| Author | Message | ||
     John Ahearne Username: jahearne Registered: 1-1997 |
Hi everyone, Using the latest version 15.4 specialist license on XP Pro. I can successfully recover the data, but all file dates are from today's date. I've selected within the General Options > Do not update file time, but the modified file dates are still from today's date and time of recovery. Looking for certain dates beyond the last backup and have millions of files to search through. Any help would be greatly appreciated! Thanks, John | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> all file dates are from today's date That the original timestamps (creation, modification, last access) are re-applied to the recovered/copied files is an extra feature available with a forensic license only, as described in the documentation of the Recover/Copy command in the program help and user manual. > I've selected within the General Options > Do not update file time "Do not update file time means that WinHex will preserve the last modification time when a modified file is saved with File | Save or Save As." This is a direct quote from what the program help and user manual have to say about the General Options. Generally if command X or option Y doesn't do what you expect it to do or if you have questions about it or don't understand what it does, you can read the documentation in the program help or user manual. > Looking for certain dates beyond the last backup For files with certain dates? So then you could perhaps just sort by modification date. After exploring recursively if necessary. | ||
| John Ahearne Username: jahearne Registered: 1-1997 |
Sorry, reading the manual did not clarify because I was confused. Am I correct in thinking that the Recover/Copy command modifies a file the same way as a file that "...is saved with File | Save or Save As." ? Every data recovery application I use preserves the original time stamps and I confused myself with your Recover/Copy command thinking that Recover would preserve the timestamps. No problem because I can use the forensic license to preserve the original timestamps. And thanks for the tip to sort by modification date. Duh, I should have thought of that! By the way, your "Reconstruct RAID System" command is the best application out there for rebuilding RAIDs. No other has the flexibilty that your application has and make recovering a few rare combinations possible. Thanks! John | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> Sorry, reading the manual did not clarify because I was confused. I thought the statements in the program help and manual about these two menu commands are clear and unambiguous. > Am I correct in thinking that the Recover/Copy command > modifies a file the same way as a file that "...is saved > with File | Save or Save As." ? They both do not modify the file contents at all. Anyway these are two different commands/functions. > No problem because I can use the forensic license to > preserve the original timestamps. With a forensic license you can also use the timestamp filters, maybe better than sorting. | ||
| Hu Hao Username: dexter Registered: N/A |
Hi, I encountered the same problem while performing FILE RECOVERY BY TYPE. The Created, Modified and Accessed Date are changed. Those files also can not find by EXPLORE EXCLUSIVELY. Is this due to those files are corrupted? | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> The Created, Modified and Accessed Date are changed. Carved files principally don't have any file system level timestamps, and what does not exist cannot be changed. Feel free to clarify if you mean something else. > Those files also can not find by EXPLORE EXCLUSIVELY. Files that are found with the File Recovery by Type function are not included in the volume snapshot of the volume in which they are found, so that's why they cannot be found when you explore that volume recursively. Such files are output to a directory of your choice. If you would like to find such files and include them in the volume snapshot, use Specialist | Refine Volume Snapshot | [x] File header signature search. > Is this due to those files are corrupted? No. | ||
| Hu Hao Username: dexter Registered: N/A |
I tried to use Specialist | Refine Volume Snapshot | [x]File Header Signature Search --> .avi (for this case), however, I still got much less avi files which I could find by File Recovery By Type. What is the difference between these 2 techniques ? | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
"File Header Signature Search" will not find files again that are already contained in the volume snapshot, with their names and paths etc. It does not make sense to list all of these files a second time. |