Photorec - recoverd filename doesnt match logfile/result.xml Topic is solved

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
w2k8
Posts: 3
Joined: 18 May 2015, 13:03

Photorec - recoverd filename doesnt match logfile/result.xml

#1 Post by w2k8 »

Hi,

recently i was useing photorec to recovering files from a memorydump, the memorydumpfile's name is: stuxnet.vmem from https://code.google.com/p/volatility/wi ... moryImages

I use the following command-line parameters:
photorec /debug /log /logname photorec.log /d dump /cmd stuxnet.vmem fileopt,everything,enable,search

The log-file and the report.xml does not match the files from the folder(s).

the filename reported in the log-file and report.xl is: f0082048.exe
The file in the export folder is: f0082048_audstub.sys

It's not the only file where the name doesnt match the exported logfile.

Why does the filename not match the log-file and/or report.xml?

*************************************************************************************************************

A part of the report.xml:

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
<metadata
xmlns='http://www.forensicswiki.org/wiki/Categ ... ensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>6.14</version>
<build_environment>
<compiler>GCC 4.8</compiler>
<compilation_date>2013-10-29T01:29:29</compilation_date>
<library name='libext2fs' version='1.42.9'/>
<library name='libewf' version='none'/>
<library name='libjpeg' version='libjpeg-turbo-1.3.0'/>
<library name='libntfs' version='libntfs-3g'/>
</build_environment>
<execution_environment>
<os_sysname>Linux</os_sysname>
<os_release>3.13.0-52-generic</os_release>
<os_version>#86-Ubuntu SMP Mon May 4 04:32:15 UTC 2015</os_version>
<host>ds01</host>
<arch>i686</arch>
<uid>1000</uid>
<start_time>2015-05-17T16:48:50+0200</start_time>
</execution_environment>
</creator>
<source>
<image_filename>stuxnet.vmem</image_filename>
<sectorsize>512</sectorsize>
<image_size>536870912</image_size>
<volume>
<byte_runs>
<byte_run offset='0' img_offset='0' len='536870912'/>
</byte_runs>
</volume>
</source>

<fileobject>
<filename>f0082048.exe</filename>
<filesize>3072</filesize>
<byte_runs>
<byte_run offset='0' img_offset='42008576' len='3072'/>
</byte_runs>
</fileobject>

*********************************************************************************************

A part from the log-file:
Using locale 'en_US.UTF-8'.


Sun May 17 19:29:11 2015
Command line: PhotoRec /debug /log /logname photorec.log /d pr_dump /cmd stuxnet.vmem fileopt,everything,enable,search

PhotoRec 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-52-generic (#86-Ubuntu SMP Mon May 4 04:32:15 UTC 2015) i686
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, ewf lib: none, libjpeg: libjpeg-turbo-1.3.0
User is not root!
Hard disk list
Disk stuxnet.vmem - 536 MB / 512 MiB - CHS 66 255 63 (RO), sector size=512

Partition table type default to None
Disk stuxnet.vmem - 536 MB / 512 MiB (RO)
Partition table type: None
P Unknown 0 0 1 65 69 4 1048576

[snip]
pr_dump.1/f0082048.exe 82048-82053

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Photorec - recoverd filename doesnt match logfile/result

#2 Post by cgrenier »

Can you try using latest 7.1-WIP ?

w2k8
Posts: 3
Joined: 18 May 2015, 13:03

Re: Photorec - recoverd filename doesnt match logfile/result

#3 Post by w2k8 »

I cant upload logfiles.

Problem is the same.
I have used version photorec 7.0

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
<metadata
xmlns='http://www.forensicswiki.org/wiki/Categ ... ensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.0</version>
<build_environment>
<compiler>GCC 4.4</compiler>
<compilation_date>2015-04-18T13:03:42</compilation_date>
<library name='libext2fs' version='1.42.8'/>
<library name='libewf' version='20120504'/>
<library name='libjpeg' version='libjpeg-turbo-1.3.1'/>
<library name='libntfs' version='libntfs-3g'/>
</build_environment>
<execution_environment>
<os_sysname>Linux</os_sysname>
<os_release>3.13.0-52-generic</os_release>
<os_version>#86-Ubuntu SMP Mon May 4 04:32:15 UTC 2015</os_version>
<host>ds01</host>
<arch>i686</arch>
<uid>1000</uid>
<start_time>2015-05-18T21:20:32+0200</start_time>
</execution_environment>
</creator>
<source>
<image_filename>stuxnet.vmem</image_filename>
<sectorsize>512</sectorsize>
<image_size>536870912</image_size>
<volume>
<byte_runs>
<byte_run offset='0' img_offset='0' len='536870912'/>
</byte_runs>
</volume>
</source>
<configuration>
</configuration>
<fileobject>
<filename>f0082048.exe</filename>
<filesize>3072</filesize>
<byte_runs>
<byte_run offset='0' img_offset='42008576' len='3072'/>
</byte_runs>
</fileobject>

[snip]

<fileobject>
<filename>f0335040.exe</filename>
<filesize>4224</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171540480' len='5120'/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0335384.exe</filename>
<filesize>7936</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171716608' len='8192'/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0335424.exe</filename>
<filesize>2944</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171737088' len='3072'/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0335432.exe</filename>
<filesize>4224</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171741184' len='5120'/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0335448.exe</filename>
<filesize>20992</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171749376' len='21504'/>
</byte_runs>
</fileobject>

