MFTXXXXX Lost Files--How to analyze and recover?

[SW1]

Hi Graham,

I had posted this on my original forum thread, but it is probably getting lost plus it is more specific, so I am re-posting it here.

A local computer store recovered my files using "Recover My Files" software. Quite impressive. They used the "MFT" scan approach.
QUESTIONS:
1. Can I assume that, if the folders and files were "recovered" and show with correct file name, that those folders/files are "intact" and NOT corrupted? The entire Netscape 7.2 file path was recovered....but I don't know if all the sub-files are corrupted or not?
2. All of the 271 "Lost Files" had the File Name format of "MFT XXXXX", where the X's are numbers. Is there a way to determine what these original files were so that I can re-constitute these files with the correct file extension and maybe salvage those 271 files?
Thanks.

[GDH]

Hi,

Sorry I did not get back to you in the previous post. When spam gets posted here it screws up the notification of new postings.

1. Just because a recovered file has its original name and folder does not guarantee that it will be a valid file (e.g. it is possible that a MFT could screw up so that vaid file names point to the wrong location on the disk).

The only way to tell for sure is if you can either preview the file or open in with its creating application.

You can try Explorer View for Windows Explorer to view files - http://download.getdata.com/ExplorerView-Setup.exe - It previews about 300 different file types using the header recognition technique. It will also let you view at HEX mode if it does not understand the header.

2. The original file name is only stored in the MFT record for that file - so if the MFT record is destroyed, then you cannot know with any certainty what the file name was.

However, some files hold Meta Data inside the file structure - e.g.

* a digital camera picutre will hold the camera type, date taken, resolution etc.
* a Microsoft Word document has interal properties, date created, author, title;
* a MP3 music file has a tag - artists, duration, etc.

All of these interal properties can be used to help reaname files. There are programs like 123renamer.com that can automate the process. Or you can read the meta data using the HEX mode with Explorer View.

I hope this helps.

[SW1]

Originally Posted by GDH

Hi,

Sorry I did not get back to you in the previous post. When spam gets posted here it screws up the notification of new postings.

1. Just because a recovered file has its original name and folder does not guarantee that it will be a valid file (e.g. it is possible that a MFT could screw up so that vaid file names point to the wrong location on the disk).

The only way to tell for sure is if you can either preview the file or open in with its creating application.

You can try Explorer View for Windows Explorer to view files - http://download.getdata.com/ExplorerView-Setup.exe - It previews about 300 different file types using the header recognition technique. It will also let you view at HEX mode if it does not understand the header.

2. The original file name is only stored in the MFT record for that file - so if the MFT record is destroyed, then you cannot know with any certainty what the file name was.

However, some files hold Meta Data inside the file structure - e.g.

* a digital camera picutre will hold the camera type, date taken, resolution etc.
* a Microsoft Word document has interal properties, date created, author, title;
* a MP3 music file has a tag - artists, duration, etc.

All of these interal properties can be used to help reaname files. There are programs like 123renamer.com that can automate the process. Or you can read the meta data using the HEX mode with Explorer View.

I hope this helps.

Hi Graham,

Thanks again for an EXCELLENT technical discussion.

I have some follow-up questions for further clarification of your comments. For most of the "normal" recovered files/file extensions (like MS Office, etc.), I can easily open those files with the "creating application" application, as you suggested.

However, my goals for the "non-normal recovered files" are as follows:

--Determine the file extensions and, hopefully, the corresponding creating applications of those recovered "Lost Files" (271 of which have been saved with "MFTXXXXX" files names). Because of only having an "MFTXXXXX" file name and no extension, I have no idea what the file extensions are on these recovered "Lost Files". Determining the file extensions might help me determine what these files contain, where they might have been used, and if I need them for any reason.

--Determine whether the "NON-COMMON RECOVERED FILES" (i.e Non-MS OFFICE files, Non-jpg files, etc.)--which DO HAVE file names and file extensions--are "usable" and not corrupted. Because I cannot open these files just by "clicking" on the file, I don't know if the files are corrupted. However, I want to have a way to determine if these files are "intact" and "not corrupted", so that if I can somehow re-build the application to which these files belong. I want to be sure that these files will be of use. For example, I want to be able to look at an "*.mab" file (a file name and file extension for a Netscape 7.2 address book) and see if that file is "intact" and "not corrupted" and will work if I try to re-build Netscape 7.2. There are other files like this which I would like to know if the files are NOT corrupted, but which do not "open" normally by just "clicking" on the application.

So, in regard to the above two goals, here are my questions:

1. When I install "Explorer View" for Windows Explorer to view files (as you suggested and downloaded from this URL) http://download.getdata.com/ExplorerView-Setup.exe
Will this "Explorer View" application open the "MFTXXXXX" files or "*.mab" (Netscape .2 address book files) in the correct application automatically, so that I can (1) change the "file extension" of the "MFTXXXX" files for the correct application, and (2) know whether the files which already have extensions (*.mab) are not corrupted?

2. Also, you indicated "There are programs like 123renamer.com that can automate the process". Will this "123 Renamer" program "DETERMINE" the correct file extensions by reading the META data in the "Lost Files" (MFTXXXXXX file names)? Or, does this program only "rename" files automatically for which I already know the file extensions?

Thanks again.

[GDH]

Hi,

1. Explorer View has its own viewing engines, so if it recognizes what type of file it is it will try and display it. If it does not recognize it, it will display it in HEX (text) mode.

The only way to know for sure if the files that you have recovered will work, is to research a way to use the original program to open the files. E.g, usually it is just a matter of determining the default folder location for the data files of the program, and then running some tests to see if the reocvered files will open when put in that location.

2. Renaming programs do not usually identify the file type. They are only really useful when the file contains internal meta data that can be extracted and used as a file name.

[SW1]

Hi Graham,
THANK YOU for all of your help and excellent technical details.