photorec recovered files naming convention

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zird
Posts: 1
Joined: 09 Jun 2015, 10:06

photorec recovered files naming convention

#1 Post by zird »

Hi,

I'm new to file carving and has just started using photorec for a project. Can anybody tell me what does the numbers after t/f of the names of recovered files represent? I am trying to map a list of file paths (retrieved from mft) to the files I have carved using photorec, any advice will be much appreciated!

Thank you very much

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: photorec recovered files naming convention

#2 Post by cgrenier »

- The number is the sector number.
- f=file
- t=jpg thumb
- b=broken file

Locked