How to *quickly* get a list of files that have bad sectors/blocks/clusters/whatever?

My wife's Windows 7 (64-bit) box has suddenly developed a SMART "disk is bad" status. I'm attempting to copy everything off (no admonishments about lacking a backup regimen, please, I know already :( ) by creating a System Image across the network to a different machine, but it gets to a certain point and starts taking forever. Doing a chkdsk reveals that certain files cause this by having many bad blocks (like dozens of thousands in a row, if the event log is any indication) and causing the system to do its standard try-to-recover-and-relocate-upon-access thing.

But this is taking so long, I'm afraid the disk will fail completely before I can get the damned thing copied. However, several of the files so far have been ones that she has copies of elsewhere, so I am able to just delete them prior to retrying the backup to speed things up considerably.

So: is there some tool or procedure that will try reading each file, and upon hitting a bad block, just tell me about it and skip to the next file? So I can see which ones I can just dump and which I need to let it try to recover?

As no one ever actually answered your question, the following not-exactly-lightning-fast method may be the quickest way to get what you are looking for.

1. The utilities you will need work under Linux, so you first need to create a USB key or CD that you can use to boot into Linux (or to attach the disk to a Linux machine).

2. You then need to run ddrescue from the Gnu ddrescue package. This will create a "mapfile", which is basically a list of the bad sectors on your disk. There are many different options to ddrescue, which among other things vary in how hard it works to read/recover data from a bad sector. If you want to consider any sector which gives trouble as "bad", and don't want to really recover anything with ddrescue, you can use the "-n" option and specify /dev/null as the target, and this will be pretty fast (ddrescue will just read once through all the sectors of the disk in order, and the mapfile output will contain a list of sectors where the read failed).

3. You then need to run a utility called ddru_ntfsfindbad on the mapfile and the disk, and this will output what you want: a list of the files on the disk that have parts in one of the bad sectors.

NOTE however: 1. If a drive is failing, reading it at all is very likely to make it fail worse. So it is quite possible (some would say "close to certain") that some/many/lots of sectors that were good before you read the disk twice via the procedure are now bad. The smart thing to do would be to have a good drive and do both steps above actually recovering data. IF you do this, of course, you might want to use ddrescue's ability to try extra hard to get the data off of hard-to-read sectors.

2. ddru_ntfsfindbad's manual says that you CANNOT run it on the original bad drive UNLESS the file system is/was NTFS. So you're ok in your case, but it will almost certainly be faster if you run it on a ddrescue-recovered drive and not the original. And if the bad sectors are in certain filesystem metadata, you really will need to do this.

I realize that the original question is very old, but I had this problem recently and thought that others might want to know the answer to the original question.

When it comes to bad sectors on a disk, if there is no backup then what I do is get a backup image of it using a tool called Drive Snapshot:

  Drive Snapshot
  http://www.drivesnapshot.de/

When this tool encounters bad sectors, it keeps track of them in a separate text file (one bad sector per line, so you can simply count the number of lines in the file to determine the total number of bad sectors), which is also used as a cross-reference to find out which files used those sectors.

I had the same question and did some research: http://www.disktuna.com/finding-out-which-file-is-affected-by-a-bad-sector/.

I am assuming Windows OS and NTFS file system.

So, a bad sector can be part of:

• Unallocated space. We can ignore this.

• File system structures. Normally chkdsk should take care of this. It is possible that depending on where file system damage is that chkdsk won't run at all. In which case you'd run a surface scan on the hard disk itself.

• System Files affected: You could use the Windows System File Checker (SFC.exe). At the command prompt, type the following command, and then press ENTER: sfc /scannow.

• User data: The Microsoft support tool NFI.exe can be used to convert a LBA sector address to a file path. This way you can determine which files need to be restored from backup after sector reallocation.

  Example:

  C:\Users\admin\Downloads>nfi \Device\Harddisk0\DR0 28521816
  NTFS File Sector Information Utility.
  Copyright (C) Microsoft Corporation 1999. All rights reserved.
  
  
  ***Physical sector 28521816 (0x1b33558) is in file number 5766 on drive C.
  \IMAGES\win7HDD.vhd
  

• The easiest way is probably HD Sentinel. After running a surface scan HD Sentinel will display a list of files affected by bad sectors.

If you already have a list of bad sectors, the most convenient tool I found to determine which are the potentially affected files is Piriform's Defraggler. When clicking on a given block on the volume's map, it will display a list of the files contained in that same block (even non-fragmented files). And when clicking on a file name in the “File list” tab (which only displays fragmented files), it will highlight all the blocks containing at least one sector belonging to that file. Unfortunately there is no numerical indication of offset / sector / cluster intervals, and no way to directly type a particular offset / sector / cluster value. (I wrote the company about two years ago to request a few enhancements which would make this great feature more practically usable in that kind of situations, and had a kind reply, thanking me for my comments and suggestions; I haven't updated Defraggler in a while, perhaps some of my suggestions have been implemented since then.)

I provided some more methods here : How do I find if there are files at a specific bad sector?

– nfi.exe X: [sector number]

– fsutil volume querycluster X: [cluster number]

With both of those command line tools it should be relatively easy to write a script so as to load each line of a list of sectors as input and get a list of files as output.

– HD Sentinel, but with a major caveat: it will actually try to access each requested sector and display its contents, which may temporarily freeze the system and worsen the drive's condition.

– R-Studio (same issue as HD Sentinel)

– WinHex (same issue as HD Sentinel)