testdisk utility reports nonexistent files from a exFAT drive used with Windows - why?
0
votes
1
answer
102
views
I tried to recover lost files from an exFAT thumb drive with the
package on linux. It was very good at finding deleted files. However as I went through the entries, I saw weird entries. The program claimed there were dozens of both present and deleted files with unreadable file names and humoungous file size as well as outlandish timestamps.
For example one entry read
bytes, -Apr-1911
and filename ,~WM-*'? M-kxfM-'D^^Q謁懫䞭鵣ㄆ冚୩鳼묁쐚쵡૪댷腁濬
. The names of invalid entries were garbled text, foreign languages and emojis. What was interesting was that some of the timestamps were before the unix epoch.
The weird entries were not on the root of the drive. They were only on some folders. Also files with only alphanumeric characters displayed fine.
My questions are:
1. What is the cause of this phenomenon? Is testdisk mistakenly picking up random leftover bytes as 'deleted files'? Or are some files created on Windows just not suitable for Linux?
2. Do Linux and Windows actually use different encodings/rulesets for their filenames? If so, what happens if a file whose name is valid on one OS which is not on the other is sent to the hostile OS? Do they all turn into gibberish like this?
p.s. All files' content was encoded in UTF-8.
Asked by ero47543
(1 rep)
Jan 5, 2023, 02:07 PM
Last activity: Apr 9, 2023, 02:38 PM
Last activity: Apr 9, 2023, 02:38 PM