重建GPT分区的研究与实现
|
摘要
GPT分区是目前硬盘普遍使用的一种分区形式,克服了MBR对分区管理不能超过2 TB的缺点。但是由于用户误操作、计算机病毒破坏、突然掉电等因素的影响,使得GPT分区被破坏的情况时有发生,从而导致存储在硬盘中的数据丢失。针对这一情况,以Windows 7为平台,Win Hex 15.08为分析工具,虚拟硬盘为实验对象,对虚拟硬盘GPT分区结构进行分析,通过DBR的特征值查找并获得DBR及DBR备份所在扇区,将DBR中存储的总扇区数转换为逻辑盘的总容量,以此为依据重建硬盘GPT分区,最后通过DBR备份所在扇区恢复DBR。实验结果表明,当GPT分区被破坏后,只要获得逻辑盘总扇区数,便可成功恢复GPT分区,从而完整恢复各逻辑盘中的全部数据。
GPT Partition is a common partition form of hard disk at present,which overcomes the disadvantage that MBR cannot exceed2 TB in partition management.However,due to user's misoperation,computer virus damage,sudden power loss and other factors,the destruction of GPT partition occurs from time to time,resulting in the loss of data stored in the hard disk.In response to this situation,based on Windows 7 platform,WinHex 15.08 as the analytical tool and the virtual hard disk as experiment object,we analyze the GPT partition structure.The DBR and its backup in the sector are searched and acquired by the eigenvalues of DBR.The total number of sectors stored in DBR is transformed into the total capacity of the logical disk,based on which the hard disk GPT partition is rebuilt.Finally the DBR is restored by its backup in the sector.The experiment shows that when the GPT partition is damaged,as long as the total number of sectors of the logical disk is obtained,the GPT partition can be restored successfully,so as to completely restore all the data of each logical disk.
GPT Partition is a common partition form of hard disk at present,which overcomes the disadvantage that MBR cannot exceed2 TB in partition management.However,due to user's misoperation,computer virus damage,sudden power loss and other factors,the destruction of GPT partition occurs from time to time,resulting in the loss of data stored in the hard disk.In response to this situation,based on Windows 7 platform,WinHex 15.08 as the analytical tool and the virtual hard disk as experiment object,we analyze the GPT partition structure.The DBR and its backup in the sector are searched and acquired by the eigenvalues of DBR.The total number of sectors stored in DBR is transformed into the total capacity of the logical disk,based on which the hard disk GPT partition is rebuilt.Finally the DBR is restored by its backup in the sector.The experiment shows that when the GPT partition is damaged,as long as the total number of sectors of the logical disk is obtained,the GPT partition can be restored successfully,so as to completely restore all the data of each logical disk.
引文
[1]刘伟.数据恢复技术深度揭秘[M].北京:电子工业出版社,2010:179.
[2]杨倩.数据恢复备份实训教程[M].北京:电子工业出版社,2016:92.
[3]马林.数据重现─文件系统原理精解与数据恢复最佳实践[M].北京:清华大学出版社,2009:84.
[4]汪中夏,张京生,刘伟.RAID数据恢复技术揭秘[M].北京:清华大学出版社,2010:150.
[5]陈培德,吴建平,王丽清.重建NTFS的DBR及分区表的研究与实现[J].实验科学与技术,2016,14(6):56-59.
[6]RUSSINOVICH M E,SOLOMON D A,LONESCU A.Windows internals[M].Beijing:Post&Telecom Press,2009:938.
[7]CARRIER B.File system forensic analysis[M].[s.l.]:Addison Wesley Professional,2005.
[8]陈培德,吴建平,王丽清.NTFS文件系统实例详解[M].北京:国防工业出版社,2015:10.
[9]SOLOMAN D A.Inside Windows NT[M].2nd ed.Washington,U.S.A:Microsoft Corporation,1998:330.
[10]戴士剑,涂彦晖.数据恢复技术[M].北京:电子工业出版社,2005:226.
[11]IVENS K,GARDINILE R K.Windows 200:the complete reference[M].Beijing:China Machine Press,2000:532.
[12]陈培德,吴建平,王丽清.Ghost后数据恢复的研究与实现[J].计算机技术与发展,2017,27(1):112-116.
[13]陈培德,吴建平,王丽清.重建分区表与FAT32_DBR研究与实现[J].计算机技术与发展,2016,26(10):188-191.
[14]刘乃琦,郭建东,张可.系统与数据恢复技术[M].北京:电子科技大学出版社,2008:46.
[2]杨倩.数据恢复备份实训教程[M].北京:电子工业出版社,2016:92.
[3]马林.数据重现─文件系统原理精解与数据恢复最佳实践[M].北京:清华大学出版社,2009:84.
[4]汪中夏,张京生,刘伟.RAID数据恢复技术揭秘[M].北京:清华大学出版社,2010:150.
[5]陈培德,吴建平,王丽清.重建NTFS的DBR及分区表的研究与实现[J].实验科学与技术,2016,14(6):56-59.
[6]RUSSINOVICH M E,SOLOMON D A,LONESCU A.Windows internals[M].Beijing:Post&Telecom Press,2009:938.
[7]CARRIER B.File system forensic analysis[M].[s.l.]:Addison Wesley Professional,2005.
[8]陈培德,吴建平,王丽清.NTFS文件系统实例详解[M].北京:国防工业出版社,2015:10.
[9]SOLOMAN D A.Inside Windows NT[M].2nd ed.Washington,U.S.A:Microsoft Corporation,1998:330.
[10]戴士剑,涂彦晖.数据恢复技术[M].北京:电子工业出版社,2005:226.
[11]IVENS K,GARDINILE R K.Windows 200:the complete reference[M].Beijing:China Machine Press,2000:532.
[12]陈培德,吴建平,王丽清.Ghost后数据恢复的研究与实现[J].计算机技术与发展,2017,27(1):112-116.
[13]陈培德,吴建平,王丽清.重建分区表与FAT32_DBR研究与实现[J].计算机技术与发展,2016,26(10):188-191.
[14]刘乃琦,郭建东,张可.系统与数据恢复技术[M].北京:电子科技大学出版社,2008:46.