Autogenerated namesDuring recovery, many partially damaged filesystem objects are located and
their reconstruction attempted. Some properties of these objects are typically
beyond recognition, and some automatically generated values will be assigned
instead. Most common situations are file creation/modification times and file
(or directory) names. The following covers common automatic file naming
patterns.
What are DIRxxxx and FRGxxxx directories?
These two types are generated on a FAT filesystem. FAT filesystem does not
store the directory name inside the directory itself, but puts into the
upper-level directory. If the upper level directory gets damaged, there is no
way to determine the names for its children (which may still be on the volume
somewhere). In such a situation the child directory will be named DIRxxxx.
What are LostFilesXXXX and LostNameXXXX objects?
Opposite to FAT, NTFS does store the object name with the object itself.
However, due to the overall complexity of NTFS, additional "abnormal"
possibilities emerge, including the perfectly valid file without any name
associated with it.
The following two situations occur most often:
- The file exists on the volume which references some seemingly valid
contents, but does not have any name associated with it. However, some name
is needed to be able to actually recover a file. So the autogenerated name
in the form of LostNameXXXX is assigned to the file.
- There is a valid file and it has a valid reference to its parent
directory. However, parent directory is either missing or damaged beyond
recognition. To accommodate the file, the "fake" directory will be created
(which does not reflect any real data on the volume) which gets a
LostFilesXXXX name. The file will be placed into that directory, and should
ZAR encounter any files referencing the same (missing) directory
later into the run, they will be placed in their appropriate directory.
ZAR saves your prayers for more suitable occasions.
|
