Re: How to deal with defect block

Adam Piggott wrote:
> secinspect.exe:
> http://www.microsoft.com/en-gb/download/details.aspx?id=19470
>
> DiskView:
> http://technet.microsoft.com/en-gb/sysinternals/bb896650.aspx
>
> You will need to find out the partition offset. One method is using 
> Microsoft's free secinspect.exe
>
> Find the correct physical drive from the output, ...

An alternative might be nfi.exe, a very old (1999) MS tool which maps 
sectors to files without any further calculations.

It still works for me on Win7 x64 with a 2TB disk with old MBR partition 
table. A real world example:

C:\ # nfi \device\harddisk0\dr0 10008000
...
***Physical sector 10008000 (0x98b5c0) is in file number 37692 on drive C.
  \Windows\SysWOW64\audiodev.dll
     $STANDARD_INFORMATION (resident)
     $FILE_NAME (resident)
     $FILE_NAME (resident)
     $DATA (nonresident)
         physical sectors 10007848-10008327 (0x98b528-0x98b707)


nfi.exe was very carefully hidden in some OEM Support Tools package 
which is still available:
http://support.microsoft.com/kb/q253066/en

I'm not aware of any newer version.


Another alternative: Use sleuthkit (ifind, istat) from you favorite 
rescue live CD/DVD.
See http://ubuntu-rescue-remix.org/node/180 for an example.

Thanks,
Christian


------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds