If I know the sector position and file size, is this sufficient to recover a file?
 

Hello...

I am in the process of recovering my brother's 200GB harddrive which is formatted as NTFS. The need for recovery has developed as a result of a corrupted MFT.

Initially I backed up the drive using a a RAW read under linux. Now though, using Windows XP, I have nearly identified all of the MFT entries that are recoverable on the drive via a sector level scan of the drive which produces a report detailing all the recoverable files and sector position they start at, their size, name, etc...

On looking at the report it has raised my interest as to whether I could take the report and use the comma de-limited information contained within to recover the files using linux, more out of academic interest than anything else!

So for example imagine I had a hard drive and it contained 2 files. Assume also that I know the starting sector position on the drive that each file begins, say sector 246,519 and sector 2,952,055. Also assume that I know the size of each file, say 157,775 bytes and 203,488 bytes respectively. Could I use, for example, the dd command to successfully retrieve the missing files that I have start sector and file size details for? If I could, how would I structure the command using a starting sector and file size? Or are there alternative methods?

I am unsure whether this would work in practice as I am unsure whether a file that starts in a given sector will necessarily be stored sequentially based on the file size or whether in reality it is much more likely that the file will be fragmented across non-sequential sectors with the only know sector being the starting sector!

Any comments would be very welcome.

Thanks
Jamie.

I have never tried doing this altho I believe it will work if the file exists sequentially. The format for dd would be

dd if=/dev/hda1 of="filename" bs=1024? seek=a multiple of bs into device count=a multiple of bs equal to filesize

Probably use an extra block or two since getting too much won't hurt, and sometimes files have little 32 byte things on the end that you might need.

Files are often fragmented, so this will work
only if you are lucky and file contents are stored in sequental order.
I'd look for some ntfs recovery tools/articles.