← All posts

Recovered Files Named 0x00003a1c8000.jpg? Why the Names Are Gone and How to Sort Them

October 7, 2026 · DiskRescue Blog

The scan finished and the output folder is full. The photo folder alone holds three thousand files. Then you look at the names: 0x00003a1c8000.jpg, 0x00003a1f2000.jpg, 0x00003a254000.jpg. No "Yellowstone 2023," no "Emma's first birthday." Every folder you used to have has been flattened into one long list of numbers.

That doesn't mean the recovery went wrong. It tells you which kind of recovery ran. Some methods bring names back and some structurally can't, and even when the names are gone, the files usually carry enough information inside them to rebuild most of the order you lost.

Short version: File names and folders live in the file system's index, not inside the files. When a drive has been formatted or its index is too damaged to use, a signature scan can still find the contents but not the names, so each file gets named after where it was found on the disk. Photos can be re-sorted by the date they were taken; documents by the properties stored inside them.

Names were never inside the files

When a photo gets saved to a drive, two separate things are written. The pixels go into the data area. Separately, the file system's index records that "IMG_2031.jpg, in the Yellowstone folder, starts here and is this long." The file name and the folder it sits in exist only in that index.

Recovery tools split along the same line. If the index is still intact, a tool can read it, find the entries marked as deleted, and restore them with their names and folders. If the index has been overwritten by a format, or is too damaged to trust, the only option is to read the data area from start to finish and look for the signatures that mark the beginning of a JPEG, an MP4 or a PDF. That approach, usually called signature scanning or file carving, recovers the raw contents. It never sees the index, so it has no names to give back.

In DiskRescue, Recover now and Step 2 · Recover from backup are signature scans. Each recovered file is named after the byte offset where it started on the disk, written in hexadecimal. 0x00003a1c8000 means the file began about 975 MB from the start of the drive. Two files can't start at the same place, so names never collide, and if a scan is paused and resumed, a file that was already saved isn't written a second time.

The numbers still carry a little order

Cameras, phones and dashcams tend to fill free space from the front of the card forward. On a card used that way, position on disk roughly tracks the order things were shot, so sorting by name groups photos from the same period together more often than not. On a card that's been filled, cleared and refilled many times the order gets scrambled. Still, when you spot one familiar shot in a sea of strangers, the files with neighboring numbers are the best place to look next.

Re-sorting photos by the date they were taken

Most phone and camera photos carry their own shooting details, known as EXIF data: the date and time, the camera or phone model, sometimes the location. That information is stored near the start of the photo file itself, not in the index, so it comes through a signature scan as long as the photo was recovered intact.

1. Open the folder of recovered photos in File Explorer and switch the view to Details.
2. Right-click any column header and turn on Date taken. If it isn't in the short list, click More... at the bottom and tick it there.
3. Right-click an empty spot in the folder and choose Group by > Date taken. Photos fall into sections by month and year. Sorting by the same column puts them in shooting order.
4. Create a folder per event or month and drag each group in. You'll end up surprisingly close to the original structure.

Some photos will have an empty Date taken. Images sent through messaging apps often have their EXIF stripped along the way, and screenshots never had any. If you see a pile of tiny images, just a few kilobytes each, those are usually browser cache files, thumbnails or icons that a program saved. Sort by size and move the small ones into their own folder; the rest becomes much easier to browse.

Documents and videos: check the properties

Word, Excel and PowerPoint files store their title, author and created date inside the file. Select one in File Explorer, open Properties, and look at the Details tab. If you only have a few dozen documents, opening each one and renaming it after its first line is the most reliable approach.

Many cameras also write a recording time inside the video file. File Explorer shows it as Media created, both as a column you can turn on and on the Details tab. If a date shows up there, use it. If some recovered videos won't play at all, that's a separate issue with its own cause; why recovered video files won't play walks through it.

Photos marked "_손상의심"

Some photos come out with a suffix, like 0x00003a1c8000_손상의심.jpg. The Korean tag means "suspected damage." It's added when part of the photo sat in sectors that couldn't be read, or when the saved image failed a validity check. When opened, these often show a gray band across the bottom or colors that shift halfway down. Don't delete them. Move them to their own folder. If there's no other copy, the top half of a photo is still worth keeping.

When the same photo shows up three times

A signature scan can return the same picture more than once. That happens when an older deleted copy hadn't been overwritten yet, or when you'd copied the same photos onto the drive on more than one occasion. With hex names, spotting matches by eye is close to impossible.

DiskRescue has a separate Duplicate cleaner for exactly this. Point it at a folder and it checks every subfolder, flags only files whose contents are identical, and moves the extras you select to the Recycle Bin rather than deleting them outright, so a wrong call can be undone. On a drive that has no Recycle Bin, such as many flash drives, it moves them to a separate holding folder instead of deleting them.

Trying it before you commit

If you haven't recovered anything yet, the free DiskRescue trial shows you what the output will look like on your own drive. It saves the first 20 files the scan finds, with no size cap, lets the duplicate cleaner clear up to 10 files, and asks for no account or social share. While the scan runs, the count of photos, videos and documents found climbs in real time, so within minutes you'll have a sense of how much is still on the drive. Open the saved files from the other drive; they're a useful sign of the drive's condition, though every recovered file still deserves its own check.

When the names could have come back

If the files were deleted recently from an NTFS drive that still opens normally, the index is probably intact, and Restore deleted files reads it to bring files back with their original names and folder paths. An emptied Recycle Bin is the classic case, covered in recovering files after emptying the Recycle Bin. Memory cards and most USB sticks use FAT32 or exFAT instead. That mode doesn't apply to them, so in DiskRescue those drives go through Recover now, with numbered output.

How DiskRescue Compares

On a lifetime license, DiskRescue costs about 1/5 what the big-name recovery suites below charge — paid once and used for life, with no auto-renewal.

Prices, features, and free-tier limits checked on each official site (Windows editions) on July 14, 2026 — they may change with sales or updates. The price comparison uses DiskRescue's launch price ($29.99). EaseUS free recovery is 500 MB by default, expanding to 2 GB after a social-media share (kb.easeus.com); Disk Drill's official free limit is 100 MB (cleverfiles.com).

Further reading

• Windows Wants to Scan and Repair Your Drive. Here's What That Does to Your Files.
• Why Your Recovered Video Files Won't Play
• Files Missing After a Windows Update or "Reset This PC": Which Case Are You In?