[sleuthkit-developers] [TSK & PhotoRec] File Block problem

[Stefano G. <ste...@ya...>]

Hello,

I have a problem in performing a new feature in PhotoRec.
Photorec carves file from corrupted hard drives and saves them in default directories named "recup_dir.*".
It saves file in the format "f0000000.extension", where number represents the offset of the file from the start of the disk image, divided by blocksize.

Now, I'm trying to use TSK in order to retrieve filenames from hdd, and then, writing some code in PhotoRec, I intend to add the feature of saving files with their own name, not the "f00000000.ext" stuff.

Problem is, I don't find anything in TSK that tells me which physical blocks of hdd are allocated to a certain filename. Is there a way to retrieve this information?

TSK gives me the inode metadata structure of every file, which could be useful, but totally useless in case the filesystem table of the original hdd is corrupted.

Thanks for the suggestions,

Stefano