Re: [sleuthkit-users] icat and ifind -- Help with -- Please DO NOT hijack threads
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] icat and ifind -- Help with -- Please DO NOT hijack threads
|
From: Al G. <big...@gm...> - 2009-11-21 03:46:12
|
Right. Here is the question. I get harddisks (minly NTFS) with bad sectors on them. I want to know what if any files reside on the badblocks with ifind. I normally image them right there and then with ddrescue, but in this example we can with with the disk since its for the bin. Heres the badblocks data: Disk /dev/sdb: 160.0 GB, 160041885696 bytes 255 heads, 63 sectors/track, 19457 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Disk identifier: 0x70000000 Device Boot Start End Blocks Id System /dev/sdb1 1 8 64228+ de Dell Utility /dev/sdb2 9 1314 10485760 7 HPFS/NTFS /dev/sdb3 * 1314 19131 143117312 7 HPFS/NTFS /dev/sdb4 19131 19458 2621440 f W95 Ext'd (LBA) /dev/sdb5 19131 19458 2620416 dd Unknown al@al-ubuntu:~$ sudo badblocks -b 512 -vs /dev/sdb Checking blocks 0 to 312581807 Checking for bad blocks (read-only test): 22817408done, 4:46 elapsed 22817432done, 5:55 elapsed 22817433done, 6:18 elapsed 22817434done, 6:42 elapsed 22817435done, 7:05 elapsed 22817436done, 7:28 elapsed 22817437done, 7:51 elapsed 22817438done, 8:14 elapsed 22817439done, 8:37 elapsed 22817440 22817441 22817442 22817443 22817444 22817445 22817446 22817447 22817448 22817449 22817450 22817451 22817452 22817453 22817454 22817455 22817456 22817457 22817458 22817459 22817460 22817461 22817462 22817463 22817464 22817465 22817466 22817467 22817468 22817469 22817470 22817471 22817472 22817473 22817474 22817475 22817476 22817477 22817478 22817479 22817480 22817481 22817482 22817483 22817484 22817485 22817486 22817487 22817488 22817489 22817490 22817491 22817492 22817493 22817494 22817495 22817496 22817497 22817498 22817499 22817500 22817501 22817502 22817503 22817504 22817505 22817506 22817507 22817508 22817509 22817510 22817511 22817512 22817513 22817514 22817515 22817516 22817517 22817518 22817519 22817520 22817521 22817522 22817523 22817524 22817525 22817526 22817527 22817528 22817529 22817530 22817531 22817532 22817533 22817534 22817535 22817536 22817537 22817538 22817539 22817540 22817541 22817542 22817543 215058296one, 52:13 elapsed 215058312one, 52:59 elapsed 215058313one, 53:22 elapsed 215058314one, 53:45 elapsed 215058315one, 54:08 elapsed 215058316one, 54:31 elapsed 215058317one, 54:54 elapsed 215058318one, 55:17 elapsed 215058319one, 55:40 elapsed done Pass completed, 122 bad blocks found. al@al-ubuntu:~$ Now, how to find what if any data is listed as residing on those blocks? Cheers -Al -- View this message in context: http://old.nabble.com/icat-and-ifind----Help-with----Please-DO-NOT-hijack-threads-tp26452166p26453534.html Sent from the sleuthkit-users mailing list archive at Nabble.com. |
