How do I determine what file occupies a given sector?

Question

I have a hard drive with 3 bad sectors. I know the sector numbers and the computer can still boot into Windows. I want to run sector repair from an HDD diagnostics tool from the manufacturer, but before I do that, I'd like to know what files are affected. Is there a way to figure out what file or files are occupying those sectors?

Answer 1

Here's the process using WinHex, a handy hex editor that can examine and edit drives directly. Be very careful; this tool can damage your system if used inappropriately. Open disks read-only whenever possible.

1. Since you have the bad sector locations already, you can open the drive in WinHex directly ("Open Disk" toolbar button) and then navigate to the sector to view the data ("Go to Sector" toolbar button). Assuming your sector locations are physical sector addresses, you need to open your physical drive in this step.
   
   This won't identify the file directly, but the left-hand pane should identify the partition that contains this sector and its corresponding relative sector address.
   

2. If the partition you've identified is an NTFS or FAT partition, we can open the partition directly ("Open Disk" again). This will open the partition in a new tab, so you can switch back and forth as needed. In the partition tab, use the "Go to Sector" function again, but this time input the translated sector (the "relative sector" identified in the drive view).
   
   Now, in the left-hand pane, you should see a section on "Alloc. of visible drive space". Under this is the cluster #, physical sector #, logical (relative) sector #, and the filename if this sector actually belongs to a file.
   

If these steps don't give you an immediate answer, your bad sectors may not be in use. If the results are unclear, you may have to do some more digging to find your answer.

Answer 2

Most defragmenting programs show a disk-map displaying all the clusters on the disk which you can then click (look for the ones marked as bad) to view the file(s) located in that cluster.

As Walter said, any disk and OS combo from the past decade or so will make sure to relocate files from bad sectors automatically (drive firmware usually handles this, but disk tools like chkdsk or defragmenters will usually do this as well).

Defraggler:

Defrag-a-File:

Vopt:

Answer 3

as far as i know when a drive hits a certain number of read errors on a sector it gets marked as bad and its contents are copied away to another place on the drive. this usually happens before the data on that sector has become completely unreadable.

I try to dig up a source for that, just read it yesterday but cannot remember where.

from man hdparm (8)

Note also that the --repair-sector flag can be used to restore (any) bad sectors when they are no longer needed, including sectors that were genuinely bad (the drive will likely remap those to a fresh area on the media).

Bottom line: you don't have to care about bad sectors, the harddrives firmware does that for you. only thing you have to do is get a new drive before there are too many of them and your drive dies.

Answer 4

DiskView from Sysinternals performs exactly this function: to display a diskmap of the drive and let you see what files occupy what clusters.

Unfortunately, there does not seem to be a way of displaying the names of system files.

Answer 5

RunTime's DiskExplorer allows you to examine a drive by sector. It's payware ($70 for the NTFS version) but free to try. They have versions for NTFS, FAT and Linux (ext2/3).

Answer 6

Try nfi.exe - Windows NT File System (NTFS) File Sector Information Utility. Download from Microsoft OEM Support Tools Phase 3 SR2.

> nfi.exe
Dumps information about an NTFS volume, and optionally determines
which volume and file contains a particular sector.

Usage: nfi drive-letter [logical-sector-number]

        Drive-letter can be a single character or a character followed
        by a colon (i.e., C or C: are acceptable).

        Logical-sector-number is a decimal or 0x-prefixed hex
        number, specifying a sector number relative to the volume
        whose drive letter is given by drive-letter. If not
        specified, then information about every file on the volume
        is dumped.

   nfi NT-device-path physical-sector-number

        Determines which volume a given physical sector on a drive is
        within, and then which file on the volume it is in.

        NT-device-path is the NT-style path to a physical device.
        It must not include a partition specification.

        Physical-sector-number is a decimal or 0x-prefixed hex
        number, specifying a sector number relative to the physical
        drive whose device path is given by NT-device-path.

    nfi full-win32-path

        Dumps information about a particular file. full-win32-path
        must start with a drive letter and a colon.

Example: nfi \device\harddisk0\dr0 18397369