can I look up which file exists on a given cyclender?

M

MrWizard6600

Supreme [H]ardness
Joined
Jan 15, 2006
Messages
5,791
I found that theres a physical defect on the surface on a disk holding sectors 10 through 50 on cyclinder 31569 head 12. Is there any way I can find out which file that is?
 
yeah its a windows formatted drive, 4kbit/sector, NTFS.
 
Last edited:
Not that i know of, but it may also be metadata; which is much worse than files. With corrupted metadata, you can lose an entire filesystem, and only recover partial files and names.

To fix a bad sector, you may try the commercial SpinRite software. After the damage being fixed, a chkdsk should fix the filesystem damage.
 
In most cases simple writes will also fix damaged sectors. If the sector had just a checksum error this will correct it and if the sector is unwriteable the drive can remap it to a spare sector.
 
Yes writing would fix the bad sector and allow the HDD to swap the bad sector for a reserve one (Current Pending Sectors get one substracted and Reallocated Sector Count gets one incremented). But the data in that bad sector may still be needed and thus cannot be overwritten.

Spinrite can recover sectors better than the HDDs themselves can, apparently, and can work to recover that sector by retrieving the contents and writing to it, so it gets replaced by a reserve sector but now with the original data. Thus; no damage to the NTFS filesystem.
 
I've got spinrite, thats how I know which cyclender is defective. No amount of writing by spinrite seems to get the sectors back into life.

im sure theres a way to do it with inodes in unix, but I have no idea where to start in windows.

When I booted up my computer and started browsing the D drive it eventually told me it had to "scan the drive for errors". I let it do its automatic thing and everything seems OK now, but I just want to know which file was damaged so I can replace it --Ive got backups, but I just need to know what to back up!
 
my lab instructor has told me that typically when windows encounters a bad physical sector read what it can, do a subtractive parody and write the sectors off as bad at the file-system leve, so I shouldn't worry about this too much, because its entirely possible that no data was ever written to these sectors...

But bump just because I'm intrested. There must be a way to do this...
 
because its entirely possible that no data was ever written to these sectors...
Click to expand...
If that were true it also would never be read. It might be written to, in case which the HDD will swap the sector and you will never notice.

However, if the drive has a bad sector that means Windows can not recover one byte from it. That means 512 bytes (one sector) of information is either lost or inaccessible. If that sector contained filesystem metadata, you could lose large amounts of data. Though recovery programs likely can recover most if not all data with minor corruption.

Thus, i'm critical of your lab instructors comments. Are you sure you interpreted them correctly? Some RAID controllers can correct bad sectors by using redundant data to reconstruct the original data, then write that data to the bad sector, as it doesn't need the contents of that bad sector, as long as it's a redundant array (RAID1 and higher).
 
sub.mesa said:
However, if the drive has a bad sector that means Windows can not recover one byte from it. That means 512 bytes (one sector) of information is either lost or inaccessible. If that sector contained filesystem metadata, you could lose large amounts of data. Though recovery programs likely can recover most if not all data with minor corruption.

Thus, i'm critical of your lab instructors comments. Are you sure you interpreted them correctly? Some RAID controllers can correct bad sectors by using redundant data to reconstruct the original data, then write that data to the bad sector, as it doesn't need the contents of that bad sector, as long as it's a redundant array (RAID1 and higher).
Click to expand...

erm... a sector is 512bits (64bytes) usually, as I mentioned above im on the 4k system.
this "scratch", or whatever it is seems to be only on the one sector on the one track, extending for 10KBytes (24x 4096bit sectors).

edit: it is 512bytes not bits. My mistake.

And as I said, Windows told me I had to scan my drive for consistancy, I did, nothings changed as far as I can tell. Either way the file has definately been relocated, so finding out whats currently on that section of that cyclender is useless since whatever it was windows has done wha tit can to repair it and move it.

but my question remains valid, If windows hadn't automatically repaired this section and I knew the the physical space where the data was destoryed, how do I go from a 4 dimensional address to a Drive:/users/Geoff/mydocs/awsomeFileThatsDestroyed?
 
Last edited:
No, the sector size of all HDDs is 512 bytes with only very few exceptions. This includes the EARS drives, which physically have 4096 byte (4KiB) sectors but expose themselves as having 512 byte (0.5KiB) sectors.

In the future, HDDs and SSDs may use 4096 byte sectors, which are supported from Windows Vista and higher, but not XP. That's the reason EARS drives still expose themselves as having 512 byte sectors and uses firmware to correct the misalignment issues at the cost of lower performance, as it needs to read when writes happen.

I'm not sure about your particularly issue, how it was fixed. It could be like you said that the sector was never really in use by the NTFS filesystem. Regarding your last question: where files are located are stored in the filesystem metadata, and as such depends on which filesystem is in use. FAT uses a simple "File Allocation Table"; NTFS is actually very similar but has a metadata-only journal to protect against filesystem damage or inconsistency upon unclean shutdowns such as power failure and crashes.

But you would need special software to access metadata and translate a filename/path into a LBA number; which can contain many fragments. (i.e. sector 7-19 + sector 5000-5010 + 5080-5086 = 3 fragments).
 
There were DOS commands that would supply the information. There are certainly 3rd party software programs that move files around.

Lots of people on the internet know how to do what is being requested.

I don't know how to do it.
 
Possibly analyze from mydefrag.

http://www.mydefrag.com/

This will give you a LCN (logical cluster number) for each file that you put your mouse over. However with the defrag api there should be an easier way / program to get this info.
 
You must log in or register to reply here.
Back
Top