Re: [sleuthkit-users] how to map a bad block back to a file?

[Brian C. <ca...@sl...>]

If you know the address of the bad blocks, then you can use 'ifind' to 
find out if the block is allocated to an inode/MFT Entry.  You can then 
use ils or istat to find out if the inode/MFT Entry is currently 
allocated or not.

brian

Gary Funck wrote:
>  From time to time, we process a hard drive that has
> a series of unrecoverable errors.  We'd like a fairly
> quick check that we can run while imaging the drive
> that tells us if the bad blocks likely fall in
> allocated space (inclusive of metadata), and if so,
> which files (and/or metadata) might be affected.
> It would also be nice to know if the bad blocks
> are part of a deleted file as well, if applicable.
> 
>  Given that ntfs volumes are prevalent these
> days, our primary interest is ntfs volumes, but
> hopefully the same principles might apply to
> FAT32, ext3 and other file system types as well.
> 
>  Can the sleuthkit tools perform this fucntion?
> What would be the recommended sequnces of
> commands that must be run to accomplish the task?