Processing extracted MFT (i.e. mapping filenames to clusters/sectors from an extracted MFT)

Hi,

I extracted the MFT from a failing disk using

 
icat /dev/hda1 0-128-1 > extractedMFT 

Now I try to do an istat on the extracted mft but it fails saying boot sector not found. istat does not accept a negative offset i.e. -768432 as the offset which is the starting of the MFT in the disk.

I would like to extract the list of data runs that istat gives for each entry in the MFT. Is there a way to just process the MFT (assuming its a standard MFT without requiring the need to process the attribute list) ?

Or is it possible to extract only the metadata from the disk so that istat runs without errors?

I have ddrescue running on the disk which is giving out a list of failed sectors. I just want to know which files are impacted by the bad sectors formed on the disk.

Thanks in advance.

Regards,
Emmanuel
------------------------------------------------------------------------------
Cloud Services Checklist: Pricing and Packaging Optimization
This white paper is intended to serve as a reference, checklist and point of
discussion for anyone considering optimizing the pricing and packaging model
of a cloud services business. Read Now!
http://www.accelacomm.com/jaw/sfnl/114/51491232/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org