How do i find out on Linux what file is occupying a given sector on a NTFS partition? I need to do it because i am rescuing data from a failing HDD (using ddrescue), and want to find out what files have been corrupted by bad sectors.
Asked
Active
Viewed 4,095 times
10
kinokijuf
- 8,255
-
Not an answer, but still good related info: NTFS file recovery techniques. – rickhg12hs Nov 11 '13 at 14:05
-
1Never used it myself, but ntfscluster looks encouraging. Some of the other ntfsprogs look interesting as well. – rickhg12hs Nov 11 '13 at 14:14
2 Answers
4
The comment provided by rickhg12hs deserves a place as an answer - it's on the mark.
The ntfs-3g utilities provide some useful functionality. In my experience, the ntfscluster tool has an advantage over ddrutility in that it can stand alone, whereas ddru_ntfsfindbad requires a ddrescue logfile. Not a problem in the context of the OP - as long as the logfile is still available.
Try something like:
ntfscluster -s 1048576 /dev/sda2
to identify what file occupies partition sector 1048576 of the NTFS partition /dev/sda2. If the drive has errors, you can try including the -f option, but weigh the results accordingly.
Because even the -q option for quiet output can be a bit chatty, consider redirecting stderr to /dev/null using 2>/dev/null so that only only the file details output to stdout are displayed.
Sully9
- 41
-
I presume a sector here is 512 bytes? If so, I guess I can calculate the appropriate partition sector with something like
$(( (ddrescue_byte_offset/512) - partition_start_sector ))? – mwfearnley Jul 26 '21 at 09:25
3
It turned out that the needed utility was mentioned right on the Ubuntu Rescue Remix (Ubuntu Rescue Remix was discontinued in 2012) front page: ddrutility
Homepage of ddrutility: https://sourceforge.net/projects/ddrutility/
