Raw file filtering software

[higgsboson]

Dear all
I have recovered large Data using raw method , since all metadata is ignored , all file attributes are missing.
Client has 4 month old backup , so he wants files created after backup date.
Is there any tool to filter latest data ?

[LarrySabo]

Active@ File Recovery Pro will put recovered files into folders named based on the meta-data of the recovered files. It works very well.

[higgsboson]

Hi
Thanks LarrySabo.
I will give it a try.

[higgsboson]

HI LarrySabo
I have checked Active File recovery , it is great tool. However in my case I don't want recovery part which I have already done. I just want to filter data depending upon date.

[LarrySabo]

You could still use Active@ File Recovery Pro on the data you have already recovered (saving the data to a second drive), but unless you have a reason to buy the software for on-going use, it may not be justified.

[fzabkar]

Here are several freeware file sorting methods:
http://www.cgsecurity.org/wiki/After_Using_PhotoRec

They appear to be targeted at PhotoRec, but they could probably still apply in your case.

[Amarbir[CDR-Labs]]

Frank And Mr Larry,
I Think he wants to do RAW Data Recovery But Sortout Files Using Dates

[MindMergepk]

Frank And Mr Larry,
I Think he wants to do RAW Data Recovery But Sortout Files Using Dates

Bhai Jan.

I think he already have files using raw recovery but original file attributes are missing like creation/modification dates and he is looking for a solution to sort out these files by dates.

[higgsboson]

Dear All
Thank you so much
I think MindMergepk has correctly identified my issue. I already have recovered files & want some software to sort files using internal metadata.
Its herculean task to segregate 60 GB of raw data.
Fortunately I have got a powerful solution. Working on it.
Thanks again.

[dataack]

Dear all
I have recovered large Data using raw method , since all metadata is ignored , all file attributes are missing.
Client has 4 month old backup , so he wants files created after backup date.
Is there any tool to filter latest data ?

Create 2 hash set then compare :

1 - Raw recovered files
1 - 4 month backup files

This reduce duplicate n old files.

[higgsboson]

Hi dataack
in case files are limited this solution may work.
In my case no. of files is very large -thousands. So checking hashes of indivisual files will be herculean task.

Thanks for suggestion.

[HaQue]

Hi dataack
in case files are limited this solution may work.
In my case no. of files is very large -thousands. So checking hashes of indivisual files will be herculean task.

Thanks for suggestion.

Scripting is your friend. Then it doesn't matter if there are 20 or 20,000.

if filenames aren't there, and you have a backup with lots of files that might not be changed, then in your chosen language do something like:

Code:

hashList = Hash all know file hashes from backups
For each hash in hashList
  {

If you don't know scripting you can use excel.
1. create a list of all hashes from files from the 4 month backup.
2. in sheet 1, have 2 columns, filename and hash
3. create hashes of all recovered files.
4. add the filename and hash to 2 columns in sheet 2.
5. if you can work out how to compare duplicates from each hash columns, then just do that, otherwise in sheet 3, add the hash columns from sheet 1 to column 1 and the hashes from sheet 2 to column 2 and use the duplicate find function.  a bit of playing around can get you good results
   if hashList[hash] == hash of rawfile
        rename rawfile to hashFilename & copy to good files folder
   else
        copy to unknown file folder
   }
   

otherwise, sorting from date should be easy, do the same as above, but if the hashes match, send to older than 4 month folder, and if not send to newer file folder

[chipsang]

Hi HaQue
I am confused how calculating hash ( MD5 /SHA1) of files will help to isolate required files ? How Hash tells internal metadata information ?
each file is different so hash of each file will be different.

[higgsboson]

Concluding of this thread -------------
A most Profound and Powerful Solution has been found ,
Thank you all contributors

[LarrySabo]

Concluding of this thread -------------
A most Profound and Powerful Solution has been found

Namely?

[Amarbir[CDR-Labs]]

Concluding of this thread -------------
A most Profound and Powerful Solution has been found

Namely?

Mr Larry ,
Answer is he has no clue .Chipsang [ i know who you are ] haque made it clear calculate the hash hashes that match are in his backup that do not are new [ IMHO ]