重建 GPT 分区与 NTFS_DBR 的研究-《计算机技术与发展》

文章信息/Info

作者:: 陈培德¹; 2; 吴建平¹; 2; 王丽清¹; 2; 朱辰龙²; 邓剑²; 1.云南省电子计算中心,云南昆明 650223; 2.云南大学信息学院,云南昆明 650223

Author(s):: CHEN Pei-de¹; 2; WU Jian-ping¹; 2; WANG Li-qing¹; 2; ZHU Chen-long²; DENG Jian²; 1.Yunnan Provincial Electronic Computing Center,Kunming 650223,China; 2.School of Information Science and Engineering,Yunnan University,Kunming 650223,China

Keywords:: GPT partition table; NTFS file system; BPB parameters of NTFS_DBR; $MFT meta file

摘要:: GPT分区是目前硬盘普遍使用的一种分区形式,克服了MBR对分区管理不能超过2TB的缺点;而NTFS文件系统是Windows操作系统的重要组成部分。文中以 Windows7 为平台,虚拟硬盘为实验对象,WinHex15.08作为数据分析与恢复工具,对GPT硬盘结构和NTFS文件系统结构进行分析;对硬盘GPT分区、NTFS_DBR和NTFS_DBR备份同时被破坏后进行修复实验。实验结果表明,当GPT分区、NTFS_DBR和NTFS_DBR备份同时被破坏后,通过元文件$MFT的0号记录、1号记录和8号记录中的80H属性相关数据,计算NTFS卷的总容量与NTFS_DBR中BPB的参数。提出了通过NTFS 卷的总容量重建GPT分区的基本思路、方法与步骤,并获得各GPT分区开始扇区号(即各NTFS_DBR所在扇区)在整个 GPT磁盘中的位置,以及恢复NTFS_DBR和NTFS_DBR备份的思路、方法与步骤。解决了GPT分区和NTFS_DBR同时被破坏后难以恢复的技术难题。

Abstract:: GPT partition is a common partition form of hard disk,which overcomes the disadvantage that MBR cannot exceed 2 TB for partition management. NTFS file system is the main part of the Windows operating system. With Windows7as the platform and virtual hard disk as the experimental object, WinHex 15.08 as the data analysis and recovery tool,the structure of GPT hard disk and NTFS file system is analyzed. Hard disk GPT partition, NTFS_DBR and NTFS_DBR backup are destroyed at the same time to perform repair experiments. Experiment shows that when the GPT partitions, NTFS_DBR and NTFS_DBR backups are destroyed at the same time, through the 80H attribute relate data in metafile $MFT record0,record1and record 6,the total capacity of NTFS volume and BPB parameters in NTFS_DBR are calculated. The basic idea,method and procedure of rebuilding GPT partition by the total capacity of NTFS volume are presented,and the position of each GPT partition starting area(that is each NTFS_DBR sector) in the entire GPT disk,and the ideas,methods,and steps for restoring NTFS_DBR and NTFS_DBR backups are obtained. The technical problem that the GPT partition and NTFS_DBR are difficult to recover after being destroyed at the same time can be solved.