Re: [sleuthkit-users] how to map a bad block back to a file?

[Simson G. <si...@ac...>]

Sleuthkit can't do this out-of-the-box. Are you really running Sleuth  
Kit on the raw drive?

However, the combination of aimage & sleuthkit and some fancy  
software that I am working can do this pretty easily. What would you  
use it for?


On Nov 20, 2006, at 1:22 PM, Gary Funck wrote:

>
>  From time to time, we process a hard drive that has
> a series of unrecoverable errors.  We'd like a fairly
> quick check that we can run while imaging the drive
> that tells us if the bad blocks likely fall in
> allocated space (inclusive of metadata), and if so,
> which files (and/or metadata) might be affected.
> It would also be nice to know if the bad blocks
> are part of a deleted file as well, if applicable.
>
>  Given that ntfs volumes are prevalent these
> days, our primary interest is ntfs volumes, but
> hopefully the same principles might apply to
> FAT32, ext3 and other file system types as well.
>
>  Can the sleuthkit tools perform this fucntion?
> What would be the recommended sequnces of
> commands that must be run to accomplish the task?
>
>
> ---------------------------------------------------------------------- 
> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to  
> share your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php? 
> page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>