NTFS recovery after ddrescue

[aivar]

Hi, I have a failing 1,5TB HDD with one NTFS partition on it and trying to recover as much data from it as possible. Currently running ddrescue (almost two weeks by now and nearly finished) to copy whole partition to 2TB drive but there are a lot of random errors stated in ddrescue log file (few thousand).

I'm concerned about the rescued files health as how can i be sure that a file is correct and does not contain some blocks witch ddrescue was not able to recover. It sure can be checked manually by looking up file positions as stated in MFT and comparing those address ranges to ddrescue log file unrecovered addresses - but is there some software to do it automatically?
Thanks.

[harddrivespecialist]

Let your program finish what it is doing right now, if its almost finished and then analyze your files.

[aivar]

What program is recommended for file analyzing?

[dobrevjetser]

Before you started cloning you should have written in your target drive a signature on every sector, like "unreadabledata".
Then you recover your files and search for files that contain that signature.
Those are the bad files.
Now it is much more difficult.
If your targetdrive was a new one, you could try looking for files that contain sectors completely filled with 00 hex.

Dobre

[Brainbug]

I never thought of doing it your way with creating an initial disk image filled with "bad" data

I am not familiar with NTFS, but for linux ext2/ext3 debugfs will look in the inode table for the filename if you give it the corresponding sector (ddrescue log address / 4096, if using standard sector size)

[aivar]

Thx for an idea, luckily my drive is indeed new.
grep -r -P [\x00\x00\x00\x00]{128} *.*
seems to work for listing bad files, only big files are problematic as it looks like grep loads whole file to memory and memory out error appears.