What and where, where are NTFS CRC windows complaining?

I am trying to find an answer to my question related to file recovery when Windows APIs complain about CRC error. I know this is due to a bad block.

But my theory is this:

  • If I disable SMART and therefore ECC, I have to read "raw data" without applying ECC, thus having a "undefined data" block in the file stream (instead of an empty block with ECC applied).
  • This data does not have to match the NTFS CRC, whereas other file data must match it.
  • I should be able to forcibly drag and drop the entire "correct data" file by flipping bits one by one of the "undefined data" blocks (I suspect the corruption affects a bit or two in the bad block, not the whole block, hence it ends up in recovery threshold in 32-bit checksum and brute force).

Now the problem is I have no idea what this CRC is, or where it is. I have walked a lot but I cannot find about it. I suppose this is an NTFS feature, and as far as I know, NTFS does not have complete official documentation, and I really don't like the idea of ​​looking for this in the NTFS-3G C ++ source code.

So: I want to make a small utility or script to recover files in this scenario. An answer that will tell me where to get this CRC and what algorithm it uses will be accepted.

Also: I suspect the CRC is for allocation blocks, not whole files. Maybe it's in the MFT?


source to share

1 answer

The CRC errors you see are not coming from NTFS. They come from the device driver.



All Articles