recover deleted filenames #1133
Replies: 1 comment 1 reply
-
|
Hi @paulobreim, Currently not, but you can change this config file adding a regex pattern to search for original file paths in the result decoded by RecycleBinParser, saving the group 1 of the regex hit (between the parenthesis) as value of a new metadata key (take a look at the FFMpegParser example at the top): If you manage to get it to work, we can add your regex by default in a future version. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you Nassif |
Beta Was this translation helpful? Give feedback.
-
Searching for a case of possible file deletion of an illicit, I performed the search with the parameter:
"application/x-recyclebin" && "2022-03-23"
The result was very interesting and it returned thousands of files that were deleted with names $XXXX.XXX which is apparently the default adopted by windows.
Looking at the text area, you can see the name of the file that was deleted.
Looking at the file in hex, it seems that the name always starts at byte 0x28 and ends with 00 00 00
Is there any way to export these deleted filenames?
I don't think so, but it would be a great function to think about.
tks
Paulo
Beta Was this translation helpful? Give feedback.
All reactions