Filename Recovery

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
DaveJohnstone
Posts: 3
Joined: 16 Feb 2018, 12:31

Filename Recovery

#1 Post by DaveJohnstone » 19 Feb 2018, 11:40

Before creating some custom signatures, the photorec.log gives me some original filenames:
Analyse
P Unknown 0 0 1 311 53 14 4999568
Pass 0 (blocksize=512) STATUS_FIND_OFFSET
* 0-4999567: (null)
4999568 sectors contains unknown data, 0 invalid files found and rejected.
blocksize=32768, offset=12288
Elapsed time 0h00m00s
Pass 1 (blocksize=32768) STATUS_EXT2_OFF
* 24-599: (null)
600-1047: fat
1048-1687: custom
1688-2775: custom
2776-4823: custom
4824-4887: custom
4888-5015: custom
5016-5783: exe
5784-6359: exe
6360-6935: custom
6936-4999575: custom
4999552 sectors contains unknown data, 10 invalid files found and rejected.
Sector 600
2 drwxr-xr-x 0 0 0 20-Feb-1998 06:18 .
0 drwxr-xr-x 0 0 0 20-Feb-1998 06:18 ..
1400 -rwxr-xr-x 0 0 11208 31-May-1994 15:52 ATTRIB.EXE
1401 -rwxr-xr-x 0 0 12241 31-May-1994 15:52 CHKDSK.EXE
1402 -rwxr-xr-x 0 0 26936 31-May-1994 15:52 COUNTRY.SYS
12 -rwxr-xr-x 0 0 15920 31-May-1994 15:52 COUNTRY.TXT
1403 -rwxr-xr-x 0 0 15718 31-May-1994 15:52 DEBUG.EXE
However, once I recover these files they are named as f<sector>.ext. How do I reconcile the original filename to the sector number? It must be a simple translation but I can't figure it out. Any help appreciated.

Regards,

Dave.

Sponsored links

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests