Re: Processing extracted MFT (i.e. mapping filenames to clusters/sectors from an extracted MFT)

> Hi,
>
> I extracted the MFT from a failing disk using
>  
> icat /dev/hda1 0-128-1 > extractedMFT
>
> Now I try to do an istat on the extracted mft but it fails saying boot sector not found. istat does not accept a negative offset i.e. -768432 as the offset which is the starting of the MFT in the disk.
>
> I would like to extract the list of data runs that istat gives for each entry in the MFT. Is there a way to just process the MFT (assuming its a standard MFT without requiring the need to process the attribute list) ?
>
> Or is it possible to extract only the metadata from the disk so that istat runs without errors?
>
> I have ddrescue running on the disk which is giving out a list of failed sectors. I just want to know which files are impacted by the bad sectors formed on the disk.
>
> Thanks in advance.
>
> Regards,
> Emmanuel ------------------------------------------------------------------------------
> Cloud Services Checklist: Pricing and Packaging Optimization
> This white paper is intended to serve as a reference, checklist and point of
> discussion for anyone considering optimizing the pricing and packaging model
> of a cloud services business. Read Now!
> http://www.accelacomm.com/jaw/sfnl/114/51491232/_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org