Search for hexadecimal 00 \x00 regular expression

[Garlin007]

My disk drive had many bad sectors so I was trying to find all the files on my drive that were damaged. When you run CHKDSK, it replaces unreadable sectors with 512 hexadecimal zeros, or nulls. I tried all of the following searces for regular expressoins, to no avail:

\x00{512}
(\x00){512}
\x0000(512}
(\x0000){512}
[\x00-\x00]{512}

In addition to not finding the desired files, the following regular expression causes TotalCmd to close without an error message

(\x00){512,}

This expression finds the desired nulls while the file is being viewed in the viewer

[\x00-\x01]{512}

but does not find the files using file search.

I read in another post that since TotalCmd is text based, which is why it can't find \x00, so this appears to be a limitation of the program. My suggestion is that if it can't be fixed, then the fact that \x00 is not supported should be documented in the help next to the documentation for \x. It also would be nice to have an example of how repetition can be combined with one or two escape characters, such as \d{2} for 2 digits or \x20{10} for 10 spaces.

I tried to do a search with the hex option in the search box turned on, but the search string will not accept 1024 0's.

My question here is, does anyone know how I can find the damaged files, either using TotalCmd or not?

[majkinetor]

When you run CHKDSK, it replaces unreadable sectors with 512 hexadecimal zeros

Can you explain that a little bit more ?
You mean OS replaces bad, unreadable sectors in RAM on bad file access?
How can CHKDSK replace anything which resides in bad sectors ?
And you mean, not with 512 but with whatever your cluster size is.

(\x00){512,}

It terminates my TC also.

So you'r question is what tools are there that will generate list of files for which some parts are in bad sectors.

[Garlin007]

Clarification regarding CHKDSK:

When you run CHKDSK with the option to "Scan for and attempt recovery of bad sectors", when it finds a bad sector it marks it as bad on the disk and attempts to copy what it can read from the sector into an unused sector, and then splices the new sector into the file. Any bytes it can't read are replaced by x00. If the bad sector is totally unreadable (as is usually the case on my hard drive) then you end up with 512 x00's in your file. Correct, 512 in my case since my sector size is 512.

I am attempting to find all the files with at least 512 consecutive x00's in it, since most of these will be as a result of the replacement of an unreadable sector with a new one. Then I will compare these files with copies I have in other places. I can't just compare all files, since the damaged files are organized in a different directory structure than some of my backups, some have been renamed, and some are in zip files in the backup but not on the hard drive, so I would first like to find the likely files that were damaged and then try to find an older version of each of those files for comparison.

[majkinetor]

OK, I was curious, so I found this:

I created a test file with 1024K NULLS in int.
I used Funduc Sowtare Search and Replace. U have binary search option with RegExp enabled. There is even a null char in the preset list. I created large group of zeros in search field using copy/paste and program found my test file. I think SR doesn't use standard RegExp so I didn't have nerves examing out it's RegExp model.

The major problem is this: you have bunch of other files which regulary have .5K nulls in them. For instance, when P2P program reserves disk space for file which is to be downloaded, it create empty file on HD and fills it with nulls (so it will apear to be damaged once, by your criteria)

Conclusion: it must be done in the process of bad sector discovery, that is, you need some other tool <> chkdsk to log damaged files before they are restored on working parts of HD.

[Sheepdog]

2majkinetor
Oops, another humanoidal software encyclopedia?

Seems to be a powerful tool. Thanks.

sheepdog

[majkinetor]

I used them all. Just state your query...

But I am tinking about retirement. That's way I like seeing icfu continuing my footsteps.


PS: If you want powerfull tool use InfoRapid Search&Replace. It has common RegExp model, plus several viewers integrated (html, pdf...), plus is freeware, plus it doesn't use registry to store its data so it works with new OS without installation.