4

I made a full disk image from a 4 to 5 year old laptop HDD.

That HDD was in a laptop that was carried often to places, so, over the years, it has probably experienced physical stresses to some degree.

The HDD still works intact, but Guymager, the program I used, showed how many bad sectors were encountered while capturing that image; specifically, 19 bad sectors.

Which LBA numbers and which files are affected by these 19 bad sectors?

I would first like to create a list of bad LBA's and then I would like to list every file on each of those LBA's in a separate step.

3
  • 1
    What kind of filesystem is/was it? What OS are you using to attempt the recovery?
    – Jeff Schaller ♦
    Aug 5, 2018 at 13:12
  • @JeffSchaller The target file system is unfortunately NTFS. OS is Linux Mint Mate
    – neverMind9
    Aug 5, 2018 at 21:01
  • Mate 64-Bit 18.3.
    – neverMind9
    Aug 5, 2018 at 21:02

3 Answers 3

Reset to default
7

Use debugfs on ext2/3/4. First find the inode based on block:

debugfs -D -R "icheck $sda3block4096" /dev/sda3

then use this inode number for query for file:

debugfs -D -R "ncheck $inode" /dev/sda3
2
  • 3
    You probably should mention that debugfs only works on ext2/ext3/ext4 filesystems.
    – dirkt
    Jul 29, 2018 at 15:24
  • @dirkt What works listing blocks on all disks independent from file systems? (low-level). And what works with FAT and NTFS?
    – neverMind9
    Aug 2, 2018 at 17:21
4

What works listing blocks on all disks independent from file systems? (low-level). And what works with FAT and NTFS?

The LBA number and bad block detection is total independent of the file system. Finding files is completely dependent on the filesystem. Don't expect a single tool to work for all filesystems.

You can use badblocks to scan for bad blocks, you can use smartctl to get the LBA(s) of reallocated blocks or bad blocks detected by the harddisk firmware, and you can use fdisk etc. if you want to calculate between partition-relative numbers (if you did e.g. badblocks /dev/sda1 and LBAs.

As mentioned in the other answer, you can find the affected files for ext2/ext3/ext3 with debugfs.

You can use the fibmap ioctl to find the LBA of the n-th block of a given file for all filesystems, but if you want to find the file for a given LBA, this is probably not practical. There's also filefrag, which probably uses this ioctl.

I'm sure there are forensic tools for FAT (and possibly even for NTFS) which find a file for a given block number, but I couldn't name any offhand.

Edit

Googling finds fatcat for forensic analysis of FAT filesystems; it seems with -L you can get a file for a specific cluster (which you can calculate from the LBA). I have no experience with this program. Googling more will probably turn up more such programs.

9
  • +1. But The LBA number and bad block detection is total independent of the file system. Finding files is completely dependent on the filesystem. | I knew that, so maybe I have asked two questions seperately.
    – neverMind9
    Aug 2, 2018 at 18:13
  • Can I use LBA lists instead of complete rescans?
    – neverMind9
    Aug 2, 2018 at 18:14
  • 1
    I don't understand the question. If you have an LBA list, you don't need to "scan" (badblocks etc.)- you already have the list. If you want files for a list of blocks for a non-ext filesystem, you still need tools for that specific filesystem. You can "scan" with fibmap, you can even script the scan to use a list of blocks and only touch each file once, but it's still an impractical way to do. It would help if you'd actually describe your situation (like "the harddisk has a FAT and a NTFS partition"), instead of asking general questions for which there's no definite answer.
    – dirkt
    Aug 2, 2018 at 18:21
  • 1
    Yes. As I already wrote: You can use smartctl (internally reallocated sectors) and badblocks (currently non-readable sectors) for the first step. But didn't you already get the list from Guymager? I'd also advise not to work directly with the harddisk, but use ddrescue etc. to first make a copy of the harddisk (which will also detect bad sectors while doing this).
    – dirkt
    Aug 2, 2018 at 20:39
  • 1
    I have no idea, I've never used Guymager. But if it knows the number of bad sectors, it should also know which sectors are bad. Just reporting their number isn't particularly helpful...
    – dirkt
    Aug 2, 2018 at 20:53
2

NTFS, ext3, ext4

If you've copied the data off your fail{ing,ed} drive with ddrescue, then use ddrutility which was created for just this purpose.

I successfully got it to list affected NTFS files given a ddrescue mapfile in under 20 seconds.

It writes its log file in the current directory.

The linked page mentions support for NTFS, ext3 and ext4.

btrfs

btrfs has it's own built-in scrub function.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .