Re: [sleuthkit-users] how to map a bad block back to a file?

[Al G. <big...@gm...>]

Did you ever do this successfully?

It is EXACTLY what I am trying to do.

Cheers

-Al


Gary Funck wrote:
> 
>  
> Brian Carrier wrote:
>> If you know the address of the bad blocks, then you can use 
>> 'ifind' to 
>> find out if the block is allocated to an inode/MFT Entry.  
>> You can then 
>> use ils or istat to find out if the inode/MFT Entry is currently 
>> allocated or not.
> 
> OK. I'll give that a try.  Please note my reply to
> Simson for additional background.  I think the challenge
> may be automating the steps outlined above.
> 
> 
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share
> your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 

-- 
View this message in context: http://old.nabble.com/how-to-map-a-bad-block-back-to-a-file--tp7449524p26455507.html
Sent from the sleuthkit-users mailing list archive at Nabble.com.