NTFS结构及错误分析
这听起来像是一个服务器故障问题，但事实并非如此。这是关于NTFS的数据格式。就这样吧。
我的磁盘驱动器已损坏。 RAID里有闪现，不过没关系。这些磁盘上偶尔会出现各种损坏模式。由此产生的错误（我现在手头有这个错误）可以通过 chkdsk 检测到。
我需要从这些数据或其他分析中知道驱动器上的哪个扇区已损坏。
任何帮助将不胜感激。
This may sound like a serverfault question, but it isn't. It is about data formats of NTFS. Here goes.
I have a corrupt disk drive. It's flashes in RAID, but it doesn't matter. Various corruption modes occur occasionally on these disks. The resulting error, which I have at hand at the moment, is detectable by chkdsk.
I need to know, from this data or other analysis, which sector on drive was corrupted.
Any help will be appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我相信损坏的扇区可能会出现在 $BadClus $Bad 流中。
这是一个稀疏流，它的非备用范围是坏簇。
有时 chkdsk 的日志（在 eventlog 中）会显示扇区。
有一些磁盘工具可以转储坏簇表。我使用商业取证产品，但也有一些免费的。
请注意，您不知道确切的扇区，因为 NTFS 只是按簇划分，并且每个簇很可能有多个扇区。
正确确定这一点的唯一方法是运行低级扇区分析，如果您想将数据保留在 RAID 上，这是不切实际的。
I belive that the corrupt sector might appear in the $BadClus $Bad stream.
This is a sparse stream and and non-spare extents of it are bad clusters.
Sometimes the log of chkdsk ( in eventlog ) shows the sector.
The are some disk tools that would dump the bad cluster table. I use a commercial forensic product but there are several free ones.
Please not that you would not knwo the exact sector since NTFS just delas in clusters and it is very likely that you have multiple sectors per cluster.
The only way to properly detremine this is to run a low-level sector analysis, which is not practical if you want to keep the data on the RAID.