Re: [sleuthkit-developers] [TSK & PhotoRec] File Block problem

[RB <ao...@gm...>]

On Tue, Aug 18, 2009 at 08:00, Stefano
Guidobaldi<ste...@ya...> wrote:
> Problem is, I don't find anything in TSK that tells me which physical blocks
> of hdd are allocated to a certain filename. Is there a way to retrieve this
> information?

You'll need to map physical blocks to inodes (using ifind), then
inodes to filenames (using ffind).

> TSK gives me the inode metadata structure of every file, which could be
> useful, but totally useless in case the filesystem table of the original hdd
> is corrupted.

In that case, you may not have file names any more to link back to
depending on the filesystem and type of corruption.