How to generate a list of files from a list of sectors

bad-sectorsddrescuefile-recoveryfilesystems

I've had a hard disk failure and managed to rescue some data from the disk (1TB) with GNU's ddrescue. The last 800GB of the disk were perfect, no single error, but in the first 200GB there were almost 14000 errors (badblocks) spread across the area. ddrescue creates a logfile that describes where the badblocks are.

ddrescues command line params:

ddrescue /dev/sdb /dev/sdd /mnt/sdc1/sdb.log -r -1 -f -d -v

The logfile looks like this:

#      pos        size  status
0x00000000  0x1C08CE00  +
0x1C08CE00  0x00000200  -
0x1C08D000  0x011E6800  +
0x1D273800  0x00000200  -
0x1D273A00  0x005EC000  +
0x1D85FA00  0x00000200  -
...         ...         ...

The plus (+) means contiguous good space, the minus (-) unreadable space; position and size are in hexadecimal. Striping the lines ending in '+' I have a list whith badblock positions, but I need a way to correlate this badblocks to files on the File System, which is, by the way, NTFS.

I know that I can use something like DiskExplorer to do this manually, but it would be the hell with 14000 sectors. So, there is a more or less automatic and elegant way of doing this ?

Best Answer

Since the huge success of this question, I've been left without answers, if there were any. But I continued researching and found an Microsoft utility that dates 1999, called nfi.exe, part of the OEM Support Tools Phase 3 Service Release 2 for Windows NT 4 and 2000. The utility does exactly what I needed, receives a sector and returns a file. But it does that to individual sectors, so I had to created a script to automate the process. It's a Python (2.7+) script that works this way:

It receives as input an ddrescue log file, parses it, calls nfi.exe for each sector in the file and generates a list with the files in alphabetical order. 

>sector_correlator.py -h

usage: sector_correlator.py [-h] [-v] [-n \path\to\nfi.exe] [-V] [-L]
                        logfile nt-device-path output file

Receives a list of sectors and returns a list of files which resides in them.

positional arguments:
  logfile              path to ddrescue's logfile.
  nt-device-path       NT-style path to physical device, like
                       \device\harddisk1\dr1
  output file          filelist output file name

optional arguments:
  -h, --help           show this help message and exit
  -v, --version        show program's version number and exit
  -n \path\to\nfi.exe  nfi.exe's path, if not speciified, assumes's it is in
                       the same path as the script
  -V                   enables verbose mode
  -L                   save nfi.exe's output log to nfi_raw.log

Example:

sector_correlator.py sdb.log \devices\harddisk0\dr0 filelist.txt

Where: sdb.log is ddrescue's log,

\device\harddisk0\dr0 is an NT-style path to the HD (you discover it using an sysinternals tool called WinObj and the Disk Management Utility) WinObj showing physical device list enter image description here

and filelist.txt is the file list you want. It will look like this:

\Documents\Downloads\Evernote_4.5.1.5432.exe
\Documents\Downloads\Programs\Apophysis207SE.exe
\Documents\Downloads\Programs\GetGnuWin32-0.6.21.exe
\Documents\Downloads\Programs\mbam-setup.exe
\Documents\Downloads\Programs\msnbackup133.exe
\Documents\Downloads\Programs\x64Components_v254.exe

The other arguments on the script are optional and are explained when you run it with -h. By default, the script assumes nfi.exe is in the same dir, if not, use -n pathtonfi.exe.

Finally, here is the link to the script: sector_correlator.py

It's very rudimentary and has no error handling, but does the job.

Related Question