NTFS structure and error analysis

Question

This may sound like a serverfault question, but it isn't. It is about data formats of NTFS. Here goes.

I have a corrupt disk drive. It's flashes in RAID, but it doesn't matter. Various corruption modes occur occasionally on these disks. The resulting error, which I have at hand at the moment, is detectable by chkdsk.

I need to know, from this data or other analysis, which sector on drive was corrupted.

Any help will be appreciated.

Answer 1

I belive that the corrupt sector might appear in the $BadClus $Bad stream. This is a sparse stream and and non-spare extents of it are bad clusters. Sometimes the log of chkdsk ( in eventlog ) shows the sector.

The are some disk tools that would dump the bad cluster table. I use a commercial forensic product but there are several free ones. Please not that you would not knwo the exact sector since NTFS just delas in clusters and it is very likely that you have multiple sectors per cluster.

The only way to properly detremine this is to run a low-level sector analysis, which is not practical if you want to keep the data on the RAID.