摘要
GPT分区是目前硬盘普遍使用的一种分区形式,克服了MBR对分区管理不能超过2 TB的缺点;而NTFS文件系统是Windows操作系统的重要组成部分。文中以Windows 7为平台,虚拟硬盘为实验对象,WinHex 15.08作为数据分析与恢复工具,对GPT硬盘结构和NTFS文件系统结构进行分析;对硬盘GPT分区、NTFS_DBR和NTFS_DBR备份同时被破坏后进行修复实验。实验结果表明,当GPT分区、NTFS_DBR和NTFS_DBR备份同时被破坏后,通过元文件$MFT的0号记录、1号记录和8号记录中的80H属性相关数据,计算NTFS卷的总容量与NTFS_DBR中BPB的参数。提出了通过NTFS卷的总容量重建GPT分区的基本思路、方法与步骤,并获得各GPT分区开始扇区号(即各NTFS_DBR所在扇区)在整个GPT磁盘中的位置,以及恢复NTFS_DBR和NTFS_DBR备份的思路、方法与步骤。解决了GPT分区和NTFS_DBR同时被破坏后难以恢复的技术难题。
GPT partition is a common partition form of hard disk,which overcomes the disadvantage that MBR cannot exceed 2 TB for partition management.NTFS file system is the main part of the Windows operating system.With Windows 7 as the platform and virtual hard disk as the experimental object,WinHex 15.08 as the data analysis and recovery tool,the structure of GPT hard disk and NTFS file system is analyzed.Hard disk GPT partition,NTFS_DBR and NTFS_DBR backup are destroyed at the same time to perform repair experiments.Experiment shows that when the GPT partitions,NTFS_DBR and NTFS_DBR backups are destroyed at the same time,through the 80H attribute relate data in metafile$MFT record 0,record 1 and record 6,the total capacity of NTFS volume and BPB parameters in NTFS_DBR are calculated.The basic idea,method and procedure of rebuilding GPT partition by the total capacity of NTFS volume are presented,and the position of each GPT partition starting area(that is each NTFS_DBR sector)in the entire GPT disk,and the ideas,methods,and steps for restoring NTFS_DBR and NTFS_DBR backups are obtained.The technical problem that the GPT partition and NTFS_DBR are difficult to recover after being destroyed at the same time can be solved.
作者
陈培德
吴建平
王丽清
朱辰龙
邓剑
CHEN Pei-de;WU Jian-ping;WANG Li-qing;ZHU Chen-long;DENG Jian(Yunnan Provincial Electronic Computing Center,Kunming 650223,China;School of Information Science and Engineering,Yunnan University,Kunming 650223,China)
出处
《计算机技术与发展》
2020年第2期127-132,共6页
Computer Technology and Development
基金
国家自然科学基金面上项目(41571010)
国家自然科学基金地区项目(61462093)
