9

I've had a hard disk failure and managed to rescue some data from the disk (1TB) with GNU's ddrescue. The last 800GB of the disk were perfect, no single error, but in the first 200GB there were almost 14000 errors (badblocks) spread across the area. ddrescue creates a logfile that describes where the badblocks are.

ddrescues command line params:

ddrescue /dev/sdb /dev/sdd /mnt/sdc1/sdb.log -r -1 -f -d -v

The logfile looks like this:

#      pos        size  status
0x00000000  0x1C08CE00  +
0x1C08CE00  0x00000200  -
0x1C08D000  0x011E6800  +
0x1D273800  0x00000200  -
0x1D273A00  0x005EC000  +
0x1D85FA00  0x00000200  -
...         ...         ...

The plus (+) means contiguous good space, the minus (-) unreadable space; position and size are in hexadecimal. Striping the lines ending in '+' I have a list whith badblock positions, but I need a way to correlate this badblocks to files on the File System, which is, by the way, NTFS.

I know that I can use something like DiskExplorer to do this manually, but it would be the hell with 14000 sectors. So, there is a more or less automatic and elegant way of doing this ?

Jens Erat
  • 18,485
  • 14
  • 68
  • 80
Miguel Santos
  • 316

3 Answers3

6

Since the huge success of this question, I've been left without answers, if there were any. But I continued researching and found an Microsoft utility that dates 1999, called nfi.exe, part of the OEM Support Tools Phase 3 Service Release 2 for Windows NT 4 and 2000. The utility does exactly what I needed, receives a sector and returns a file. But it does that to individual sectors, so I had to created a script to automate the process. It's a Python (2.7+) script that works this way:

It receives as input an ddrescue log file, parses it, calls nfi.exe for each sector in the file and generates a list with the files in alphabetical order. 

>sector_correlator.py -h

usage: sector_correlator.py [-h] [-v] [-n \path\to\nfi.exe] [-V] [-L]
                        logfile nt-device-path output file

Receives a list of sectors and returns a list of files which resides in them.

positional arguments:
  logfile              path to ddrescue's logfile.
  nt-device-path       NT-style path to physical device, like
                       \device\harddisk1\dr1
  output file          filelist output file name

optional arguments:
  -h, --help           show this help message and exit
  -v, --version        show program's version number and exit
  -n \path\to\nfi.exe  nfi.exe's path, if not speciified, assumes's it is in
                       the same path as the script
  -V                   enables verbose mode
  -L                   save nfi.exe's output log to nfi_raw.log

Example:

sector_correlator.py sdb.log \devices\harddisk0\dr0 filelist.txt

Where: sdb.log is ddrescue's log,

\device\harddisk0\dr0 is an NT-style path to the HD (you discover it using an sysinternals tool called WinObj and the Disk Management Utility) WinObj showing physical device list enter image description here

and filelist.txt is the file list you want. It will look like this:

\Documents\Downloads\Evernote_4.5.1.5432.exe
\Documents\Downloads\Programs\Apophysis207SE.exe
\Documents\Downloads\Programs\GetGnuWin32-0.6.21.exe
\Documents\Downloads\Programs\mbam-setup.exe
\Documents\Downloads\Programs\msnbackup133.exe
\Documents\Downloads\Programs\x64Components_v254.exe

The other arguments on the script are optional and are explained when you run it with -h. By default, the script assumes nfi.exe is in the same dir, if not, use -n pathtonfi.exe.

Finally, here is the link to the script: sector_correlator.py

It's very rudimentary and has no error handling, but does the job.

Miguel Santos
  • 316
2

This is more an addendum to the Answer (#1) based on my attempts to check my failing drive. 1) you can still get nfi.exe and use it (with winxp at least). You download the file listed as oem3sr2.zip in the linked MS page above in Ans #1.

I found that with the current version of nfi.exe you do NOT need to dig out the drive path. A simple drive letter will do.... eg "K:"

python sector_correlator.py badsectors.log k: badfiles.txt

However (and my strength is in perl so don't expect much from my reading of python), it seems to me that the script only checks one block per line matching '-'. So if the log file reported 200 consecutive bad blocks (the second number of the logfile line) , then the script has not checked the last 199 blocks for different file associations.

In linux you can use ddrescuelog -l- badsectors.log to expand to show all the bad blocks. Unfortunately, and I don't understand why, Ubuntu's implementation of ddrescue does not include ddrescuelog (but it's fairly easy to get the latest from debian, and compile & install it, about the simplest I've seen).

J Tweed
  • 21
0

I am recovering a bad disk right now, and am going to try this:

http://sourceforge.net/projects/ddrutility/

... which (as of version 2.1) includes ddru_ntfsfindbad:

Ddru_ntfsfindbad is a utility for NTFS partitions to find which files are related to bad sectors in a ddrescue log file.

Installation means compiling from source, but with an Ubuntu machine (VM) lying about, the instructions provided made that easy.

Mark Cranness
  • 111