2

Are there any tools/utilities that can enumerate all the sectors on which a given file is stored?

2
  • 2
    For what purpose? Dec 10, 2013 at 21:41
  • file recovery [satisfy char minimum]
    – eeeeeee
    Dec 11, 2013 at 19:06

1 Answer 1

1

ntfscluster which is part of the ntfs-3g package on Linux systems can do something like this. For example:

$ sudo ntfscluster -F WINDOWS/twunk_32.exe /dev/sdb1
Dump: /WINDOWS/twunk_32.exe
    0x10 - resident
    0x30 - resident
    0x80 - non-resident
             VCN     LCN     Length
               0  1144261        7

LCN stands for "logical cluster number" which you'll have to convert to sectors or byte offsets using the "bytes per cluster" number that's output by ntfscluster -i $DEVICE.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .