Home / server / Questions / 1168620
Accepted
Jonathan Gilbert
Asked: 2024-12-07 21:08:40 +0800 CST

List sectors associated with a file on an exFAT volume

  • 772

I have a device that is failing. Using ddrescue, I have recovered all all but about 500 KB in 83 regions. The map file tells me the raw offset and length of each lost region. I want to find out what files are affected. How can I obtain a list of physical sector offsets associated with a file on an exFAT volume?

exfat

2 Answers

  1. Best Answer

    I ended up writing my own utility. I wasn't able to locate anything pre-existing. It is written in C# against .NET 8+ and the source code is here:

    https://github.com/logiclrd/FindAffectedFilesExfat

    Screenshot

    • 6

  2. In terms of effort expended, I think there's a better way to solve the core problem than suggested in the question title (listing the sectors of a volume and trying to determine which file each of them belongs to). It seems that the core problem is the following:

    I have a device that is failing. [...] I want to find out what files are affected.

    If you just want to obtain a list of files affected by the device failure, it is not necessary to gather a sector-by-sector mapping of file locations on the device. As you already have the contents of the failed drive imaged to another device or an image file and retain the mapfile produced by ddrescue in the process, you can use the fill mode of ddrescue to mark all unrecovered sectors on the image with some string that doesn't appear in any of the files on the failed disk, then mount the image as a file system and run a simple grep -r -l 'your_unique_marker_string' over it. This will provide you with a clean list of damaged files and nothing else; since the actual search for files is done at file system level, any unrecovered sectors not corresponding to any file are conveniently ignored with no effort from your part.

    To invoke ddrescue in this mode, you would do like this:

    ddrescue --fill-mode=l- marker_string.txt image_file.img map_file.map

    where marker_string.txt is the file containing the unique string you want to fill the unrecovered sectors with. Note that you cannot specify the string directly at the command line.

    The --fill-mode option takes the status character(s) of the sectors to be filled as argument, as presented in the mapfile. If the mapfile contains blocks with statuses other than + (successfully read) and - (known bad sectors), you'll want to add those to the fill mode list (not the + of course!).

    The letter l in the argument of the --fill-mode option outputs location data (sector number) at the start of each marked sector. It is optional, but there's little reason to omit it; you can, for example, use the location data to construct a domain mapfile to restrict further rescue attempts to sectors containing file data, which may be useful if the failed drive had lots of unused space now presenting as bad sectors.

    I've found this method most effective and have used it on several occasions with good results. It has the significant advantage that it's independent of the file system used. It does depend on the file system being healthy enough to be able to be mounted (i.e. that enough of the file system structures have been rescued); my experience is from NTFS and I've found Windows' native CHKDSK to be quite effective at repairing it into a mountable condition. I'd expect the same outcome from any modern journaling file system and its native repair tools.

    • 1