分区恢复作业论文

《分区恢复作业论文》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、案例1恢复丢失的分区1•先将anli-l.hdd复制到c盘根目录下然后用inspor-Desk加载此镜像然后单击下一•步安装上虚拟硬盘2.打开winHex加载物理磁盘：硬盘2MBR开后即为此硬盘000000F013723681FB55AA7530F6C101742B6160000001006A006A00FF760AFF76086A0068007C6A00000110016A10B4428E)F4CD136161730E4F740B0000012032E48A5600CD13EBD661F9C3496E7661000001306C696420706172

2、746974696F6E20746100000140626C65004572726F72206C6F6164696E0000015067206F7065726174696E67207379737400000160656D004D697373696E67206F706572610000017074696E672073797374656D000000000000000180000000000000000000000000000000000000019000000000000000000000000000000000000001A000000000000000

3、000000000000000000000001B000000000002C4463568CB70400000001000001C001000BFE3F0C3F0000008E2F03000000000001D000000000000000000000000000000000000001E000000000000000000000000000000000000001F0000000000000000000000000000055AA的打1a塞ttsisj••…HDO：IC251T020ATMR04-0(18.6GB)•…占RH1：KingstonData

4、TravelerG2(1.9GB,USB)L•—i歸紧接着通过搜索”55AA“来查找原来的第二个分区开始的位置，用F3键向下翻,查找文本下列文本字串符将被搜索(S)：

5、55AAV

6、「区分犬小写追)[ascii3厂用作通配符⑪：F厂整字匹配0)搜索叭向下二]P条件：偏移计算

7、512=

8、510

9、厂仅在选块中搜索厂在所有打开的窗口中搜索0)厂列表搜索提示’一直到厂忽略读取错误a)确定©取消如

10、■然后在第112455扇区找到EBRCEBR的结构036E8F8000000000000000000000000000000000036E8F90000000000000

11、00000000000000000000036E8FA000000000000000000000000000000000036E8FB000000000000000000000000000000001036E8FC001070BFE3F0C>00少477801阿0000036E8FD00000000000"00Wpo0000036E8FE000000000000000珂aobo0000036E8FF0000000000000000055AAG盘逻辑驱动器的起始扇区OOOOOO3F转化十进制为63和MBR是一样的，所以，EBR的结束标志也一定是55AAo

12、搜索EBR起始位置，16进制查找“55M”加条件512=510,EBR倒数第五行倒数第二个字节是0001)。下图是定位到EBR中的截图：驱动器的总扇区(X)()17847转化为十进制96327然后将起始扇区+驱动器总的大小：63+96327=968303•跳转到MBR扇区，将扩展分区的信息填入分区表，具体做法是：定位到EBR上，将分区信息开始和结尾选屮(选块开始，选块结束，复制)，然后定位到MBR中，在第二分区的开头和结尾分别选中并粘贴EBR,7777747700000170747—69VV6E4—67201y731y7973vra-*74V165J76

13、DVA001V00v%-r001J007亠0000000180000000000000000000000000000000000000019000000000000000000000000000000000000001A000000000000000000000000000000000000001B000000000002C4463568CB70400000001000001C001000BFE3FOC3F00000008B701000001000001D001070BFE3FOC3F000000477801oS0000000001E0000000000

14、00000000000000000000000000001F0000000000