I have used an app called blkls from The Sleuth Kit to extract (copy) (output) the unallocated blocks/sectors of an NTFS volume. By default, with no additional switches/options, blkls will copy/extract the unallocated blocks of a device/disk/partition/volume to standard output.
blkls /dev/sdb1 | bzip2 1>> /media/another-drive/unallocated.img
Since most of those blocks/sectors are empty, I wanted to compress the free space (empty blocks) so I wouldn't end up with a file that was hundreds of gigabytes in size. I piped the standard output of blkls to gzip compression. I also tried bzip2 (which is much more processor/resource -intensive). The compression did succeed in keeping the size of the resulting image file down to hundreds of megabytes. However, it seems that I can't perform data carving on the compressed blob of output produced by blkls that was compressed (on-the-fly) by bzip and gzip2.
Is it true that the only way I could use foremost, scalpel or photorec is to take the compressed output produced by running blkls and uncompress it? That would result in an image file that would be in the hundreds of gigabytes, and I don't want that.
Is there some compression algorithm that I could use that foremost, scalpel, or photorec could carve in compressed form (without having to UNcompress/extract)? Is there a compression algorithm that would simply compress the empty/blank/free space ('0's) of any input binary data stream (source) that it receives?
I know that most of those blocks are empty (have no data in them) since this NTFS volume was a secondary data storage backup , not Operating System volume. All data was pretty much written to it sequentially with little over-writing or deletion.
I am looking for any fragments of files that were partially written or incorrectly written to the NTFS volume.
Search your favourite GNU/Linux Distro's repositories for a package named "SleuthKit"
Tip: - grml, which is a live distro based on Debian's Testing branch, has the latest version of TheSleuthKit already bundled / pre-installed and ready to use upon bootup (version 3.2.3).
I would much appreciate any helpful information tips that anyone would have to offer, or any insight into any of the subject matters that this posting touches upon. Thank you, and regards.