************************************************************************
File list
total 43348
drwxrwxr-x 2 user user 20480 May 18 21:32 .
drwxr-xr-x 10 user user 4096 May 18 21:20 ..
-rw-rw-r-- 1 user user 133 May 18 21:20 f0000292.txt
-rw-rw-r-- 1 user user 409 May 18 21:20 f0013690.txt
-rw-rw-r-- 1 user user 526 May 18 21:20 f0013702.txt
-rw-rw-r-- 1 user user 206 May 18 21:20 f0013708.txt
-rw-rw-r-- 1 user user 215 May 18 21:20 f0013716.txt
-rw-rw-r-- 1 user user 180 May 18 21:20 f0013720.txt
-rw-rw-r-- 1 user user 131840 Apr 13 2008 f0013952.dll
-rw-rw-r-- 1 user user 1069056 Oct 31 2010 f0014192.reg
-rw-rw-r-- 1 user user 80128 Apr 13 2008 f0016736.exe
-rw-rw-r-- 1 user user 144384 Apr 14 2008 f0017648.dll
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0018720.txt
-rw-rw-r-- 1 user user 151552 Oct 29 2010 f0019224.reg
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0019720.txt
-rw-rw-r-- 1 user user 53248 Jul 17 2010 f0020072.exe
-rw-rw-r-- 1 user user 22528 Apr 14 2008 f0020856.dll
-rw-rw-r-- 1 user user 389120 Oct 29 2010 f0021112.reg
-rw-rw-r-- 1 user user 133 May 18 21:20 f0022796.txt
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0023848.txt
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0024192.txt
-rw-rw-r-- 1 user user 878 May 18 21:20 f0025264.java
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0026144.java
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0026352.py
-rw-rw-r-- 1 user user 20480 Oct 29 2010 f0026896.reg
-rw-rw-r-- 1 user user 8192 Oct 31 2010 f0027568.reg
-rw-rw-r-- 1 user user 1254 May 18 21:20 f0029088.gsm
-rw-rw-r-- 1 user user 23475 May 18 21:20 f0067546.txt
-rw-rw-r-- 1 user user 8218 May 18 21:20 f0067592.txt
-rw-rw-r-- 1 user user 1022 May 18 21:20 f0070462.txt
-rw-rw-r-- 1 user user 3050496 May 18 21:20 f0075626.dbf
-rw-rw-r-- 1 user user 270 May 18 21:20 f0081592.txt
-rw-rw-r-- 1 user user 73472 Apr 13 2008 f0081768.exe
-rw-rw-r-- 1 user user 3072 Aug 17 2001 f0082048_audstub.sys
-rw-rw-r-- 1 user user 574976 Apr 13 2008 f0082096.exe
-rw-rw-r-- 1 user user 49536 Apr 13 2008 f0083456.exe
-rw-rw-r-- 1 user user 63744 Apr 13 2008 f0083536.exe
-rw-rw-r-- 1 user user 42368 Apr 13 2008 f0083792.exe
-rw-rw-r-- 1 user user 38400 Apr 14 2008 f0083840.dll
-rw-rw-r-- 1 user user 105344 Apr 13 2008 f0084096.exe
-rw-rw-r-- 1 user user 10368 Apr 13 2008 f0084992.exe
-rw-rw-r-- 1 user user 28672 Apr 22 2009 f0087240.reg
-rw-rw-r-- 1 user user 278528 Jun 3 2011 f0087296.reg
-rw-rw-r-- 1 user user 5120 Jul 17 2010 f0087840.dll
-rw-rw-r-- 1 user user 61440 Jul 17 2010 f0088592.dll
-rw-rw-r-- 1 user user 121 May 18 21:20 f0089732.txt
-rw-rw-r-- 1 user user 1628 May 18 21:20 f0090258.java
-rw-rw-r-- 1 user user 121 May 18 21:20 f0090908.txt
-rw-rw-r-- 1 user user 126 May 18 21:20 f0091628.txt
-rw-rw-r-- 1 user user 1500 May 18 21:20 f0091946.java
-rw-rw-r-- 1 user user 3507 May 18 21:20 f0091952.txt
-rw-rw-r-- 1 user user 132 May 18 21:20 f0092332.txt
-rw-rw-r-- 1 user user 1511 May 18 21:20 f0092620.java
-rw-rw-r-- 1 user user 27648 Jul 17 2010 f0092712.exe
-rw-rw-r-- 1 user user 132 May 18 21:20 f0093228.txt
-rw-rw-r-- 1 user user 27648 Jul 17 2010 f0093328.exe
-rw-rw-r-- 1 user user 135168 Jul 17 2010 f0093808.dll
-rw-rw-r-- 1 user user 24576 Jul 17 2010 f0093936.exe
-rw-rw-r-- 1 user user 36352 Apr 13 2008 f0094032.exe
-rw-rw-r-- 1 user user 27648 Jul 17 2010 f0094368.exe
-rw-rw-r-- 1 user user 1652 May 18 21:20 f0094850.java
-rw-rw-r-- 1 user user 102400 Apr 22 2009 f0095064.reg
-rw-rw-r-- 1 user user 27648 Jul 17 2010 f0095328.exe
-rw-rw-r-- 1 user user 4415 May 18 21:20 f0101304.txt
-rw-rw-r-- 1 user user 459 May 18 21:20 f0112424.txt
-rw-rw-r-- 1 user user 575 May 18 21:20 f0114384.lnk
-rw-rw-r-- 1 user user 238 May 18 21:20 f0122018.txt
-rw-rw-r-- 1 user user 11264 Apr 14 2008 f0125984.dll
-rw-rw-r-- 1 user user 155648 Aug 16 2006 f0126896.exe
-rw-rw-r-- 1 user user 102400 Jul 17 2010 f0127024.dll
-rw-rw-r-- 1 user user 98304 Jul 20 2010 f0127456.pyc
-rw-rw-r-- 1 user user 8832 Aug 17 2001 f0130784.exe
-rw-rw-r-- 1 user user 1113 May 18 21:20 f0131666.txt
-rw-rw-r-- 1 user user 500 May 18 21:20 f0131670.txt
-rw-rw-r-- 1 user user 20608 Apr 13 2008 f0132032.exe
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0132632.txt
-rw-rw-r-- 1 user user 19072 Apr 13 2008 f0132640.exe
-rw-rw-r-- 1 user user 42368 Apr 13 2008 f0133232.exe
-rw-rw-r-- 1 user user 48384 Apr 13 2008 f0138248.exe
-rw-rw-r-- 1 user user 256 May 18 21:20 f0139090.txt
-rw-rw-r-- 1 user user 284 May 18 21:20 f0139114.txt
-rw-rw-r-- 1 user user 138112 Apr 13 2008 f0139824.exe
