[sleuthkit-users] how to map a bad block back to a file?
Brought to you by:
carrier
|
From: Gary F. <ga...@in...> - 2006-11-20 20:03:46
|
From time to time, we process a hard drive that has a series of unrecoverable errors. We'd like a fairly quick check that we can run while imaging the drive that tells us if the bad blocks likely fall in allocated space (inclusive of metadata), and if so, which files (and/or metadata) might be affected. It would also be nice to know if the bad blocks are part of a deleted file as well, if applicable. Given that ntfs volumes are prevalent these days, our primary interest is ntfs volumes, but hopefully the same principles might apply to FAT32, ext3 and other file system types as well. Can the sleuthkit tools perform this fucntion? What would be the recommended sequnces of commands that must be run to accomplish the task? |