Join Us!

X-Ways export list ...
 
Notifications
Clear all

X-Ways export list deleted files with orig name  

  RSS
Opie328
(@opie328)
New Member

Using X-Ways 19.8, analyzing Windows 10 Enterprise computers. I am trying to export a list of deleted files with the original names according to the file system (from before being moved to the Recycle Bin and assigned a $R… name). I have recovered a number of deleted files from unallocated disk space, filtered for the types and description to get the deleted files I want and X-Ways shows the files when exploring recursively in the directory browser. Under Name, it displays the file name (for example; $R2QB45X.pdf) along with the original filename in brackets and light green if it was able to recover it (for example; [Important_Document.pdf]. If the file is selected and Details Mode is chosen, the "Important_Document.pdf" is listed as the "Name according to the file system." I assume it's pulled from the information in the $I file since INFO2 is no longer in use. The problem is that when I select the file, right click and choose Export list, even if I highlight all of the fields, the "Important_Document.pdf" is not included in the data exported; only "$R2QB45X.pdf" is copied. Any ideas how to get that included?

Quote
Posted : 15/10/2019 5:56 pm
nightworker
(@nightworker)
Active Member

you should recover $I files and copy spesific bytes each of them to export full list.
but if you want more raw recovery doesnt contain file path

ReplyQuote
Posted : 16/10/2019 8:12 am
Opie328
(@opie328)
New Member

Just to update in case someone else looks for this. Stefan & crew at X-Ways added this as an option to display the original filename starting with v19.9. Thanks!

ReplyQuote
Posted : 06/04/2020 7:32 pm
Share: