I am recovering a drive for a client. He says there was a folder on the drive called TM Design. I have imaged the drive (took almost 2 weeks) and I have got back 99% of the data, but the folder (or files) are not there. I have looked at hex and found the attached reference to TM Design. It looks like it is referring to a server called TM Design. I am not network wizard and wondered if this reference is to the machine this drive came from or does it describe the path that the machine was networked to? If it was networked his data could be somewhere else.....

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

That looks like a shortcut to some network location.
If you extract the shortcut file, then you can look at properties and it will indicate where it is pointing in a more friendly path.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

I can see its part of the MFT, but any advice on how I would do that?

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

you can see that the file is resident in the mft. so should be easy to copy. looks like the file is named 'target.lnk'

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/

Figure out the parent folder where the file belongs to, then build file tree with some software and extract the file. Then look at properties.

Educated guess: It is a shortcut, right? So, a shortcut depends on visually seeing in on what? Typically on a user's desktop OR maybe under "My Computer/Computer".

Best wishes

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

Any recommendation on file extraction software?

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

R-studio, etc. Anything really..

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

I thought you were talking about ntfswalk or something like that. R-Studio is good.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

once you copy it rename it to target.txt otherwise when you open the file it will try to open the shortcut link.

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/