Re: ntfscluster work on extracted mft file?
Is there any way to to make ntfscluster work directly on an extracted MFT?
What you can do is create a metadata file from your partition, this will extract the MFT and other useful data, skipping all user data. You will get a sparse file which is apparently as big as the partition, but is not much bigger than the MFT itself :
ntfsclone -mt --rescue -O metadata /dev/xxx
Where metadata is a target file on a sparse capable partition (ext, ntfs, ...) and /dev/xxx is your source partition.
Running ntfscluster directly on the drive takes very long and gives a series of "Error reading inode" errors.
You can run ntfscluster on the metadata file instead. This might also be long if you have a lot of files, because the only way of knowing which file has data at some location, is to scan the file list. You may also get errors on inodes which have bad data.