Get a list of files located on a range of potentially bad sectors in NTFS

Question

I have a 3TB hard drive which had 16 bad sectors according to SMART data. I ran a surface test with HDSentinel, which increased that number to about 100. Then I directly copied directories to a healthy 3TB HDD, by order of importance (using either Robocopy or SynchronizeIt, which both preserve all timestamps including those of directories), which further increased the number of bad sectors to 416. I think that the best course of action would have been to clone it completely to the other HDD, in order to salvage as much data as possible, since each attempt at reading a bad sector seems to make the problem worse, but there's always the risk of the HDD completely failing before the process is over, and some directories here are much more important than others – anyway, what's done is done, and I have successfully recovered what mattered the most.

During the surface test, HDSentinel provided a list of unreadable sectors, with which I identified 6 files affected by bad sectors ; I moved them to a special folder and tried not to touch them yet – well, I say tried, because at first I wanted to move them with Windows 7 Explorer, but that stupid thing insisted on parsing them as they were selected so as to display a preview, which froze the system for a while and added some more bad sectors to the count, so I had to move those files from the command line...

Side question : how can I preventively disable that preview in such a case ?

Now, I have a few options that I know of to deal with those files :

• Either try to copy them directly with Roadkil Unstoppable Copier (which is supposed to skip bad sectors and salvage what is salvageable).
• Or run ddrescue to extract specifically the range of sectors occupied by corrupted files (plus the first 10GB, so as to have the system files, including the MFT, which should allow me to extract the fragmented files without getting a headache – those corrupted files are mostly catch-up TV broadcasts (no longer online) which were downloaded simultaneously, and I guess that's why they have been written interlaced, with thousands of fragments each, despite the HDD having plenty of free space).

In the second case (which is probably the safest at that point), in order to be sure that I'm not missing anything, I would like to get a list of files having at least one sector in the potentially damaged area. The first bad sector identified was number 4131708368, the last was 4157865694, so I want to identify which files are found between sectors 4131440000 and 4158400000, to have a good safety margin.

After reading this thread, I tried two methods :

• With nfi.exe (takes sector values as input, I put a step of 8 to get only one value per 4KB cluster)

  FOR /L %N in (4131440000,8,4158400000) DO nfi.exe R: %N >>"G:\nfi ST3000DM001 4131440000-4158400000.txt"
  

But it doesn't work, it displays negative values. This seems to be a problem of 32 bit limit for the incremental calculation, despite the numbers being below 2^32. By making tests I found out that the problem appeared at 2147483648, which is exactly 2^31. Why is that ?

• With fsutil (requires cluster values as input, obtained by dividing the sector values by 8) :

  FOR /L %N in (516430000,1,519800000) DO fsutil volume querycluster R: %N >>"G:\fsutil querycluster ST3000DM001 516430000-519800000.txt"
  

This works, and the presentation is more streamlined than with nfi.exe (one line per cluster), but it's excruciatingly slow : about 1 second per value, it would take 936 hours to finish. It seems to be much faster if the cluster values are entered in a row on the same line, but I wouldn't know how to make an incremental count to add all values within the same line without having to type them, and I guess that the poor little cmd.exe would choke with 3370000 values on the same command...

Is there a better method to get what I want ? Does that sound like a safe and sound approach to that kind of issue ?

Thanks.

Answer 1

I found out that Piriform's Defraggler has the ability to display a complete list of files present in a given block on the volume's map, and also highlights all the blocks where at least one sector of a given file can be found. Too bad that it doesn't provide the corresponding range of sectors, but so far it's still the best tool I've found for this particular purpose.

MyDefrag, another popular defragmentation software, has a more accurate grid, allows zooming, and directly provides the name of the file occupying any block being pointed at, but it doesn't give a list of files found in a range of sectors, and it's neither accurate nor practical to hover over each pixel-sized block in order to check which files are located there (besides, if a file has thousands of fragments as is the case for several of the files I have yet to recover, it's impossible to catch them all).

