file name recovery
 
Notifications
Clear all

file name recovery

9 Posts
6 Users
0 Likes
693 Views
jacktiger
(@jacktiger)
Posts: 27
Eminent Member
Topic starter
 

Someone formatted his disk.Using qphotorecovery I recovered lot of files. But the filename is eg 23000.jpg and so on. Some free tools permit me di recover also the name of file?

 
Posted : 18/06/2015 1:37 pm
mscotgrove
(@mscotgrove)
Posts: 933
Prominent Member
 

You have obviously recovered with data carving. File names do not exist this way.

Two solutions

1) Try and use a recovery program that works with logical files, rather than data carving. After a format this is possible. Original filenames and structure often possible - though can be harder for FAT 32 and HFS+/MAC, and easier for NTFS.

2) Use a data carving tool that uses the meta data to create some kind of file name, or at least file date.

Free, I am not sure about, low cost, is possible

 
Posted : 19/06/2015 2:15 am
binarybod
(@binarybod)
Posts: 272
Reputable Member
 

Here is a technique I have used in the past with some success

1) Carve the whole drive/partition for URL strings

2) Use grep to isolate all lines starting 'http' and ending '.jpg'

3) Use wget to see which of these picture resources are still live on the Internet and download them to a folder somewhere

4) Hash all the .jpg files you captured from the web

5) See which files you carved match those that you downloaded by comparing hashes. If any files match then it is a fair bet that the name of the resource in the URL is the name of the file (but not an absolute guarantee)

6) Be aware that the picture carving process may produce a different file from the resource on the Internet so it might pay to do some visual matching using your own Mk 1 eyeball.

7) Analysis of the area on the drive where the matching URL string was may reveal other useful information (e.g. if it is a web browser cache record then it is likely to contain date information too)

Have fun 😉

 
Posted : 19/06/2015 9:48 pm
mscotgrove
(@mscotgrove)
Posts: 933
Prominent Member
 

@Paul - Unless I have misunderstood your process, it will only work with published JPEGs.

Most disks I see are full of photos of 'holidays' that are not published.

 
Posted : 20/06/2015 12:18 am
cs1337
(@cs1337)
Posts: 83
Trusted Member
 

i've used a application called "file scavenger" in the past that worked like a charm for something like this. give it a shot.

 
Posted : 20/06/2015 1:52 am
lcoughey
(@lcoughey)
Posts: 6
Active Member
 

Someone formatted his disk.Using qphotorecovery I recovered lot of files. But the filename is eg 23000.jpg and so on. Some free tools permit me di recover also the name of file?

If they just formatted their disk and did not write any data back to it, you should be able to easily find the original MFT (assuming NTFS) and rebuild the original file structure with minimal damage to the files with almost any data recovery program. I recommend using R-Studio for the task, but the aforementioned FileScavenger should work too.

 
Posted : 02/07/2015 9:35 pm
jacktiger
(@jacktiger)
Posts: 27
Eminent Member
Topic starter
 

Thanks all!!! File scavenger works fine. Bit is IT possibile to retrieve also the path?
Thanks

 
Posted : 08/07/2015 1:14 am
jaclaz
(@jaclaz)
Posts: 5135
Illustrious Member
 

Thanks all!!! File scavenger works fine. Bit is IT possibile to retrieve also the path?
Thanks

Yes and no.
It depends on how much (if any) info is still in the $MFT.

Try using DMDE
http//dmde.com/

IF it can find the path info it will assemble the files in a "virtual reconstruction" of the filesystem from which you may get the original paths (or parts of it).

jaclaz

 
Posted : 08/07/2015 4:01 pm
jacktiger
(@jacktiger)
Posts: 27
Eminent Member
Topic starter
 

Thanks jaclaz. First i used dmde then the other tools. So it's impossibile recover the path.
Thanks

 
Posted : 09/07/2015 2:46 pm
Share:
Share to...