Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #5970 > unrolled thread

Script that lists Files using special Clusters

Back to article view | Back to comp.programming

Contents

  Script that lists Files using special Clusters example@example.com - 2015-11-14 13:19 +0100
    Re: Script that lists Files using special Clusters Robert Wessel <robertwessel2@yahoo.com> - 2015-11-15 17:33 -0600

#5970 — Script that lists Files using special Clusters

Hello,

I want to write a script, that

1. analyzes every MFT-Entries of a NTFS-Volume,

2. checks, which Clusters this Entry uses for storing data,

3. if one of this Clusters is in a special area (ca. Cluster 0 - 200.000
/ 30D40) to write the Name (with its full path) in a Text-file.


How can I do this?




Background: Beginning Sektors of a HD (several hundred MBs) where
overwriten with dd id=/dev/zero with zeros because of a wrong
functioning machine. MFT is ok. Now there should be a list with files
whose data is corrupt.

[toc] | [next] | [standalone]

#5974

On Sat, 14 Nov 2015 13:19:04 +0100, example@example.com wrote:

>Hello,
>
>I want to write a script, that
>
>1. analyzes every MFT-Entries of a NTFS-Volume,
>
>2. checks, which Clusters this Entry uses for storing data,
>
>3. if one of this Clusters is in a special area (ca. Cluster 0 - 200.000
>/ 30D40) to write the Name (with its full path) in a Text-file.
>
>
>How can I do this?
>
>
>
>
>Background: Beginning Sektors of a HD (several hundred MBs) where
>overwriten with dd id=/dev/zero with zeros because of a wrong
>functioning machine. MFT is ok. Now there should be a list with files
>whose data is corrupt.


Perhaps the following will help:

http://grayscale-research.org/new/pdfs/NTFS%20forensics.pdf

[toc] | [prev] | [standalone]

Back to top | Article view | comp.programming

csiph-web