pbobby wrote:
Oh boy - all of the above replies aside, the images you found were in the recycle bin.
You don't need to carve or anything like that, you need to understand recycle bin forensics. This will tell you where the JPG images were originally located.
I presume this is critical since the images are only associated with people by a folder name or original file name? And nothing in the image itself identifies who the patient is that the picture belongs to?
OP stated:
DIYdriverecovery wrote:
I then mounted that dd image and then xxcopy'd all the jpg file over to a different folder, but unfortunately, the only ones I could find were all in the recycle bin.
I then ran Photorec against that dd image, but all the files have weird names. I'm now looking for a tool that helps me piece together the original file name, as their patient records heavily depend on having these original file names.
As I read the above, "direct find" on the mounted image ONLY produced some images that were in Recycle Bin (and this was NOT the expected result).
Then "direct access"/"carving" through Photorec provided more images but (obviously) with "queer names".
Hence the suggestion of attempting a more "proper" data recovery process and/or check if there is any metadata in the already recovered by "carving" images.
jaclaz
↧