/04/2020 6:32 pm
Share: