Someone formatted his disk.Using qphotorecovery I recovered lot of files. But the filename is eg 23000.jpg and so on. Some free tools permit me di recover also the name of file?
You have obviously recovered with data carving. File names do not exist this way.
Two solutions
1) Try and use a recovery program that works with logical files, rather than data carving. After a format this is possible. Original filenames and structure often possible - though can be harder for FAT 32 and HFS+/MAC, and easier for NTFS.
2) Use a data carving tool that uses the meta data to create some kind of file name, or at least file date.
Free, I am not sure about, low cost, is possible
Here is a technique I have used in the past with some success
1) Carve the whole drive/partition for URL strings
2) Use grep to isolate all lines starting 'http' and ending '.jpg'
3) Use wget to see which of these picture resources are still live on the Internet and download them to a folder somewhere
4) Hash all the .jpg files you captured from the web
5) See which files you carved match those that you downloaded by comparing hashes. If any files match then it is a fair bet that the name of the resource in the URL is the name of the file (but not an absolute guarantee)
6) Be aware that the picture carving process may produce a different file from the resource on the Internet so it might pay to do some visual matching using your own Mk 1 eyeball.
7) Analysis of the area on the drive where the matching URL string was may reveal other useful information (e.g. if it is a web browser cache record then it is likely to contain date information too)
Have fun 😉
@Paul - Unless I have misunderstood your process, it will only work with published JPEGs.
Most disks I see are full of photos of 'holidays' that are not published.
i've used a application called "file scavenger" in the past that worked like a charm for something like this. give it a shot.
Someone formatted his disk.Using qphotorecovery I recovered lot of files. But the filename is eg 23000.jpg and so on. Some free tools permit me di recover also the name of file?
If they just formatted their disk and did not write any data back to it, you should be able to easily find the original MFT (assuming NTFS) and rebuild the original file structure with minimal damage to the files with almost any data recovery program. I recommend using R-Studio for the task, but the aforementioned FileScavenger should work too.
Thanks all!!! File scavenger works fine. Bit is IT possibile to retrieve also the path?
Thanks
Thanks all!!! File scavenger works fine. Bit is IT possibile to retrieve also the path?
Thanks
Yes and no.
It depends on how much (if any) info is still in the $MFT.
Try using DMDE
http//dmde.com/
IF it can find the path info it will assemble the files in a "virtual reconstruction" of the filesystem from which you may get the original paths (or parts of it).
jaclaz
Thanks jaclaz. First i used dmde then the other tools. So it's impossibile recover the path.
Thanks