Hex Reference Help

[ddrecovery]

I am recovering a drive for a client. He says there was a folder on the drive called TM Design. I have imaged the drive (took almost 2 weeks) and I have got back 99% of the data, but the folder (or files) are not there. I have looked at hex and found the attached reference to TM Design. It looks like it is referring to a server called TM Design. I am not network wizard and wondered if this reference is to the machine this drive came from or does it describe the path that the machine was networked to? If it was networked his data could be somewhere else.....

Attachments

TM_Design.txt

(11.83 KiB) Downloaded 617 times

[labtech]

That looks like a shortcut to some network location.
If you extract the shortcut file, then you can look at properties and it will indicate where it is pointing in a more friendly path.

[ddrecovery]

That looks like a shortcut to some network location.
If you extract the shortcut file, then you can look at properties and it will indicate where it is pointing in a more friendly path.

I can see its part of the MFT, but any advice on how I would do that?

[scratchy]

you can see that the file is resident in the mft. so should be easy to copy. looks like the file is named 'target.lnk'

[labtech]

Figure out the parent folder where the file belongs to, then build file tree with some software and extract the file. Then look at properties.

Educated guess: It is a shortcut, right? So, a shortcut depends on visually seeing in on what? Typically on a user's desktop OR maybe under "My Computer/Computer".

Best wishes

[ddrecovery]

Figure out the parent folder where the file belongs to, then build file tree with some software and extract the file. Then look at properties.

Any recommendation on file extraction software?

[labtech]

R-studio, etc. Anything really..

[ddrecovery]

R-studio, etc. Anything really..

I thought you were talking about ntfswalk or something like that. R-Studio is good.

[scratchy]

once you copy it rename it to target.txt otherwise when you open the file it will try to open the shortcut link.