±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36779
New Yesterday: 2 Visitors: 144

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

X-Ways export list deleted files with orig name

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


X-Ways export list deleted files with orig name

Post Posted: Oct 15, 19 16:56

Using X-Ways 19.8, analyzing Windows 10 Enterprise computers. I am trying to export a list of deleted files with the original names according to the file system (from before being moved to the Recycle Bin and assigned a $R... name). I have recovered a number of deleted files from unallocated disk space, filtered for the types and description to get the deleted files I want and X-Ways shows the files when exploring recursively in the directory browser. Under Name, it displays the file name (for example; $R2QB45X.pdf) along with the original filename in brackets and light green if it was able to recover it (for example; [Important_Document.pdf]. If the file is selected and Details Mode is chosen, the "Important_Document.pdf" is listed as the "Name according to the file system." I assume it's pulled from the information in the $I file since INFO2 is no longer in use. The problem is that when I select the file, right click and choose Export list, even if I highlight all of the fields, the "Important_Document.pdf" is not included in the data exported; only "$R2QB45X.pdf" is copied. Any ideas how to get that included?  

Senior Member

Re: X-Ways export list deleted files with orig name

Post Posted: Oct 16, 19 07:12

you should recover $I files and copy spesific bytes each of them to export full list.
but if you want more raw recovery doesnt contain file path  


Re: X-Ways export list deleted files with orig name

Post Posted: Apr 06, 20 18:32

Just to update in case someone else looks for this. Stefan & crew at X-Ways added this as an option to display the original filename starting with v19.9. Thanks!  

Page 1 of 1