Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Yesterday I deleted a (fragmented) archive file only to find that it did not extract correctly, so I was left stranded. Fortunately there was not much space free on the drive, so most of the space marked as free was from the now-deleted archive. I pulled up a disk editor and—painfully—managed to get a list of cluster ranges from the FAT that were marked as unused. My task then was to save these ranges of clusters to files so that I could examine them to try to determine which parts were from the archive and recombine them to attempt to restore the deleted file.

This turned out to be a huge pain in the butt because the disk editor did not have the ability to select a range of clusters, so I had to navigate to the start of each cluster and hold down Ctrl+Shift+PgDn until I reached the end of the range (which usually took forever!)

I did a quick Google search to see if I could find a command-line tool (preferably with Windows and DOS versions) that would allow me to issue a commands such as:

SAVESECT -c 0xBEEF 0xCAFE FOO.BAR ::save clusters 0xBEEF-0xCAFE to FOO.BAR
SAVESECT -s 1111 9876 BAZ.BIN ::save sectors 1111-9876 to BAZ.BIN

Sadly my search came up empty.

Any ideas?


Thanks!

share|improve this question
add comment

2 Answers

You say you'd prefer a tool (app) that runs in Windows.

Well, there's a great piece of Forensics software which works (best) on Unix-like systems called the Sleuth Kit (TSK). It is a collection/suite of apps. In particular, one such app is called blkls.

Try:

blkls /dev/sda1 1200-1250 1>> /media/usbdrive/<file>

Where <file> is where you want the raw data saved to.

In that hypothetical example, sectors/blocks #s 1200 through 1250 will be copied from the partition/volume that is mapped (by the *nix system) to /dev/sda1 to the output/target file of your choosing (in a mounted volume of a, say, removable USB drive). It's good practice for the destination/target to be a different physical device from the source of the data.

A Debian-based specialized live Linux distro called grml can be downloaded for free. It already has the latest version of TheSleuthKit already installed. You can download the .iso image (using BitTorrent or with any regular HTTP client (like a web browser)) and burn it to a cd-r and then boot your computer from the cd-r.

When the system boots up into grml, you can open a Terminal window and use the Sleuth Kit.

If you boot your Windows computer into a live linux distro, your internal hard drive, which presumably has your Windows operating system installed on it will be mapped to a virtual "file" in teh Linux file system called /dev/sda.

The internal hard disk will be mapped to 'a' and any additional storage (block) devices that the operating system find will be mapped to subsequent letters in the alphabet, e.g. /dev/sdb, /dev/sdc, etc.

Each partition on the storage device is mapped to a number which is appended to the name of the device under the /dev/ (device) folder.

If your internal hard drive has Windows installed on the first partition (that is, an NTFS volume resides within the boundaries of the first partition on that hard disc drive it would be mapped by the *nix OS to /dev/sda1, or if it's on the second partition of /dev/sda then it would be /dev/sda2.

Probe how the *nix OS has mapped /dev/ files by using

fdisk -l /dev/sd*

or

blkid /dev/sd*

Knowing which partition mapping that the OS in which the SleuthKit is running the source volume you're trying to extract data from is mapped to will enable you to use the handy tools of The Sleuth Kit.

share|improve this answer
    
That looks good. I’ll see if I can find a Windows (or even DOS) port. If so, then it should be perfect for both this question and another one. –  Synetech Mar 10 '12 at 17:09
add comment

dd (for Win32) should allow you to do exactly what you need.

share|improve this answer
    
Close, but there does not seem to be a way to do that without a lot manual calculation to convert clusters to absolute offsets / sectors. –  Synetech Mar 1 '12 at 4:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.