Re: [Bug-ddrescue] Imaging blocks only belong to specific files?

[Christian Franke]

Reon Toerien wrote:
> There must be a way to do this from Linux without resorting to windows 
> tools. Relevant blocks must be written to a file and then used by 
> ddrescue.

NTFS is a windows FS, ddrescue also exists as a Windows(Cygwin) port. So 
I presumed that you have access to a windows system.

Sleuthkit supports NTFS and is available on many Linux Live systems and 
distributions.
http://www.sleuthkit.org/
An example use case from Ubuntu-Rescue-Remix website:
http://ubuntu-rescue-remix.org/node/180

A python script, but it relies on nfi.exe:
http://superuser.com/questions/346381/how-can-i-generate-a-list-of-files-from-a-list-of-sectors


Christian

> On 28 January 2012 19:36, Christian Franke <... 
> <mailto:address@hidden>> wrote:
>
>     Reon Toerien wrote:
>
>         Hi,
>
>         Here's the scenario:
>
>         Filesystem is NTFS and contains some mbox mail files. I need
>         to identify the blocks on the HDD used by these files and only
>         image those specific blocks with ddrescue instead of the
>         entire partition and recover those files.
>
>         Any ideas, recommendations & links?
>
>
>     The old (1999) windows tool nfi.exe can be used to map file path
>     names to logical block numbers and vice versa. Still works on Win7
>     if disk uses MBR partition table. The tool was carefully hidden
>     :-) in some OEM support tools package which is still available here:
>     http://support.microsoft.com/kb/253066/
>
>     Christian