[SW1]

Originally Posted by GDH

Hi,

Sorry I did not get back to you in the previous post. When spam gets posted here it screws up the notification of new postings.

1. Just because a recovered file has its original name and folder does not guarantee that it will be a valid file (e.g. it is possible that a MFT could screw up so that vaid file names point to the wrong location on the disk).

The only way to tell for sure is if you can either preview the file or open in with its creating application.

You can try Explorer View for Windows Explorer to view files - http://download.getdata.com/ExplorerView-Setup.exe - It previews about 300 different file types using the header recognition technique. It will also let you view at HEX mode if it does not understand the header.

2. The original file name is only stored in the MFT record for that file - so if the MFT record is destroyed, then you cannot know with any certainty what the file name was.

However, some files hold Meta Data inside the file structure - e.g.

* a digital camera picutre will hold the camera type, date taken, resolution etc.
* a Microsoft Word document has interal properties, date created, author, title;
* a MP3 music file has a tag - artists, duration, etc.

All of these interal properties can be used to help reaname files. There are programs like 123renamer.com that can automate the process. Or you can read the meta data using the HEX mode with Explorer View.

I hope this helps.

Hi Graham,

Thanks again for an EXCELLENT technical discussion.

I have some follow-up questions for further clarification of your comments. For most of the "normal" recovered files/file extensions (like MS Office, etc.), I can easily open those files with the "creating application" application, as you suggested.

However, my goals for the "non-normal recovered files" are as follows:

--Determine the file extensions and, hopefully, the corresponding creating applications of those recovered "Lost Files" (271 of which have been saved with "MFTXXXXX" files names). Because of only having an "MFTXXXXX" file name and no extension, I have no idea what the file extensions are on these recovered "Lost Files". Determining the file extensions might help me determine what these files contain, where they might have been used, and if I need them for any reason.

--Determine whether the "NON-COMMON RECOVERED FILES" (i.e Non-MS OFFICE files, Non-jpg files, etc.)--which DO HAVE file names and file extensions--are "usable" and not corrupted. Because I cannot open these files just by "clicking" on the file, I don't know if the files are corrupted. However, I want to have a way to determine if these files are "intact" and "not corrupted", so that if I can somehow re-build the application to which these files belong. I want to be sure that these files will be of use. For example, I want to be able to look at an "*.mab" file (a file name and file extension for a Netscape 7.2 address book) and see if that file is "intact" and "not corrupted" and will work if I try to re-build Netscape 7.2. There are other files like this which I would like to know if the files are NOT corrupted, but which do not "open" normally by just "clicking" on the application.

So, in regard to the above two goals, here are my questions:

1. When I install "Explorer View" for Windows Explorer to view files (as you suggested and downloaded from this URL) http://download.getdata.com/ExplorerView-Setup.exe
Will this "Explorer View" application open the "MFTXXXXX" files or "*.mab" (Netscape .2 address book files) in the correct application automatically, so that I can (1) change the "file extension" of the "MFTXXXX" files for the correct application, and (2) know whether the files which already have extensions (*.mab) are not corrupted?

2. Also, you indicated "There are programs like 123renamer.com that can automate the process". Will this "123 Renamer" program "DETERMINE" the correct file extensions by reading the META data in the "Lost Files" (MFTXXXXXX file names)? Or, does this program only "rename" files automatically for which I already know the file extensions?

Thanks again.