-rw-rw-r-- 1 user user 241664 May 18 21:20 f0142200.dbf
-rw-rw-r-- 1 user user 20480 Jul 17 2010 f0146680.dll
-rw-rw-r-- 1 user user 239104 Apr 14 2008 f0147912.dll
-rw-rw-r-- 1 user user 158 May 18 21:20 f0148790.txt
-rw-rw-r-- 1 user user 176640 Apr 14 2008 f0153240.dll
-rw-rw-r-- 1 user user 57344 Apr 14 2008 f0154232.dll
-rw-rw-r-- 1 user user 9216 Jan 13 2010 f0154496.exe
-rw-rw-r-- 1 user user 20480 Apr 13 2008 f0154856.exe
-rw-rw-r-- 1 user user 52352 Apr 13 2008 f0154904.exe
-rw-rw-r-- 1 user user 7040 Aug 17 2001 f0154968.dll
-rw-rw-r-- 1 user user 5888 Aug 17 2001 f0155024.exe
-rw-rw-r-- 1 user user 12288 Aug 17 2001 f0155176.dll
-rw-rw-r-- 1 user user 5504 Apr 13 2008 f0155472.exe
-rw-rw-r-- 1 user user 24960 Apr 13 2008 f0155488.exe
-rw-rw-r-- 1 user user 15488 Apr 13 2008 f0155928.exe
-rw-rw-r-- 1 user user 125056 Aug 17 2001 f0156168.exe
-rw-rw-r-- 1 user user 73472 Apr 13 2008 f0156616.exe
-rw-rw-r-- 1 user user 36352 Apr 13 2008 f0157088.exe
-rw-rw-r-- 1 user user 96384 Apr 13 2008 f0157096.exe
-rw-rw-r-- 1 user user 37248 Apr 13 2008 f0157240.exe
-rw-rw-r-- 1 user user 40704 Apr 13 2008 f0158024.dll
-rw-rw-r-- 1 user user 24576 Apr 13 2008 f0158344.exe
-rw-rw-r-- 1 user user 4736 Dec 1 2009 f0158456_vmmouse.sy.exe
-rw-rw-r-- 1 user user 23040 Apr 13 2008 f0158496.exe
-rw-rw-r-- 1 user user 80128 Apr 13 2008 f0158576.exe
-rw-rw-r-- 1 user user 62976 Apr 13 2008 f0158656.exe
-rw-rw-r-- 1 user user 15744 Apr 13 2008 f0158928.exe
-rw-rw-r-- 1 user user 42112 Apr 13 2008 f0159064.exe
-rw-rw-r-- 1 user user 64512 Apr 13 2008 f0159248.exe
-rw-rw-r-- 1 user user 141056 Apr 13 2008 f0159440.dll
-rw-rw-r-- 1 user user 57600 Apr 13 2008 f0159832.exe
-rw-rw-r-- 1 user user 21376 Apr 22 2010 f0159936_vmx_svga.sys
-rw-rw-r-- 1 user user 81664 Apr 13 2008 f0159984_videoprt.sys
-rw-rw-r-- 1 user user 20608 Apr 13 2008 f0160152_USBUHCI.sys
-rw-rw-r-- 1 user user 45056 May 18 21:20 f0160224.exe
-rw-rw-r-- 1 user user 54784 Sep 1 2009 f0160312.exe
-rw-rw-r-- 1 user user 30208 Jan 23 2009 f0160488.exe
-rw-rw-r-- 1 user user 40704 Jul 20 2001 f0160576.exe
-rw-rw-r-- 1 user user 182656 Apr 13 2008 f0160728.exe
-rw-rw-r-- 1 user user 9216 Jan 13 2010 f0161368.exe
-rw-rw-r-- 1 user user 621 May 18 21:20 f0161768.xml
-rw-rw-r-- 1 user user 1862 May 18 21:20 f0161776.xml
-rw-rw-r-- 1 user user 4120 May 18 21:20 f0163256.evt
-rw-rw-r-- 1 user user 88 May 18 21:20 f0163264.evt
-rw-rw-r-- 1 user user 88 May 18 21:20 f0163272.evt
-rw-rw-r-- 1 user user 88 May 18 21:20 f0163280.evt
-rw-rw-r-- 1 user user 24576 Oct 29 2010 f0163296.reg
-rw-rw-r-- 1 user user 25088 Apr 14 2008 f0163528.dll
-rw-rw-r-- 1 user user 16384 Oct 29 2010 f0163768.reg
-rw-rw-r-- 1 user user 245248 Apr 14 2008 f0163800.dll
-rw-rw-r-- 1 user user 344064 Apr 14 2008 f0163808.dll
-rw-rw-r-- 1 user user 19456 Apr 14 2008 f0163816.dll
-rw-rw-r-- 1 user user 16896 Apr 14 2008 f0163824.dll
-rw-rw-r-- 1 user user 18432 Apr 14 2008 f0163960.dll
-rw-rw-r-- 1 user user 62976 Apr 13 2008 f0164800.exe
-rw-rw-r-- 1 user user 64512 Apr 13 2008 f0164840.exe
-rw-rw-r-- 1 user user 53248 Oct 29 2010 f0164904.reg
-rw-rw-r-- 1 user user 27392 Apr 13 2008 f0165544_fdc.sys
-rw-rw-r-- 1 user user 15744 Apr 13 2008 f0166008.exe
-rw-rw-r-- 1 user user 9216 Jan 13 2010 f0166360.exe
-rw-rw-r-- 1 user user 3072 May 18 21:20 f0166418.txt
-rw-rw-r-- 1 user user 42112 Apr 13 2008 f0166432.exe
-rw-rw-r-- 1 user user 54784 Sep 1 2009 f0166576_vmci.sys
-rw-rw-r-- 1 user user 2048 May 18 21:20 f0166828.txt
-rw-rw-r-- 1 user user 21376 Apr 22 2010 f0166944.exe
-rw-rw-r-- 1 user user 141056 Apr 13 2008 f0166952.dll
-rw-rw-r-- 1 user user 718 May 18 21:20 f0167424.xml
-rw-rw-r-- 1 user user 30208 Jan 23 2009 f0167480.exe
-rw-rw-r-- 1 user user 60160 Apr 13 2008 f0167504.dll
-rw-rw-r-- 1 user user 52736 Apr 14 2008 f0167672.dll
-rw-rw-r-- 1 user user 214528 Apr 13 2008 f0167768.exe
-rw-rw-r-- 1 user user 383488 Apr 14 2008 f0167984.dll
-rw-rw-r-- 1 user user 102400 Apr 14 2008 f0168848.dll
-rw-rw-r-- 1 user user 80896 Apr 14 2008 f0169288.dll
-rw-rw-r-- 1 user user 133 May 18 21:20 f0169484.txt
-rw-rw-r-- 1 user user 3756 May 18 21:20 f0169560.txt
-rw-rw-r-- 1 user user 135168 Oct 29 2010 f0169984.reg
-rw-rw-r-- 1 user user 625664 Apr 14 2008 f0170384.dll
-rw-rw-r-- 1 user user 126976 Apr 14 2008 f0170408.dll
-rw-rw-r-- 1 user user 18944 Apr 14 2008 f0171056.dll
-rw-rw-r-- 1 user user 811 May 18 21:20 f0171972.txt
-rw-rw-r-- 1 user user 228 May 18 21:20 f0171974.txt
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0172496.txt
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0172528.txt
