When long filenames are deleted in Windows, there remain remnants of the 8.3 filename in the directory. When undeleting the long filename it must match the original exactly; otherwise, an internal checksum won't match and the file won't be displayed.
Category: Maresware
Category URL: http://www.dfir.training/component/mtree/by-developer/maresware?Itemid=