Eternal loop reconstructing MFT about recuperabit

[Lazza]

From the output you posted, it seems you have various traces of files which get divided into over 127000 (127 thousand!) partitions. This can result from an extremely fragmented MFT (that maybe has sustained defragmentation many times in the past).

See this file where they are ordered by length -> count (accumulator):

many_partitions.txt

Long story short, the program is not looping, it's just running. 😅 You might want to put a limit to ignore partitions with few files. For instance, you can ignore those with less than 5001 files.

Start with a fresh, unmodified copy of RecuperaBit and add this before line 823 of ntfs.py:

partitioned_files = {
    index: partitioned_files[index]
    for index in partitioned_files
    if len(partitioned_files[index].files) > 5000
}

This way you will only analyze about 50 partitions. I am going to close this issue, however you might consider suggesting one or both of these:

• option to disable the search of partition boundaries for those that are not immediately detectable from boot sectors
• option to prune partitions with few files, or to limit the search to the top N partitions

These could be nice enhancements in the future.

[Lazza]

Please, before line 823 of ntfs.py:

for address in partitioned_files:

Add the following lines:

print partitioned_files
print list(partitioned_files)
exit(1)

With the same indentation. This will stop the program just after the scan, printing useful debug information.

[gabrielboliveira]

This is the output with those lines: recuperabit.txt

[gabrielboliveira]

Great! Thanks for the suggestion. I'll try what you suggested.