Sign in with
Sign up | Sign in
Your question

Recovered nameless files and $MFT after recovery, how to reassemble?

Last response: in Storage
Share
March 17, 2011 9:27:39 AM

I formatted a SATA drive accidentally, but was able to recover my files, although they are all FILE001, FILE002... etc. I did some more recovery and was able to obtain the $MFT and $Logfile files, my question is; How do I reassemble these so that the file names are restored? Is it possible? Here is an image of the MFT folder recovered:
March 17, 2011 3:54:47 PM

$ indicates temporary files - the names are likely correct already
m
0
l
March 17, 2011 9:06:07 PM

mdsiu said:
$ indicates temporary files - the names are likely correct already

Thank You for your reply, however the file names are not corrected. The raw nameless files reside in two other folders called 3 NTFS and 4 NTFS, they are then split into file types within folders (see image) I suppose my question is: how do I make the raw recovered files "see" the MFT?
m
0
l
Related resources
a c 353 G Storage
March 18, 2011 3:45:28 PM

This can be as simple as renamine to a real pain in the butt.
With the files recoverd from Chkdisk, if the file was a small file in some cases it could be recovered by simply renaming the file (supply the first character). Many of the files recovered are normally one cluster size and if the link to the suceeding clusters was not broken it could include the added clusters. If the files are recognizable then you can edit and resave using the program that created the file.
Example say you have a .txt file that was several custers long, but is now two files. Then open up first , look at file and delete any garbage (normally apped to end of file)- save, then open up 2nd half do the same then combine the 2 files.
Had a whole slew full of pictures I had to recover ie File001, file002. Had to open each one and edit ( the bottom portion was black (the last part of the cluster with no data) then resave with a new filename.

If the file is a .dll, a .exe, or a binary file - I do not recomend trying to recover, as any kind of error in these files can have problems from not working to disabling your entire system.
m
0
l
March 18, 2011 10:01:55 PM

RetiredChief said:
This can be as simple as renamine to a real pain in the butt.
With the files recoverd from Chkdisk, if the file was a small file in some cases it could be recovered by simply renaming the file (supply the first character). Many of the files recovered are normally one cluster size and if the link to the suceeding clusters was not broken it could include the added clusters. If the files are recognizable then you can edit and resave using the program that created the file.
Example say you have a .txt file that was several custers long, but is now two files. Then open up first , look at file and delete any garbage (normally apped to end of file)- save, then open up 2nd half do the same then combine the 2 files.
Had a whole slew full of pictures I had to recover ie File001, file002. Had to open each one and edit ( the bottom portion was black (the last part of the cluster with no data) then resave with a new filename.

If the file is a .dll, a .exe, or a binary file - I do not recomend trying to recover, as any kind of error in these files can have problems from not working to disabling your entire system.


The files were primarily video files, AVI, MKV, WMV, etc. The were recovered using Piriform's Recuva software, not CHKDISK. I was trying to avoid having to rename all the files. in the 750 GB partition I lost.
m
0
l
!