-rw-rw-r-- 1 user user 135168 Apr 14 2008 f0172584.dll
-rw-rw-r-- 1 user user 22528 Apr 14 2008 f0172680.dll
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0172920.txt
-rw-rw-r-- 1 user user 4608 Apr 14 2008 f0172960_gdiext
-rw-rw-r-- 1 user user 24576 Apr 14 2008 f0174096.dll
-rw-rw-r-- 1 user user 10624 Jan 25 2010 f0174648.exe
-rw-rw-r-- 1 user user 62464 Apr 14 2008 f0181384.dll
-rw-rw-r-- 1 user user 19968 Apr 14 2008 f0181688.dll
-rw-rw-r-- 1 user user 16384 May 18 21:20 f0181800.dat
-rw-rw-r-- 1 user user 16384 May 18 21:20 f0181832.dat
-rw-rw-r-- 1 user user 16896 Apr 13 2008 f0182192.dll
-rw-rw-r-- 1 user user 39424 Apr 14 2008 f0182296.dll
-rw-rw-r-- 1 user user 99840 Apr 14 2008 f0182656.dll
-rw-rw-r-- 1 user user 60416 Apr 14 2008 f0182664.dll
-rw-rw-r-- 1 user user 44032 Aug 18 2001 f0183048_MSXML3R.dll
-rw-rw-r-- 1 user user 299520 Apr 14 2008 f0183240.dll
-rw-rw-r-- 1 user user 41472 Apr 13 2008 f0183560.exe
-rw-rw-r-- 1 user user 3072 May 18 21:20 f0183970.txt
-rw-rw-r-- 1 user user 43520 Apr 14 2008 f0184144.dll
-rw-rw-r-- 1 user user 198144 Apr 14 2008 f0184792.dll
-rw-rw-r-- 1 user user 180608 Apr 13 2008 f0185136.exe
-rw-rw-r-- 1 user user 540672 May 18 21:20 f0185312.exe
-rw-rw-r-- 1 user user 32768 May 18 21:20 f0186368.dat
-rw-rw-r-- 1 user user 211 May 18 21:20 f0187246.java
-rw-rw-r-- 1 user user 218112 Apr 13 2008 f0187464.exe
-rw-rw-r-- 1 user user 159744 Aug 4 2010 f0187608.pyc
-rw-rw-r-- 1 user user 190 May 18 21:20 f0200696.txt
-rw-rw-r-- 1 user user 152 May 18 21:20 f0201034.txt
-rw-rw-r-- 1 user user 105 May 18 21:20 f0205176.txt
-rw-rw-r-- 1 user user 146048 Apr 13 2008 f0213400.dll
-rw-rw-r-- 1 user user 30208 Apr 13 2008 f0213872_USBEHCI.sys.exe
-rw-rw-r-- 1 user user 13952 Apr 13 2008 f0213960.exe
-rw-rw-r-- 1 user user 3072 Aug 17 2001 f0214000_audstub.sys
-rw-rw-r-- 1 user user 60160 Apr 13 2008 f0214224.dll
-rw-rw-r-- 1 user user 41472 Apr 13 2008 f0214384_raspppoe.sys
-rw-rw-r-- 1 user user 48384 Apr 13 2008 f0214504.exe
-rw-rw-r-- 1 user user 10112 Apr 13 2008 f0214680.exe
-rw-rw-r-- 1 user user 91520 Apr 13 2008 f0214712.exe
-rw-rw-r-- 1 user user 17792 Aug 17 2001 f0215024.exe
-rw-rw-r-- 1 user user 51328 Apr 13 2008 f0215056.exe
-rw-rw-r-- 1 user user 69120 Apr 13 2008 f0215192.exe
-rw-rw-r-- 1 user user 35072 Apr 13 2008 f0215328.exe
-rw-rw-r-- 1 user user 19072 Apr 13 2008 f0215624_tdi.sys
-rw-rw-r-- 1 user user 5501 May 18 21:20 f0215928.txt
-rw-rw-r-- 1 user user 23040 Apr 13 2008 f0216088.exe
-rw-rw-r-- 1 user user 16512 Aug 17 2001 f0216128_raspti.sys
-rw-rw-r-- 1 user user 196224 Apr 13 2008 f0216192.exe
-rw-rw-r-- 1 user user 4352 Apr 13 2008 f0216200_swenum.sys
-rw-rw-r-- 1 user user 40704 Apr 13 2008 f0216632.dll
-rw-rw-r-- 1 user user 144 May 18 21:20 f0217488.txt
-rw-rw-r-- 1 user user 190 May 18 21:20 f0218138.txt
-rw-rw-r-- 1 user user 393216 May 18 21:20 f0218480.class
-rw-rw-r-- 1 user user 16896 Apr 14 2008 f0219248.dll
-rw-rw-r-- 1 user user 4352 Aug 17 2001 f0220872_WmiLib.sys
-rw-rw-r-- 1 user user 10240 Apr 13 2008 f0220896.exe
-rw-rw-r-- 1 user user 68224 Apr 13 2008 f0220912.exe
-rw-rw-r-- 1 user user 187776 Apr 13 2008 f0221272.exe
-rw-rw-r-- 1 user user 153344 Apr 13 2008 f0222640.exe
-rw-rw-r-- 1 user user 706048 Apr 14 2008 f0222936.dll
-rw-rw-r-- 1 user user 40576 Apr 13 2008 f0223032.exe
-rw-rw-r-- 1 user user 328 May 18 21:20 f0225728.txt
-rw-rw-r-- 1 user user 3005952 May 5 2010 f0225968.exe
-rw-rw-r-- 1 user user 20480 Aug 18 2001 f0226264.dll
-rw-rw-r-- 1 user user 2065792 Apr 13 2008 f0229248.exe
-rw-rw-r-- 1 user user 16896 Apr 14 2008 f0229696.dll
-rw-rw-r-- 1 user user 3584 Aug 18 2001 f0232592_riched32.dll
-rw-rw-r-- 1 user user 47872 Mar 20 2010 f0237800.exe
-rw-rw-r-- 1 user user 477 May 18 21:20 f0240760.txt
-rw-rw-r-- 1 user user 3584 Aug 18 2001 f0241744.dll
-rw-rw-r-- 1 user user 590 May 18 21:20 f0243238.txt
-rw-rw-r-- 1 user user 465 May 18 21:20 f0244784.txt
-rw-rw-r-- 1 user user 829 May 18 21:20 f0244788.txt
-rw-rw-r-- 1 user user 46592 Sep 15 2010 f0245064.dll
-rw-rw-r-- 1 user user 135168 Jun 3 2011 f0245192.reg
-rw-rw-r-- 1 user user 77824 Sep 15 2010 f0245480.dll
-rw-rw-r-- 1 user user 323584 Sep 15 2010 f0245488.dll
-rw-rw-r-- 1 user user 15872 Sep 15 2010 f0245496.dll
-rw-rw-r-- 1 user user 126976 Sep 15 2010 f0245504.dll
-rw-rw-r-- 1 user user 139264 Sep 15 2010 f0245512.exe
-rw-rw-r-- 1 user user 68096 Apr 14 2008 f0246408.dll
-rw-rw-r-- 1 user user 40960 Apr 14 2008 f0246512.dll
-rw-rw-r-- 1 user user 437248 Apr 14 2008 f0247416.dll
-rw-rw-r-- 1 user user 87040 Apr 14 2008 f0248152.dll
-rw-rw-r-- 1 user user 9216 Apr 14 2008 f0248712.dll
