All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: Corrupted File Finder
PostPosted: November 7th, 2018, 16:42 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 190
Location: Portugal
Dear DR expert,

Ever done a recovery to find out some files were corrupted? Even though MFT displays their name and size correctly? I did.

And it was frustrating to look file by file, just to have an estimate of good vs bad files to report to client.

So I decided to create a small software that will look for a determined percentage of 0's in the file hex and append a _corrupted label to the file.

Please let me know if this is something that you would use on your daily work.

_________________
BTC Wallet - 16S1yq41ehJr9Kh8GeA2cgSYLt397XKU4Q


Top
 Profile  
 
 Post subject: Re: Corrupted File Finder
PostPosted: November 7th, 2018, 17:39 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10943
Location: Australia
Here is a command line example that recurses through the subdirectories of the Recovery folder and performs an integrity check of all ZIP files. The results are written to zip_tests.txt.

    for /r C:\Recovery_Root_Dir %f in (*.zip) do "c:\program files\7-zip\7z" t %f >> C:\zip_tests.txt

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Corrupted File Finder
PostPosted: November 7th, 2018, 21:04 
Offline

Joined: December 8th, 2010, 11:37
Posts: 579
Location: Ottawa, Canada
Hi @DRUG,

Such a program would be helpful to me, but not on a daily basis. I assume you are selling this program. if so, what is the cost, please?

I've asked DFL (whose tools I use) to write such a program or to incorporate the function into their existing DE program. What I had asked, was to append ".bad" to the filename of any recovered file that contains one or more sectors full of nothing but the fill character (Bs rather than 0s, in DFL's case).

That fill character is written by DFL's imaging/cloning program when a sector on the patient drive is unreadable. The image or clone, from which I want to extract recovered data, will not give a read error of course, because it's a healthy clone drive/image file. Therefore, there is no way to flag files that encountered read errors during the imaging/cloning process without such a program or function. Your program sounds like it would be perfect for this.

Larry

_________________
Sabo Computer Repairs & Data Recovery


Top
 Profile  
 
 Post subject: Re: Corrupted File Finder
PostPosted: November 8th, 2018, 0:32 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10943
Location: Australia
@LarrySabo, would this work for you?

    grep -r -l -U -e 'B{512,}' /recovery_root_dir > /badfiles.txt

I haven't tested it -- I just based it on my reading of the grep man page.

https://www.gnu.org/s/grep/manual/grep.html

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Corrupted File Finder
PostPosted: November 8th, 2018, 8:34 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 190
Location: Portugal
@LarrySabo @fzabkar

I'm still improving the inner features, but as most of the forensic software the importing and parsing of files takes some time.

If this is to be sold and not distributed freely (only will be sold if I have development costs it will be on a simbolic price)

This is how it works:


Attachments:
2018-11-08_12-10-20.gif
2018-11-08_12-10-20.gif [ 13.57 MiB | Viewed 169 times ]

_________________
BTC Wallet - 16S1yq41ehJr9Kh8GeA2cgSYLt397XKU4Q
Top
 Profile  
 
 Post subject: Re: Corrupted File Finder
PostPosted: November 8th, 2018, 9:23 
Offline

Joined: December 8th, 2010, 11:37
Posts: 579
Location: Ottawa, Canada
fzabkar wrote:
@LarrySabo, would this work for you?...
I'll try it and report back. Thanks!

_________________
Sabo Computer Repairs & Data Recovery


Top
 Profile  
 
 Post subject: Re: Corrupted File Finder
PostPosted: November 8th, 2018, 9:29 
Offline

Joined: December 8th, 2010, 11:37
Posts: 579
Location: Ottawa, Canada
Thanks, @DRUG. Looks good so far. I would suggest allowing the "fill character" to be a user-definable variable, e.g., "B" instead of "0", and the tag to be an added extension of ".bad" rather than "_corrupted." An option to move all "bad" files to a separate folder would also be handy.

_________________
Sabo Computer Repairs & Data Recovery


Top
 Profile  
 
 Post subject: Re: Corrupted File Finder
PostPosted: November 8th, 2018, 11:44 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 190
Location: Portugal
LarrySabo wrote:
Thanks, @DRUG. Looks good so far. I would suggest allowing the "fill character" to be a user-definable variable, e.g., "B" instead of "0", and the tag to be an added extension of ".bad" rather than "_corrupted." An option to move all "bad" files to a separate folder would also be handy.



I'm already working on the fill character and the added extension. Moving the files may be a bit risky, but I'll check it out also.

Thank you for the feedback.

_________________
BTC Wallet - 16S1yq41ehJr9Kh8GeA2cgSYLt397XKU4Q


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group