If anybody has another good idea... it could benefit quite a few people having a similar issue.

Answer 2

for /L %N in (1,1,100) do ( fsutil volume querycluster c: %N00 %N01 %N02 %N03 %N04 %N05 %N06 %N07 %N08 %N09 %N10 %N11 %N12 %N13 %N14 %N15 %N16 %N17 %N18 %N19 %N20 %N21 %N22 %N23 %N24 %N25 %N26 %N27 %N28 %N29 %N30 %N31 %N32 %N33 %N34 %N35 %N36 %N37 %N38 %N39 %N40 %N41 %N42 %N43 %N44 %N45 %N46 %N47 %N48 %N49 %N50 %N51 %N52 %N53 %N54 %N55 %N56 %N57 %N58 %N59 %N60 %N61 %N62 %N63 %N64 %N65 %N66 %N67 %N68 %N69 %N70 %N71 %N72 %N73 %N74 %N75 %N76 %N77 %N78 %N79 %N80 %N81 %N82 %N83 %N84 %N85 %N86 %N87 %N88 %N89 %N90 %N91 %N92 %N93 %N94 %N95 %N96 %N97 %N98 %N99 )

For me this is about 5 seconds, a 19-20x improvement.

Sadly that still seems to work out to be about 50 hours. Wonder if the command prompt can handle a 1000 at once.

This seems to go faster doing a 1000x at once.

