[1]陈培德,吴建平,王一景,等.GPT 磁盘克隆成 MBR 磁盘后数据恢复的研究[J].计算机技术与发展,2020,30(05):94-98.[doi:10. 3969 / j. issn. 1673-629X. 2020. 05. 018]
　CHEN Pei-de,WU Jian-ping,WANG Yi-jing,et al.Research on Data Recovery after GPT Disk Cloned into MBR Disk[J].COMPUTER TECHNOLOGY AND DEVELOPMENT,2020,30(05):94-98.[doi:10. 3969 / j. issn. 1673-629X. 2020. 05. 018]
点击复制

GPT 磁盘克隆成 MBR 磁盘后数据恢复的研究()
分享到：

《计算机技术与发展》[ISSN:1006-6977/CN:61-1281/TN]

卷:
30
期数:
2020年05期
页码:
94-98
栏目:
安全与防范
出版日期:
2020-05-10

文章信息/Info

Title:
Research on Data Recovery after GPT Disk Cloned into MBR Disk
文章编号:
1673-629X(2020)05-0094-05
作者:
陈培德; 吴建平; 王一景; 邓 剑; 朱辰龙
云南大学 信息学院,云南 昆明 650223
Author(s):
CHEN Pei-de; WU Jian-ping; WANG Yi-jing; DENG Jian; ZHU Chen-long
School of Information Science and Engineering,Yunnan University,Kunming 650223,China
关键词:
GPT 分区; MBR 分区; NTFS 文件系统; NTFS_DBR 中 BPB 参数; 元文件 $ MFT
Keywords:
GPT partition; MBR partition; NTFS file system; BPB parameter of NTFS_DBR;  $ MFT meta file
分类号:
TP393
DOI:
10. 3969 / j. issn. 1673-629X. 2020. 05. 018
摘要:
用户在使用 Ghost 工具软件安装操作系统或者克隆磁盘时,有时会将“选择镜像文件到分区”误操作为“选择镜像文件到磁盘”；克隆结束后,导致整个 GPT 磁盘成为一个大 C 盘,GPT 磁盘中各逻辑盘丢失的现象。 针对这种情况,以Windows7 为平台,Ghost8.0 为实验软件,WinHex15.08 为数据分析与恢复软件,在虚拟 GPT 磁盘中建立 5 个卷,5 个卷的文件系统都是 NTFS。 再制作一个镜像文件,在镜像文件中建立一个 MBR 分区,对应文件系统也是 NTFS。 将镜像文件克隆到 GPT 磁盘中,造成 GPT 磁盘中原来 5 个卷对应分区丢失。 对克隆后的 GPT 磁盘结构进行分析,提出了恢复 GPT 磁盘各卷的基本思路、方法与步骤,即恢复克隆前的 GPT 头和 GPT 头备份。 实验结果表明:除第 1 个分区中的部分数据被覆盖无法恢复外,GPT 磁盘中剩余 4 个卷的数据均可完整恢复。
Abstract:
When users install operating systems or clone disks using Ghost tool software,sometimes “Select Mirror File to Partition” is misrepresented as “Select Mirror File to Disk”,leading to the entire GPT disk to become a large C disk and loss of logic disks on GPT disks after the cloning. In this case,with Windows 7 as the platform,Ghost 8. 0 as the experimental software,WinHex15.08 as the data analysis and recovery software,5 volumes are created on virtual GPT disks. Five volumes of the file system are NTFS. Make another mirror file where a MBR partition is established. The corresponding file system is also NTFS. Clone a mirror file into a GPT disk,which causes loss of the original 5 volumes corresponding partition in GPT disk. Analysis of the cloned GPT disk structure,the basic ideas,methods and steps of restoring the volumes of GPT disk are presented, that is, restoring the GPT head and GPT head backup before cloning. The experiment shows that unless part of the data in the first partition is overwritten and cannot be restored,the data of the remaining 4 volumes in the GPT disk can be fully restored.

相似文献/References:

[1]陈培德,吴建平.恢复 GPT 分区的研究与实现[J].计算机技术与发展,2021,31(07):81.[doi:10. 3969 / j. issn. 1673-629X. 2021. 07. 014]
　CHEN Pei-de,WU Jian-ping.Research and Implementation of Recovering GPT Partition[J].COMPUTER TECHNOLOGY AND DEVELOPMENT,2021,31(05):81.[doi:10. 3969 / j. issn. 1673-629X. 2021. 07. 014]
[2]陈培德,吴建平,钱文华,等.重建GPT分区的研究与实现[J].计算机技术与发展,2019,29(02):96.[doi:10．3969/j．issn．1673－629X．2019．02．020]
　CHEN Peide,WU Jianping,QIAN Wenhua,et al.Research and Implementation of Rebuilding GPT Partition[J].COMPUTER TECHNOLOGY AND DEVELOPMENT,2019,29(05):96.[doi:10．3969/j．issn．1673－629X．2019．02．020]

更新日期/Last Update: 2020-05-10