cgsecurity.org

I'm new here.

I just used QPhotoRec (on Windows) to recover jpg and tif files from a "raw" hard drive with apparently a damaged MFT (which Testdisk couldn't fix).

My question is: The photo image files have all been renamed (with numbers) The numbers aren't sequential as they appear on screen... but is the order they appear the same as the order they were on the drive originally? There are several hundred photos per sequence (time lapse sequences) and the changes are miniscule from one to the next hence I need to know the best way to determine the original shooting sequence.

Any suggestions appreciated.

You might have found the answer here:

https://www.cgsecurity.org/testdisk.pdf

11.11 PhotoRec: file name and date

The number is calculated by using the file location minus the partition offset divided by the block size.For some filesystems like NTFS, exFAT, ext2/3/4, this number may be identical to the original cluster/blocknumber.

Simplified, the number represents a relative cluster-type position with regards to the beginning of the partition in question.
If you have never fragmented your drive, only written one image after another on an empty partition the number represents the time series in rising order.

Thanks for your help