Are there any tools/utilities that can enumerate all the sectors on which a given file is stored?
1 Answer
ntfscluster
which is part of the ntfs-3g
package on Linux systems can do something like this. For example:
$ sudo ntfscluster -F WINDOWS/twunk_32.exe /dev/sdb1
Dump: /WINDOWS/twunk_32.exe
0x10 - resident
0x30 - resident
0x80 - non-resident
VCN LCN Length
0 1144261 7
LCN stands for "logical cluster number" which you'll have to convert to sectors or byte offsets using the "bytes per cluster" number that's output by ntfscluster -i $DEVICE
.