Re: [sleuthkit-users] how to map a bad block back to a file?

[Gary F. <ga...@in...>]

 
Brian Carrier wrote:
> If you know the address of the bad blocks, then you can use 
> 'ifind' to 
> find out if the block is allocated to an inode/MFT Entry.  
> You can then 
> use ils or istat to find out if the inode/MFT Entry is currently 
> allocated or not.

OK. I'll give that a try.  Please note my reply to
Simson for additional background.  I think the challenge
may be automating the steps outlined above.