Recovered nameless files and $MFT after recovery, how to reassemble?

I formatted a SATA drive accidentally, but was able to recover my files, although they are all FILE001, FILE002... etc. I did some more recovery and was able to obtain the $MFT and $Logfile files, my question is; How do I reassemble these so that the file names are restored? Is it possible? Here is an image of the MFT folder recovered:
5 answers Last reply
More about recovered nameless files recovery reassemble
  1. $ indicates temporary files - the names are likely correct already
  2. mdsiu said:
    $ indicates temporary files - the names are likely correct already

    Thank You for your reply, however the file names are not corrected. The raw nameless files reside in two other folders called 3 NTFS and 4 NTFS, they are then split into file types within folders (see image) I suppose my question is: how do I make the raw recovered files "see" the MFT?
  3. The $ files are NTFS metafiles, not temporary files.

    See http://en.wikipedia.org/wiki/NTFS#Metafiles

    To the OP -- have you actually examined the $MFT with a hex editor?
  4. This can be as simple as renamine to a real pain in the butt.
    With the files recoverd from Chkdisk, if the file was a small file in some cases it could be recovered by simply renaming the file (supply the first character). Many of the files recovered are normally one cluster size and if the link to the suceeding clusters was not broken it could include the added clusters. If the files are recognizable then you can edit and resave using the program that created the file.
    Example say you have a .txt file that was several custers long, but is now two files. Then open up first , look at file and delete any garbage (normally apped to end of file)- save, then open up 2nd half do the same then combine the 2 files.
    Had a whole slew full of pictures I had to recover ie File001, file002. Had to open each one and edit ( the bottom portion was black (the last part of the cluster with no data) then resave with a new filename.

    If the file is a .dll, a .exe, or a binary file - I do not recomend trying to recover, as any kind of error in these files can have problems from not working to disabling your entire system.
  5. RetiredChief said:
    This can be as simple as renamine to a real pain in the butt.
    With the files recoverd from Chkdisk, if the file was a small file in some cases it could be recovered by simply renaming the file (supply the first character). Many of the files recovered are normally one cluster size and if the link to the suceeding clusters was not broken it could include the added clusters. If the files are recognizable then you can edit and resave using the program that created the file.
    Example say you have a .txt file that was several custers long, but is now two files. Then open up first , look at file and delete any garbage (normally apped to end of file)- save, then open up 2nd half do the same then combine the 2 files.
    Had a whole slew full of pictures I had to recover ie File001, file002. Had to open each one and edit ( the bottom portion was black (the last part of the cluster with no data) then resave with a new filename.

    If the file is a .dll, a .exe, or a binary file - I do not recomend trying to recover, as any kind of error in these files can have problems from not working to disabling your entire system.


    The files were primarily video files, AVI, MKV, WMV, etc. The were recovered using Piriform's Recuva software, not CHKDISK. I was trying to avoid having to rename all the files. in the 750 GB partition I lost.
Ask a new question

Read More

Hard Drives Data Recovery Storage