How to get a file's sector location/number?

Question

I want to know the sector location of a particular file on my hard drive.

Can I get that by any means?

I am running Mac OS X (Intel) with a Hitachi HDD.

Answer 1

Have a look at hfsdebug to get the block number.

Answer 2

There's a great piece of Forensics software which works (best) on Unix-like systems called The Sleuth Kit (TSK). It is a collection/suite of apps. In particular, one such app is called ifind.

Try:

ifind -n Users/(Username)/Documents/(filename.doc) /dev/sda1

and the block/sector(/?cluster?) numbers that contain the contents of the given file should be output by the ifind program.

A Debian-based specialized live Linux distro called grml can be downloaded for free. It already has the latest version of TheSleuthKit already installed. You can download the .iso image (using BitTorrent or with any regular HTTP client (like a web browser)) and burn it to a cd-r and then boot your computer from the cd-r.

When the system boots up into grml, you can open a Terminal window and use the apps in the Sleuth Kit.

If you boot your Mac into a live linux distro, your internal hard drive, which presumably has your Mac OS X operating system installed on it will be mapped to a virtual "file" in teh Linux file system called /dev/sda. The internal hard disk will be mapped to 'a' and any additional storage (block) devices that the operating system find will be mapped to subsequent letters in the alphabet, e.g. /dev/sdb, /dev/sdc, etc., e.g. USB drives.

Each partition on the storage device is mapped to a number which is appended to the name of the device under the /dev/ (device) folder.

For example, if your internal hard drive has OS X installed on the first partition (that is, an HFS+ volume resides within the boundaries of the first partition on that hard disc drive it would be mapped by the *nix OS to: /dev/sda1 or if it's on the second partition of /dev/sda then it would be /dev/sda2.

Use /dev/sda to access the internal hard disc drive as a whole. Use /dev/sda1, /dev/sda2, /dev/sda3 to access each of the partitions (storage volumes) on that hard disk.

Probe how the nix OS has mapped /dev/ files by using:

fdisk -l /dev/sd*

or

blkid /dev/sd*

Knowing which partition mapping that the OS in which the SleuthKit is running the source volume you're trying to extract data from is mapped to will enable you to use the handy tools of The Sleuth Kit.