for /L %N in (1,1,1000) do fsutil volume querycluster c: %N000 %N001 %N002 %N003 %N004 %N005 %N006 %N007 %N008 %N009 %N010 %N011 %N012 %N013 %N014 %N015 %N016 %N017 %N018 %N019 %N020 %N021 %N022 %N023 %N024 %N025 %N026 %N027 %N028 %N029 %N030 %N031 %N032 %N033 %N034 %N035 %N036 %N037 %N038 %N039 %N040 %N041 %N042 %N043 %N044 %N045 %N046 %N047 %N048 %N049 %N050 %N051 %N052 %N053 %N054 %N055 %N056 %N057 %N058 %N059 %N060 %N061 %N062 %N063 %N064 %N065 %N066 %N067 %N068 %N069 %N070 %N071 %N072 %N073 %N074 %N075 %N076 %N077 %N078 %N079 %N080 %N081 %N082 %N083 %N084 %N085 %N086 %N087 %N088 %N089 %N090 %N091 %N092 %N093 %N094 %N095 %N096 %N097 %N098 %N099 %N100 %N101 %N102 %N103 %N104 %N105 %N106 %N107 %N108 %N109 %N110 %N111 %N112 %N113 %N114 %N115 %N116 %N117 %N118 %N119 %N120 %N121 %N122 %N123 %N124 %N125 %N126 %N127 %N128 %N129 %N130 %N131 %N132 %N133 %N134 %N135 %N136 %N137 %N138 %N139 %N140 %N141 %N142 %N143 %N144 %N145 %N146 %N147 %N148 %N149 %N150 %N151 %N152 %N153 %N154 %N155 %N156 %N157 %N158 %N159 %N160 %N161 %N162 %N163 %N164 %N165 %N166 %N167 %N168 %N169 %N170 %N171 %N172 %N173 %N174 %N175 %N176 %N177 %N178 %N179 %N180 %N181 %N182 %N183 %N184 %N185 %N186 %N187 %N188 %N189 %N190 %N191 %N192 %N193 %N194 %N195 %N196 %N197 %N198 %N199 %N200 %N201 %N202 %N203 %N204 %N205 %N206 %N207 %N208 %N209 %N210 %N211 %N212 %N213 %N214 %N215 %N216 %N217 %N218 %N219 %N220 %N221 %N222 %N223 %N224 %N225 %N226 %N227 %N228 %N229 %N230 %N231 %N232 %N233 %N234 %N235 %N236 %N237 %N238 %N239 %N240 %N241 %N242 %N243 %N244 %N245 %N246 %N247 %N248 %N249 %N250 %N251 %N252 %N253 %N254 %N255 %N256 %N257 %N258 %N259 %N260 %N261 %N262 %N263 %N264 %N265 %N266 %N267 %N268 %N269 %N270 %N271 %N272 %N273 %N274 %N275 %N276 %N277 %N278 %N279 %N280 %N281 %N282 %N283 %N284 %N285 %N286 %N287 %N288 %N289 %N290 %N291 %N292 %N293 %N294 %N295 %N296 %N297 %N298 %N299 %N300 %N301 %N302 %N303 %N304 %N305 %N306 %N307 %N308 %N309 %N310 %N311 %N312 %N313 %N314 %N315 %N316 %N317 %N318 %N319 %N320 %N321 %N322 %N323 %N324 %N325 %N326 %N327 %N328 %N329 %N330 %N331 %N332 %N333 %N334 %N335 %N336 %N337 %N338 %N339 %N340 %N341 %N342 %N343 %N344 %N345 %N346 %N347 %N348 %N349 %N350 %N351 %N352 %N353 %N354 %N355 %N356 %N357 %N358 %N359 %N360 %N361 %N362 %N363 %N364 %N365 %N366 %N367 %N368 %N369 %N370 %N371 %N372 %N373 %N374 %N375 %N376 %N377 %N378 %N379 %N380 %N381 %N382 %N383 %N384 %N385 %N386 %N387 %N388 %N389 %N390 %N391 %N392 %N393 %N394 %N395 %N396 %N397 %N398 %N399 %N400 %N401 %N402 %N403 %N404 %N405 %N406 %N407 %N408 %N409 %N410 %N411 %N412 %N413 %N414 %N415 %N416 %N417 %N418 %N419 %N420 %N421 %N422 %N423 %N424 %N425 %N426 %N427 %N428 %N429 %N430 %N431 %N432 %N433 %N434 %N435 %N436 %N437 %N438 %N439 %N440 %N441 %N442 %N443 %N444 %N445 %N446 %N447 %N448 %N449 %N450 %N451 %N452 %N453 %N454 %N455 %N456 %N457 %N458 %N459 %N460 %N461 %N462 %N463 %N464 %N465 %N466 %N467 %N468 %N469 %N470 %N471 %N472 %N473 %N474 %N475 %N476 %N477 %N478 %N479 %N480 %N481 %N482 %N483 %N484 %N485 %N486 %N487 %N488 %N489 %N490 %N491 %N492 %N493 %N494 %N495 %N496 %N497 %N498 %N499 %N500 %N501 %N502 %N503 %N504 %N505 %N506 %N507 %N508 %N509 %N510 %N511 %N512 %N513 %N514 %N515 %N516 %N517 %N518 %N519 %N520 %N521 %N522 %N523 %N524 %N525 %N526 %N527 %N528 %N529 %N530 %N531 %N532 %N533 %N534 %N535 %N536 %N537 %N538 %N539 %N540 %N541 %N542 %N543 %N544 %N545 %N546 %N547 %N548 %N549 %N550 %N551 %N552 %N553 %N554 %N555 %N556 %N557 %N558 %N559 %N560 %N561 %N562 %N563 %N564 %N565 %N566 %N567 %N568 %N569 %N570 %N571 %N572 %N573 %N574 %N575 %N576 %N577 %N578 %N579 %N580 %N581 %N582 %N583 %N584 %N585 %N586 %N587 %N588 %N589 %N590 %N591 %N592 %N593 %N594 %N595 %N596 %N597 %N598 %N599 %N600 %N601 %N602 %N603 %N604 %N605 %N606 %N607 %N608 %N609 %N610 %N611 %N612 %N613 %N614 %N615 %N616 %N617 %N618 %N619 %N620 %N621 %N622 %N623 %N624 %N625 %N626 %N627 %N628 %N629 %N630 %N631 %N632 %N633 %N634 %N635 %N636 %N637 %N638 %N639 %N640 %N641 %N642 %N643 %N644 %N645 %N646 %N647 %N648 %N649 %N650 %N651 %N652 %N653 %N654 %N655 %N656 %N657 %N658 %N659 %N660 %N661 %N662 %N663 %N664 %N665 %N666 %N667 %N668 %N669 %N670 %N671 %N672 %N673 %N674 %N675 %N676 %N677 %N678 %N679 %N680 %N681 %N682 %N683 %N684 %N685 %N686 %N687 %N688 %N689 %N690 %N691 %N692 %N693 %N694 %N695 %N696 %N697 %N698 %N699 %N700 %N701 %N702 %N703 %N704 %N705 %N706 %N707 %N708 %N709 %N710 %N711 %N712 %N713 %N714 %N715 %N716 %N717 %N718 %N719 %N720 %N721 %N722 %N723 %N724 %N725 %N726 %N727 %N728 %N729 %N730 %N731 %N732 %N733 %N734 %N735 %N736 %N737 %N738 %N739 %N740 %N741 %N742 %N743 %N744 %N745 %N746 %N747 %N748 %N749 %N750 %N751 %N752 %N753 %N754 %N755 %N756 %N757 %N758 %N759 %N760 %N761 %N762 %N763 %N764 %N765 %N766 %N767 %N768 %N769 %N770 %N771 %N772 %N773 %N774 %N775 %N776 %N777 %N778 %N779 %N780 %N781 %N782 %N783 %N784 %N785 %N786 %N787 %N788 %N789 %N790 %N791 %N792 %N793 %N794 %N795 %N796 %N797 %N798 %N799 %N800 %N801 %N802 %N803 %N804 %N805 %N806 %N807 %N808 %N809 %N810 %N811 %N812 %N813 %N814 %N815 %N816 %N817 %N818 %N819 %N820 %N821 %N822 %N823 %N824 %N825 %N826 %N827 %N828 %N829 %N830 %N831 %N832 %N833 %N834 %N835 %N836 %N837 %N838 %N839 %N840 %N841 %N842 %N843 %N844 %N845 %N846 %N847 %N848 %N849 %N850 %N851 %N852 %N853 %N854 %N855 %N856 %N857 %N858 %N859 %N860 %N861 %N862 %N863 %N864 %N865 %N866 %N867 %N868 %N869 %N870 %N871 %N872 %N873 %N874 %N875 %N876 %N877 %N878 %N879 %N880 %N881 %N882 %N883 %N884 %N885 %N886 %N887 %N888 %N889 %N890 %N891 %N892 %N893 %N894 %N895 %N896 %N897 %N898 %N899 %N900 %N901 %N902 %N903 %N904 %N905 %N906 %N907 %N908 %N909 %N910 %N911 %N912 %N913 %N914 %N915 %N916 %N917 %N918 %N919 %N920 %N921 %N922 %N923 %N924 %N925 %N926 %N927 %N928 %N929 %N930 %N931 %N932 %N933 %N934 %N935 %N936 %N937 %N938 %N939 %N940 %N941 %N942 %N943 %N944 %N945 %N946 %N947 %N948 %N949 %N950 %N951 %N952 %N953 %N954 %N955 %N956 %N957 %N958 %N959 %N960 %N961 %N962 %N963 %N964 %N965 %N966 %N967 %N968 %N969 %N970 %N971 %N972 %N973 %N974 %N975 %N976 %N977 %N978 %N979 %N980 %N981 %N982 %N983 %N984 %N985 %N986 %N987 %N988 %N989 %N990 %N991 %N992 %N993 %N994 %N995 %N996 %N997 %N998 %N999