search

Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

Is there a way to manually set sector size? I think recuperabit is assuming my 4096 sector size disk has 512 sector size. #99

Open left1000 opened 2 years ago

left1000 commented 2 years ago

Is there a way to manually set sector size? I've got an image of a harddrive where the sector size is 4096 (because on modern harddrives that is what it is) but a lot of linux cli functions default to 512 sector size (and usually include an option flag to select an alternate sector size.)

Maybe I'm just wrong about how many sectors I have, but Recuperabit did find file/index records once every 8 sectors, which would fit with my theory. This also means recuperabit is going 8 times slower than it needs to on most modern harddrives?

Lazza commented 2 years ago

Currently there is no option for this, but it's a useful request.

left1000 commented 2 years ago

I mean I might be wrong, if I'm wrong the feature is useless (recuperabit is already choosing the right sector size) but if I am right? reuperabit is almost always choosing the wrong sector size (at least on modern hdds). Of course the code for this idea is way over my head :)

Lazza commented 2 years ago

To clarify, currently RecuperaBit is not "chosing" any size, it is set as a constant equal to 512. 😅

AlexDaniel commented 2 years ago

Hm. I found this ticket and started wondering if it affects me. For the record, sector size can be easily seen by running fdisk. In my case, the output is:

Sector size (logical/physical): 512 bytes / 4096 bytes

I guess logical sector size is what we're looking for, right? And if that number was different, then simply editing constants.py should be enough, correct?

Lazza commented 2 years ago

What we are concerned with is the sector size used by the file system, not by the physical disk. If the logical size is 512, you should be OK.