-rw-rw-r-- 1 user user 81920 Mar 21 2010 f0248736.dll
-rw-rw-r-- 1 user user 94208 Apr 13 2008 f0249600.dll
-rw-rw-r-- 1 user user 32256 Apr 14 2008 f0250248.dll
-rw-rw-r-- 1 user user 118784 Apr 14 2008 f0250720.dll
-rw-rw-r-- 1 user user 117 May 18 21:20 f0250992.txt
-rw-rw-r-- 1 user user 55808 Apr 13 2008 f0251056.exe
-rw-rw-r-- 1 user user 17408 Apr 14 2008 f0251464.dll
-rw-rw-r-- 1 user user 175104 Apr 14 2008 f0251656.dll
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0252448.java
-rw-rw-r-- 1 user user 193536 Apr 14 2008 f0252720.dll
-rw-rw-r-- 1 user user 19456 Apr 14 2008 f0253288.dll
-rw-rw-r-- 1 user user 138752 Mar 18 2008 f0253328.dll
-rw-rw-r-- 1 user user 108544 Apr 13 2008 f0253536.exe
-rw-rw-r-- 1 user user 71680 Apr 14 2008 f0254488.dll
-rw-rw-r-- 1 user user 28672 Apr 13 2008 f0256496.exe
-rw-rw-r-- 1 user user 13312 Apr 13 2008 f0256528.exe
-rw-rw-r-- 1 user user 761 May 18 21:20 f0256848.lnk
-rw-rw-r-- 1 user user 398 May 18 21:20 f0256856.lnk
-rw-rw-r-- 1 user user 806 May 18 21:20 f0257320.lnk
-rw-rw-r-- 1 user user 778 May 18 21:20 f0257328.lnk
-rw-rw-r-- 1 user user 776 May 18 21:20 f0257336.lnk
-rw-rw-r-- 1 user user 778 May 18 21:20 f0257344.lnk
-rw-rw-r-- 1 user user 770 May 18 21:20 f0257352.lnk
-rw-rw-r-- 1 user user 773 May 18 21:20 f0257360.lnk
-rw-rw-r-- 1 user user 778 May 18 21:20 f0257368.lnk
-rw-rw-r-- 1 user user 774 May 18 21:20 f0257376.lnk
-rw-rw-r-- 1 user user 786 May 18 21:20 f0257384.lnk
-rw-rw-r-- 1 user user 769 May 18 21:20 f0257432.lnk
-rw-rw-r-- 1 user user 989 May 18 21:20 f0257440.lnk
-rw-rw-r-- 1 user user 753 May 18 21:20 f0257448.lnk
-rw-rw-r-- 1 user user 738 May 18 21:20 f0257456.lnk
-rw-rw-r-- 1 user user 150 May 18 21:20 f0257584.java
-rw-rw-r-- 1 user user 84 May 18 21:20 f0257592.ini
-rw-rw-r-- 1 user user 782 May 18 21:20 f0257672.lnk
-rw-rw-r-- 1 user user 947 May 18 21:20 f0257680.lnk
-rw-rw-r-- 1 user user 800 May 18 21:20 f0257688.lnk
-rw-rw-r-- 1 user user 755 May 18 21:20 f0257728.lnk
-rw-rw-r-- 1 user user 769 May 18 21:20 f0257736.lnk
-rw-rw-r-- 1 user user 386 May 18 21:20 f0257744.lnk
-rw-rw-r-- 1 user user 769 May 18 21:20 f0257752.lnk
-rw-rw-r-- 1 user user 777 May 18 21:20 f0257760.lnk
-rw-rw-r-- 1 user user 675 May 18 21:20 f0257768.lnk
-rw-rw-r-- 1 user user 758 May 18 21:20 f0257776.lnk
-rw-rw-r-- 1 user user 769 May 18 21:20 f0257784.lnk
-rw-rw-r-- 1 user user 793 May 18 21:20 f0257792.lnk
-rw-rw-r-- 1 user user 606 May 18 21:20 f0257808.lnk
-rw-rw-r-- 1 user user 996 May 18 21:20 f0257832.lnk
-rw-rw-r-- 1 user user 788 May 18 21:20 f0257840.lnk
-rw-rw-r-- 1 user user 32256 Apr 13 2008 f0257928.dll
-rw-rw-r-- 1 user user 609 May 18 21:20 f0258096.lnk
-rw-rw-r-- 1 user user 796 May 18 21:20 f0258136.lnk
-rw-rw-r-- 1 user user 718 May 18 21:20 f0258192.lnk
-rw-rw-r-- 1 user user 718 May 18 21:20 f0258200.lnk
-rw-rw-r-- 1 user user 949 May 18 21:20 f0258216.lnk
-rw-rw-r-- 1 user user 916 May 18 21:20 f0258224.lnk
-rw-rw-r-- 1 user user 824 May 18 21:20 f0258232.lnk
-rw-rw-r-- 1 user user 938 May 18 21:20 f0258240.lnk
-rw-rw-r-- 1 user user 751 May 18 21:20 f0258248.lnk
-rw-rw-r-- 1 user user 718 May 18 21:20 f0258256.lnk
-rw-rw-r-- 1 user user 713 May 18 21:20 f0258264.lnk
-rw-rw-r-- 1 user user 718 May 18 21:20 f0258272.lnk
-rw-rw-r-- 1 user user 52736 Apr 13 2008 f0258440.dll
-rw-rw-r-- 1 user user 511 May 18 21:20 f0258632.lnk
-rw-rw-r-- 1 user user 713 May 18 21:20 f0258656.lnk
-rw-rw-r-- 1 user user 718 May 18 21:20 f0258664.lnk
-rw-rw-r-- 1 user user 697 May 18 21:20 f0258672.lnk
-rw-rw-r-- 1 user user 715 May 18 21:20 f0258680.lnk
-rw-rw-r-- 1 user user 710 May 18 21:20 f0258688.lnk
-rw-rw-r-- 1 user user 103 May 18 21:20 f0259482.txt
-rw-rw-r-- 1 user user 40576 Apr 13 2008 f0259872.exe
-rw-rw-r-- 1 user user 15488 Apr 13 2008 f0260136.exe
-rw-rw-r-- 1 user user 4736 Aug 17 2001 f0260824_usbd.sys
-rw-rw-r-- 1 user user 18432 Apr 14 2008 f0261112.dll
-rw-rw-r-- 1 user user 4608 Apr 14 2008 f0261944.dll
-rw-rw-r-- 1 user user 23552 Apr 14 2008 f0262104.dll
-rw-rw-r-- 1 user user 13824 Aug 1 2010 f0262648.dll
-rw-rw-r-- 1 user user 11776 Apr 14 2008 f0263856.dll
-rw-rw-r-- 1 user user 75264 Apr 14 2008 f0263864.dll
-rw-rw-r-- 1 user user 47104 Apr 14 2008 f0264296.dll
-rw-rw-r-- 1 user user 15360 Apr 14 2008 f0264304.dll
-rw-rw-r-- 1 user user 45568 Apr 14 2008 f0264312.dll
-rw-rw-r-- 1 user user 311296 Oct 28 2009 f0264320.dll
-rw-rw-r-- 1 user user 4736 Dec 1 2009 f0265248_vmmouse.sys
-rw-rw-r-- 1 user user 20480 Apr 13 2008 f0265728.exe
-rw-rw-r-- 1 user user 599040 Apr 14 2008 f0266240.dll
-rw-rw-r-- 1 user user 348160 Feb 21 2003 f0267264.dll
