I want to know the sector location of a particular file on my hard drive.
Can I get that by any means?
I am running Mac OS X (Intel) with a Hitachi HDD.
There's a great piece of Forensics software which works (best) on Unix-like systems called The Sleuth Kit (TSK). It is a collection/suite of apps. In particular, one such app is called
and the block/sector(/?cluster?) numbers that contain the contents of the given file should be output by the
A Debian-based specialized live Linux distro called grml can be downloaded for free. It already has the latest version of TheSleuthKit already installed. You can download the .iso image (using BitTorrent or with any regular HTTP client (like a web browser)) and burn it to a cd-r and then boot your computer from the cd-r.
When the system boots up into grml, you can open a Terminal window and use the apps in the Sleuth Kit.
If you boot your Mac into a live linux distro, your internal hard drive, which presumably has your Mac OS X operating system installed on it will be mapped to a virtual "file" in teh Linux file system called
Each partition on the storage device is mapped to a number which is appended to the name of the device under the
For example, if your internal hard drive has OS X installed on the first partition (that is, an HFS+ volume resides within the boundaries of the first partition on that hard disc drive it would be mapped by the *nix OS to:
Probe how the nix OS has mapped /dev/ files by using:
Knowing which partition mapping that the OS in which the SleuthKit is running the source volume you're trying to extract data from is mapped to will enable you to use the handy tools of The Sleuth Kit.