Why can I see original file names using disk surface scan method?
Information about file names is stored in the Master File Table (MFT) separate from the actual file data. The disk surface scan method enumerates all clusters on the disk that are marked as unused. It can’t use the file name information from MFT. Howerer, several file types, for example MP3 files or Microsoft Office Documents, store some file information inside of file data stream. So even not analyzing MFT, we can determine file properties and create friendly file names for such file types. For example, “User – Sample Office Document.doc”. Some file types, such as BMP and GIF have no ability to store properties inside of the data stream. For such files, we generate unique names based on the file’s starting cluster number. For example, “GIF Animation (23523).gif”.
Related Questions
- Why Sothink SWF Decompiler cannot export all the elements’ names as original they existed in FLA file and what kinds of names could be recovered?
- I placed a file in my FastEZ Library and deleted the original from my disk - but the file isn in my Library anymore! Where did it go?
- What information can I recover using disk surface scan method?