-rw-rw-r-- 1 user user 65536 Aug 1 2010 f0268288.dll
-rw-rw-r-- 1 user user 13952 Apr 13 2008 f0268360.exe
-rw-rw-r-- 1 user user 49664 May 4 2007 f0268800.dll
-rw-rw-r-- 1 user user 43520 Aug 1 2010 f0270664.exe
-rw-rw-r-- 1 user user 348160 Feb 21 2003 f0270696.dll
-rw-rw-r-- 1 user user 310 May 18 21:20 f0271650.txt
-rw-rw-r-- 1 user user 282 May 18 21:20 f0273876.txt
-rw-rw-r-- 1 user user 426 May 18 21:20 f0274496.txt
-rw-rw-r-- 1 user user 73 May 18 21:20 f0274498.java
-rw-rw-r-- 1 user user 49536 Apr 13 2008 f0276296.exe
-rw-rw-r-- 1 user user 147456 Sep 15 2010 f0277128.exe
-rw-rw-r-- 1 user user 498176 Mar 1 2010 f0277432.dll
-rw-rw-r-- 1 user user 129792 Apr 13 2008 f0277624.dll
-rw-rw-r-- 1 user user 92672 Apr 14 2008 f0277680.dll
-rw-rw-r-- 1 user user 144896 Apr 14 2008 f0277688.dll
-rw-rw-r-- 1 user user 163840 Apr 14 2008 f0277848.dll
-rw-rw-r-- 1 user user 69632 Feb 3 2009 f0278312.dll
-rw-rw-r-- 1 user user 534 May 18 21:20 f0278950.txt
-rw-rw-r-- 1 user user 60800 Apr 13 2008 f0279304.exe
-rw-rw-r-- 1 user user 116224 Apr 14 2008 f0282048.dll
-rw-rw-r-- 1 user user 144 May 18 21:20 f0282276.txt
-rw-rw-r-- 1 user user 154 May 18 21:20 f0282278.txt
-rw-rw-r-- 1 user user 52480 Apr 13 2008 f0282544.exe
-rw-rw-r-- 1 user user 135987 May 18 21:20 f0283192.ttf
-rw-rw-r-- 1 user user 64512 Apr 14 2008 f0283224.dll
-rw-rw-r-- 1 user user 105344 Apr 13 2008 f0283624.exe
-rw-rw-r-- 1 user user 6144 Apr 13 2008 f0283864.exe
-rw-rw-r-- 1 user user 237056 Apr 14 2008 f0285016.dll
-rw-rw-r-- 1 user user 61440 Apr 14 2008 f0285368.dll
-rw-rw-r-- 1 user user 706048 Apr 14 2008 f0286416.dll
-rw-rw-r-- 1 user user 16896 Apr 14 2008 f0287600.dll
-rw-rw-r-- 1 user user 131 May 18 21:20 f0288396.txt
-rw-rw-r-- 1 user user 487 May 18 21:20 f0289886.txt
-rw-rw-r-- 1 user user 245 May 18 21:20 f0290354.txt
-rw-rw-r-- 1 user user 7680 Apr 14 2008 f0291256.dll
-rw-rw-r-- 1 user user 7168 Apr 14 2008 f0291904.dll
-rw-rw-r-- 1 user user 45568 Apr 14 2008 f0292064.dll
-rw-rw-r-- 1 user user 75264 Apr 14 2008 f0292160.dll
-rw-rw-r-- 1 user user 147968 Apr 14 2008 f0292368.dll
-rw-rw-r-- 1 user user 192512 Apr 14 2008 f0292976.dll
-rw-rw-r-- 1 user user 10496 Aug 17 2001 f0294816.exe
-rw-rw-r-- 1 user user 347 May 18 21:20 f0294842.txt
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0294976.txt
-rw-rw-r-- 1 user user 34560 Apr 13 2008 f0295936.exe
-rw-rw-r-- 1 user user 30208 Apr 13 2008 f0296248.exe
-rw-rw-r-- 1 user user 117 May 18 21:20 f0297166.txt
-rw-rw-r-- 1 user user 143360 Apr 14 2008 f0297360.dll
-rw-rw-r-- 1 user user 512 May 18 21:20 f0297768.txt
-rw-rw-r-- 1 user user 246272 Apr 14 2008 f0297872.dll
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0298576.txt
-rw-rw-r-- 1 user user 119 May 18 21:20 f0298830.txt
-rw-rw-r-- 1 user user 23040 Apr 14 2008 f0299376.dll
-rw-rw-r-- 1 user user 132096 Apr 14 2008 f0299472.dll
-rw-rw-r-- 1 user user 3072 May 18 21:20 f0300010.txt
-rw-rw-r-- 1 user user 876 May 18 21:20 f0300344.java
-rw-rw-r-- 1 user user 772 May 18 21:20 f0300346.java
-rw-rw-r-- 1 user user 772 May 18 21:20 f0300348.java
-rw-rw-r-- 1 user user 163 May 18 21:20 f0300350.txt
-rw-rw-r-- 1 user user 23552 Apr 14 2008 f0300352.dll
-rw-rw-r-- 1 user user 266 May 18 21:20 f0300688.java
-rw-rw-r-- 1 user user 155 May 18 21:20 f0300692.txt
-rw-rw-r-- 1 user user 195 May 18 21:20 f0300694.txt
-rw-rw-r-- 1 user user 897 May 18 21:20 f0301136.java
-rw-rw-r-- 1 user user 818 May 18 21:20 f0301138.java
-rw-rw-r-- 1 user user 238 May 18 21:20 f0301140.java
-rw-rw-r-- 1 user user 381 May 18 21:20 f0301142.java
-rw-rw-r-- 1 user user 194560 Apr 14 2008 f0301200.dll
-rw-rw-r-- 1 user user 4352 Apr 13 2008 f0301464_swenum.sys
-rw-rw-r-- 1 user user 69120 Apr 13 2008 f0301608.exe
-rw-rw-r-- 1 user user 4674 May 18 21:20 f0303124.txt
-rw-rw-r-- 1 user user 1024 May 18 21:20 f0303286.txt
-rw-rw-r-- 1 user user 586240 Apr 14 2008 f0304160.dll
-rw-rw-r-- 1 user user 1024 May 18 21:20 f0305378.txt
-rw-rw-r-- 1 user user 3072 May 18 21:20 f0305506.txt
-rw-rw-r-- 1 user user 25088 Apr 14 2008 f0305536.dll
-rw-rw-r-- 1 user user 37888 May 18 21:20 f0305598.class
-rw-rw-r-- 1 user user 91520 Apr 13 2008 f0305672.exe
-rw-rw-r-- 1 user user 1024 May 18 21:20 f0305898.txt
-rw-rw-r-- 1 user user 1024 May 18 21:20 f0305986.txt
-rw-rw-r-- 1 user user 2048 May 18 21:20 f0306444.txt
-rw-rw-r-- 1 user user 2048 May 18 21:20 f0306500.txt
-rw-rw-r-- 1 user user 1024 May 18 21:20 f0306610.txt
-rw-rw-r-- 1 user user 361472 Aug 18 2001 f0306888.dll
-rw-rw-r-- 1 user user 3072 May 18 21:20 f0307754.txt
