On Thu, 27 Jan 2011, Gordon Ferris wrote:
2. What utilities will show which sectors are occupied by specific files? Ideally I could specify a range of sectors and a list of files using those sectors would be provided. It would also be nice to specify files and be shown which sectors they occupy. I've heard of the Coroner's Toolkit; are there any other recommendations?
Try looking at sleuthkit. Handy set of tools. Hopefully it could be used in your case too.
Sleuthkit seems to have some limitations on OpenBSD. I needed to use it recently, but it did not recognise the FFS filesystem size when run on OpenBSD. I had to compile and run it on some linux live CD and it worked well (on OpenBSD FFS) from there. I was able to get a listing of blocks occupied by individual files.
Regards, David
