Hi,

Is there any way to to make ntfscluster work directly on an extracted MFT?

I have a list of bad sectors (from ddrescue) and an extracted MFT (via The Sleuth Kit). I would like to know which files are in those bad sectors of the failing drive.

Running ntfscluster directly on the drive takes very long and gives a series of "Error reading inode" errors.

Thanks,
Emmanuel

Hi,


What you can do is create a metadata file from your partition, this will extract the MFT and other useful data, skipping all user data. You will get a sparse file which is apparently as big as the partition, but is not much bigger than the MFT itself :

Where metadata is a target file on a sparse capable partition (ext, ntfs, ...) and /dev/xxx is your source partition.

You can run ntfscluster on the metadata file instead. This might also be long if you have a lot of files, because the only way of knowing which file has data at some location, is to scan the file list. You may also get errors on inodes which have bad data.

Regards

Jean-Pierre