-rw-rw-r-- 1 user user 48128 Apr 13 2008 f0307800_mspriv.dll
-rw-rw-r-- 1 user user 133 May 18 21:20 f0309226.txt
-rw-rw-r-- 1 user user 10112 Apr 13 2008 f0309248.exe
-rw-rw-r-- 1 user user 152832 Apr 13 2008 f0309576.exe
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0311144.txt
-rw-rw-r-- 1 user user 302 May 18 21:20 f0311836.java
-rw-rw-r-- 1 user user 223 May 18 21:20 f0312376.txt
-rw-rw-r-- 1 user user 179 May 18 21:20 f0312378.txt
-rw-rw-r-- 1 user user 197 May 18 21:20 f0312406.txt
-rw-rw-r-- 1 user user 512 May 18 21:20 f0312416.txt
-rw-rw-r-- 1 user user 512 May 18 21:20 f0313354.txt
-rw-rw-r-- 1 user user 590 May 18 21:20 f0313668.java
-rw-rw-r-- 1 user user 204 May 18 21:20 f0313670.txt
-rw-rw-r-- 1 user user 122 May 18 21:20 f0314920.txt
-rw-rw-r-- 1 user user 1024 May 18 21:20 f0314926.txt
-rw-rw-r-- 1 user user 722 May 18 21:20 f0318464.txt
-rw-rw-r-- 1 user user 107 May 18 21:20 f0319882.java
-rw-rw-r-- 1 user user 205 May 18 21:20 f0321136.txt
-rw-rw-r-- 1 user user 1316 May 18 21:20 f0321692.java
-rw-rw-r-- 1 user user 176 May 18 21:20 f0321716.txt
-rw-rw-r-- 1 user user 794 May 18 21:20 f0321746.txt
-rw-rw-r-- 1 user user 335 May 18 21:20 f0324132.txt
-rw-rw-r-- 1 user user 3072 May 18 21:20 f0325370.txt
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0325768.txt
-rw-rw-r-- 1 user user 2048 May 18 21:20 f0326628.txt
-rw-rw-r-- 1 user user 124 May 18 21:20 f0326834.txt
-rw-rw-r-- 1 user user 512 May 18 21:20 f0327058.txt
-rw-rw-r-- 1 user user 175 May 18 21:20 f0327578.txt
-rw-rw-r-- 1 user user 127 May 18 21:20 f0328364.txt
-rw-rw-r-- 1 user user 458 May 18 21:20 f0328366.txt
-rw-rw-r-- 1 user user 1809 May 18 21:20 f0329864.txt
-rw-rw-r-- 1 user user 34304 Apr 14 2008 f0329952.dll
-rw-rw-r-- 1 user user 1178 May 18 21:20 f0330288.txt
-rw-rw-r-- 1 user user 2048 May 18 21:20 f0330292.txt
-rw-rw-r-- 1 user user 44032 Apr 14 2008 f0330440.dll
-rw-rw-r-- 1 user user 456576 Apr 13 2008 f0330768.exe
-rw-rw-r-- 1 user user 513 May 18 21:20 f0332470.txt
-rw-rw-r-- 1 user user 4096 May 18 21:20 f0332848.txt
-rw-rw-r-- 1 user user 24576 Apr 13 2008 f0333608_kbdclass.sys
-rw-rw-r-- 1 user user 10624 Apr 13 2008 f0334224.exe
-rw-rw-r-- 1 user user 4224 Aug 17 2001 f0335040_videosim.sys
-rw-rw-r-- 1 user user 7936 Aug 17 2001 f0335384_fs_rec.sys
-rw-rw-r-- 1 user user 2944 Aug 17 2001 f0335424_null.sys
-rw-rw-r-- 1 user user 4224 Aug 17 2001 f0335432_beep.sys
-rw-rw-r-- 1 user user 20992 Apr 13 2008 f0335448_vga.sys
-rw-rw-r-- 1 user user 4224 Aug 17 2001 f0335568_RDPCDD.SYS
-rw-rw-r-- 1 user user 19072 Apr 13 2008 f0336096.exe
-rw-rw-r-- 1 user user 30848 Apr 13 2008 f0336152.exe
-rw-rw-r-- 1 user user 8832 Aug 17 2001 f0336232_rasacd.sys
-rw-rw-r-- 1 user user 75264 Apr 13 2008 f0336272.exe
-rw-rw-r-- 1 user user 34688 Apr 13 2008 f0337848_NETBIOS.SYS
-rw-rw-r-- 1 user user 12032 Aug 17 2001 f0338048.exe
-rw-rw-r-- 1 user user 295424 Apr 14 2008 f0338664.dll
-rw-rw-r-- 1 user user 456576 Apr 13 2008 f0338880.exe
-rw-rw-r-- 1 user user 122496 Aug 1 2010 f0338960.exe
-rw-rw-r-- 1 user user 44544 Apr 13 2008 f0339184.exe
-rw-rw-r-- 1 user user 30720 Apr 14 2008 f0339640.dll
-rw-rw-r-- 1 user user 44544 Apr 13 2008 f0339792_fips.sys
-rw-rw-r-- 1 user user 152832 Apr 13 2008 f0340712.exe
-rw-rw-r-- 1 user user 34560 Apr 13 2008 f0340864.exe
-rw-rw-r-- 1 user user 19840 Jan 1 2009 f0341176.exe
-rw-rw-r-- 1 user user 4096 Jun 3 2011 f0342432.reg
-rw-rw-r-- 1 user user 14208 Apr 13 2008 f0342712_diskdump.sys
-rw-rw-r-- 1 user user 11264 Nov 13 2008 f0342744_vmscsi.sys
-rw-rw-r-- 1 user user 4096 Oct 30 2010 f0342856.reg
-rw-rw-r-- 1 user user 4096 Oct 30 2010 f0342864.reg
-rw-rw-r-- 1 user user 352256 Jun 3 2011 f0342872.reg
-rw-rw-r-- 1 user user 63744 Apr 13 2008 f0343560.exe
-rw-rw-r-- 1 user user 175744 Apr 13 2008 f0344576.exe
-rw-rw-r-- 1 user user 115 May 18 21:20 f0359988.txt
-rw-rw-r-- 1 user user 133 May 18 21:20 f0359996.txt
-rw-rw-r-- 1 user user 12288 Oct 31 2010 f0406392.reg
-rw-rw-r-- 1 user user 229376 Jun 3 2011 f0406416.reg
-rw-rw-r-- 1 user user 4096 Oct 29 2010 f0406864.reg
-rw-rw-r-- 1 user user 4096 Oct 29 2010 f0406872.reg
-rw-rw-r-- 1 user user 4509696 Oct 31 2010 f0406880.reg
-rw-rw-r-- 1 user user 10496 Aug 17 2001 f0415688.exe
-rw-rw-r-- 1 user user 3328 Aug 17 2001 f0416024_dxgthk.sys
-rw-rw-r-- 1 user user 17664 Apr 13 2008 f0416232.exe
-rw-rw-r-- 1 user user 24960 Apr 13 2008 f0416528.dll
-rw-rw-r-- 1 user user 12160 Aug 17 2001 f0417152.exe
-rw-rw-r-- 1 user user 10368 Apr 13 2008 f0417968.exe
-rw-rw-r-- 1 user user 0 May 18 21:32 files.txt
-rw-rw-r-- 1 user user 2360885 May 18 21:20 report.xml

