Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to know the sector location of a particular file on my hard drive.

Can I get that by any means?

I am running Mac OS X (Intel) with a Hitachi HDD.

share|improve this question
    
I would have thought that fileXray does this, but it doesn't seem like it. –  Daniel Beck May 19 '11 at 10:52

2 Answers 2

Have a look at hfsdebug to get the block number.

share|improve this answer
    
It looks like you cannot download hfsdebug from that site any more, which sucks. Not like one wants to download a random binary from another site and hope it's legitimate :) –  Blair Zajac Jun 7 '11 at 22:33

There's a great piece of Forensics software which works (best) on Unix-like systems called The Sleuth Kit (TSK). It is a collection/suite of apps. In particular, one such app is called ifind.

Try:

ifind -n Users/(Username)/Documents/(filename.doc) /dev/sda1

and the block/sector(/?cluster?) numbers that contain the contents of the given file should be output by the ifind program.

A Debian-based specialized live Linux distro called grml can be downloaded for free. It already has the latest version of TheSleuthKit already installed. You can download the .iso image (using BitTorrent or with any regular HTTP client (like a web browser)) and burn it to a cd-r and then boot your computer from the cd-r.

When the system boots up into grml, you can open a Terminal window and use the apps in the Sleuth Kit.

If you boot your Mac into a live linux distro, your internal hard drive, which presumably has your Mac OS X operating system installed on it will be mapped to a virtual "file" in teh Linux file system called /dev/sda. The internal hard disk will be mapped to 'a' and any additional storage (block) devices that the operating system find will be mapped to subsequent letters in the alphabet, e.g. /dev/sdb, /dev/sdc, etc., e.g. USB drives.

Each partition on the storage device is mapped to a number which is appended to the name of the device under the /dev/ (device) folder.

For example, if your internal hard drive has OS X installed on the first partition (that is, an HFS+ volume resides within the boundaries of the first partition on that hard disc drive it would be mapped by the *nix OS to: /dev/sda1 or if it's on the second partition of /dev/sda then it would be /dev/sda2.

Use /dev/sda to access the internal hard disc drive as a whole. Use /dev/sda1, /dev/sda2, /dev/sda3 to access each of the partitions (storage volumes) on that hard disk.

Probe how the nix OS has mapped /dev/ files by using:

fdisk -l /dev/sd*

or

blkid /dev/sd*

Knowing which partition mapping that the OS in which the SleuthKit is running the source volume you're trying to extract data from is mapped to will enable you to use the handy tools of The Sleuth Kit.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.