Peter Ballen

I've used the NTFS file extractor that's part of mft2csv to great success.

I got the newer version and ran it. I'm getting some strange results. I think the periods are screwing things up? "Documents and Settings\Admin\Application Data\Sun\Java\jre1.6.0_05" becomes "path\JRE16~1.0_0" "WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceModel" becomes "path\System~4.SER"...

Curiouser and curiouser "Documents and Settings\All Users\Documents\My Music" becomes "path\MYMUSI~1" (which happens to everything in the Music folder). However, "Documents and Settings\All Users\Documents\My Pictures" comes out fine.

We've gone from lots of bad filenames to only a handful, all limited to a single misread? character. "Documents and Settings/User/My Documents/My Pictures/Guatemala/IMG_0715.jpeg" becomes "path/IMP_0175.JE-G" (the E has an accent)....

The raw record only has a single FN record, but its reading name as "IMG_0175.J\xc8\x96G" Let me try getting the raw bits. My MFT might be bad?

I opened the MFT in a hex viewer. The relevant bits (which do convert to IMG_0175.jpg) are: 49 00 4D 00 47 00 5F 00 30 00 31 00 37...