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Photorec - recoverd filename doesnt match logfile/result

#4 Post by cgrenier »

Please use 7.1-WIP, not 7.0.
This version is listed at the bottom of the page http://www.cgsecurity.org/wiki/TestDisk_Download

w2k8
Posts: 3
Joined: 18 May 2015, 13:03

Re: Photorec - recoverd filename doesnt match logfile/result

#5 Post by w2k8 »

Hi,

Thanks, the filenames from the logfiles and the report.xml do match the filenames on the disk.

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
<metadata
xmlns='http://www.forensicswiki.org/wiki/Categ ... ensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.1-WIP</version>
<build_environment>
<compiler>GCC 4.4</compiler>
<library name='libext2fs' version='1.42.8'/>
<library name='libewf' version='20120504'/>
<library name='libjpeg' version='libjpeg-turbo-1.3.1'/>
<library name='libntfs' version='libntfs-3g'/>
</build_environment>
<execution_environment>
<os_sysname>Linux</os_sysname>
<os_release>3.13.0-52-generic</os_release>
<os_version>#86-Ubuntu SMP Mon May 4 04:32:15 UTC 2015</os_version>
<host>ds01</host>
<arch>i686</arch>
<uid>1000</uid>
<start_time>2015-05-19T18:32:27+0200</start_time>
</execution_environment>
</creator>
<source>
<image_filename>stuxnet.vmem</image_filename>
<sectorsize>512</sectorsize>
<image_size>536870912</image_size>
<volume>
<byte_runs>
<byte_run offset='0' img_offset='0' len='536870912'/>
</byte_runs>
</volume>
</source>


<fileobject>
<filename>f0335424_null.sys</filename>
<filesize>2944</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171737088' len='3072'/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0335432_beep.sys</filename>
<filesize>4224</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171741184' len='5120'/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0335448_vga.sys</filename>
<filesize>20992</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171749376' len='21504'/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0335568_RDPCDD.SYS</filename>
<filesize>4224</filesize>
<byte_runs>
<byte_run offset='0' img_offset='171810816' len='5120'/>
</byte_runs>
</fileobject>

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Photorec - recoverd filename doesnt match logfile/result

#6 Post by cgrenier »

The problem looks solved in 7.1-WIP: your file listing shows
<pre>
-rw-rw-r-- 1 user user 4224 Aug 17 2001 f0335568_RDPCDD.SYS
</pre>
and the XML file lists <code>f0335568_RDPCDD.SYS</code>.

Locked