Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have used an app called blkls from The Sleuth Kit to extract (copy) (output) the unallocated blocks/sectors of an NTFS volume. By default, with no additional switches/options, blkls will copy/extract the unallocated blocks of a device/disk/partition/volume to standard output.

blkls /dev/sdb1 | bzip2 1>> /media/another-drive/unallocated.img

Since most of those blocks/sectors are empty, I wanted to compress the free space (empty blocks) so I wouldn't end up with a file that was hundreds of gigabytes in size. I piped the standard output of blkls to gzip compression. I also tried bzip2 (which is much more processor/resource -intensive). The compression did succeed in keeping the size of the resulting image file down to hundreds of megabytes. However, it seems that I can't perform data carving on the compressed blob of output produced by blkls that was compressed (on-the-fly) by bzip and gzip2.

Is it true that the only way I could use foremost, scalpel or photorec is to take the compressed output produced by running blkls and uncompress it? That would result in an image file that would be in the hundreds of gigabytes, and I don't want that.

Is there some compression algorithm that I could use that foremost, scalpel, or photorec could carve in compressed form (without having to UNcompress/extract)? Is there a compression algorithm that would simply compress the empty/blank/free space ('0's) of any input binary data stream (source) that it receives?

I know that most of those blocks are empty (have no data in them) since this NTFS volume was a secondary data storage backup , not Operating System volume. All data was pretty much written to it sequentially with little over-writing or deletion.

I am looking for any fragments of files that were partially written or incorrectly written to the NTFS volume.


Search your favourite GNU/Linux Distro's repositories for a package named "SleuthKit"

Tip: - grml, which is a live distro based on Debian's Testing branch, has the latest version of TheSleuthKit already bundled / pre-installed and ready to use upon bootup (version 3.2.3).

I would much appreciate any helpful information tips that anyone would have to offer, or any insight into any of the subject matters that this posting touches upon. Thank you, and regards.

share|improve this question
I found information about "Sparseness" or "sparse files" in the man page for the command "ntfsclone" (which is part of the "NTFSprogs" package, which ships with / is bundled with most GNU/Linux distros). Consult "info ntfsclone" or "man ntfsclone" and search (type a forward slash) and "sparse" and see what it has to say about "sparse files." – Fleetwood May 14 '12 at 3:55

I would just hack out a quick tool to split the input into 4KB blocks and drop any blocks that were all zeroes, passing on the other blocks as-is.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .