What and where, where are NTFS CRC windows complaining?
I am trying to find an answer to my question related to file recovery when Windows APIs complain about CRC error. I know this is due to a bad block.
But my theory is this:
- If I disable SMART and therefore ECC, I have to read "raw data" without applying ECC, thus having a "undefined data" block in the file stream (instead of an empty block with ECC applied).
- This data does not have to match the NTFS CRC, whereas other file data must match it.
- I should be able to forcibly drag and drop the entire "correct data" file by flipping bits one by one of the "undefined data" blocks (I suspect the corruption affects a bit or two in the bad block, not the whole block, hence it ends up in recovery threshold in 32-bit checksum and brute force).
Now the problem is I have no idea what this CRC is, or where it is. I have walked a lot but I cannot find about it. I suppose this is an NTFS feature, and as far as I know, NTFS does not have complete official documentation, and I really don't like the idea of looking for this in the NTFS-3G C ++ source code.
So: I want to make a small utility or script to recover files in this scenario. An answer that will tell me where to get this CRC and what algorithm it uses will be accepted.
Also: I suspect the CRC is for allocation blocks, not whole files. Maybe it's in the MFT?
source to share