Filenames are not always what they are listed as

[EHCanadian]

I've got this odd problem.

 

I can delete something and atempt to recover it. But its not whats listed.

 

Example. ImageLeft.jpg isn't ImageLeft.jpg but some other file that name was not even close, Like index.php.

 

The only way to confirm whats a image or a text file or even a application is to atempt to make sence of the header

 

 

Attached Image

 

Windows Server 2003 Enterprise Slipstreamed SP2

AMD 3000+ @ 2.2GHZ

2GB DDR Kingston

[Augeas]

The filenames seem OK to me. Do you mean that the filenames are correct but the content isn't? If the filenames have changed then how do you know what to look at?

 

Only menuboxleft appears to have the correct header for a jpg file, the other two look as if they've been overwritten. Unfortunately this is what can happen, quite quickly too.

[EHCanadian]

I understand that. But for some odd reason the filename and content didn't match but was marked as execelent. Also the path has a ? in it. Would it not be classed as a orange status as its recoverable just not what the filename says.

[Augeas]

How would a piece of software know that? Recuva can only make a guess at the state of the file based on what I imagine are some fairly basic assumptions, whether the data has been overwritten, etc. Recuva will recover whatever data is in the clusters pointed to by the file entry in the MFT, it can't possibly analyse the data itself, well, not a lot. I wouldn't put too much trust the in the state of the file field.