Recently, I helped my friends recover a few hard drives that were mistaken for Ghost. I took the time to write and write the process today, hoping to give some reference to friends who have encountered such problems. There are two kinds of wrong Ghost situations that are usually encountered. One is to misuse the XP installation disk with Ghost function. This installation disk will rebuild the partition table, divide your hard disk into four zones, and then put the XP system Ghost to C drive; the second is to use Ghost backup to restore the system, this should restore the backup to the C partition, but accidentally restored to the entire hard disk. The essence of these two operations is the same, they have rewritten the partition table of the hard disk, and covered some data to the hard disk. From the perspective of data recovery, the C partition is covered with data. Since there is no deep recovery technology in China, the data that is basically covered cannot be recovered, but the data after the C partition can be completely recovered.
As an example to illustrate, a hard disk originally has three partitions, respectively, C, D, E, D and E disk have important data. Originally intended to use Ghost to install an XP system on the C drive, but accidentally, restore the Ghost backup to the entire hard drive, this sub-hard disk has only one C partition. As shown in the figure below, this hard disk has a total of 16G, the original C disk 8G, D and E are each 4G, and now there is only one C disk, the size is 16G. //This switched www.45it.com computer hardware and software applications network
can be seen from the chart, Ghost made two things, first, covering the C drive Part of the space, the second is to rewrite the partition table. In addition to being covered by Ghost, the rest of the data is unscathed. As long as we can rebuild the partition table, the data of the original D and E disks can be seen again. To rebuild the partition table, the key is to know the location of the first extended partition, find this location, and all the problems are solved. Usually I solve this problem, generally using Winhex or Diskgen, now both methods are written for your reference.
A Winhex
Winhex is a five-star sector editing tool, although it is only 2M in size, but its function is powerful, what analyzes the partition table, analyzes DBR, calculates offset, and cluster chain tracking is not a problem. It is a reserved weapon for data recovery engineers. We first invited it to play, but using Winhex requires a certain understanding of the data storage principle (I will not introduce the principle in detail today), or else the Winhex interface will crash.
We hang the hard disk to be restored to another computer, as shown in the following figure, disk 1 is the target hard disk, now it has only one partition, we have to restore its partition.
Start Winhex, select "Disk Editor" in the tool menu, as shown below, select to open the second physical hard disk HD1 (wmware experimental environment).
Winhex opened physical hard disk, as shown below is the content of sector 0, sector 0 is divided into three parts in FIG., The boot program, the partition table and the end of the flag 55AA. The green part of the figure is the partition table. Since there is only one partition in the hard disk, there is only one item in the partition table.
Okay, now we have to rebuild the correct partition table, there must be two in the partition table, one is the description of the primary partition C, the other is the extension Description of the partition. The key now is to find the starting point of the extended partition. Since the C partition of the original hard disk is about 8000M, the size of each cylinder is 255 × 63 × 512 = 8225280 bytes = 7.8M, so the starting point of the original extended partition is about 8000 ÷ 7.8 = 1025, which means that the starting point of the extended partition is near the 1025 cylinder. Taking into account the error factor, we relaxed the range and let Winhex search for the starting sector of the extended partition starting from the 950 cylinder. The starting sector of the extended partition has an extended partition table, and the sector ends with 55AA. We can specify the search condition according to this feature. The specific idea is 512 bytes per sector, numbered from 0 to 511. Let Winhex search Which sector's 510 and 511 bytes are 55 and AA, this sector is likely to be the extended partition start sector we are looking for. Of course, it is also possible that an irrelevant sector is also ending with 55AA, so further screening is required. In general, the starting sector of the extended partition is always located in the 0 head 1 sector of a cylinder, and we must use these conditions.
Well, first locate the 950 cylinder 0 head 1 sector, we are ready to start searching from here, select "go to sector" in the Winhex "Location" menu, as shown below, fill in the parameters is 950/0/1. Again, the 950 cylinder is just an empirical estimate.
In the Winhex "Search" menu, select "Find hexadecimal values" as shown below.
As shown in the figure below, we entered the search parameters. The searched hexadecimal value is 55AA, and the search direction is downward. This tells Winhex to search backwards from the 950 column. The condition is set to start from offset 510 because 1 sector has 512 bytes, numbered from 0 bytes to 511, 55 at position 510, and AA at position 511.
The search started, and a sector that meets the conditions was found in a while. Is it the extended sector starting area that we want to take? We choose to display the "Details Panel" in the "View" menu of Winhex, so that the LBA and CHS parameters of the sector can be displayed. As shown in the figure below, this sector is located in the sector of the 1019 cylinder 254 head. Obviously the end sector of an NTFS partition, most likely the last sector of the original C drive. This sector is not what we need, keep searching!
sector to find down our goals as it is, and as shown, this has a partition table sector, and the location at cylinder 0 head 1 1020 The sector is almost the same as our estimated 1025 cylinder. Based on experience, this is basically the goal we are looking for.
Well, assuming that 1020 cylinder head 0 sector 1, we find that the extended partition starting point, then we can determine the original C partition is from 0 cylinder head 1 1 The sector begins, ending at 1019 cylinder 254 head 63 sectors. Where is the extended partition ending? The second item in the partition table knows the answer. The second item in the partition table describes the start and end points of the second extended partition. The end of the second extended partition is the end of the extended partition we are looking for. From the partition table, the starting point of the second extended partition is 7D 04 7E sectors from the current sector, and the size is 88 C8 AE sectors. After calculation, the end point of the extended partition is 2087 cylinder 254 head 63 sectors. Speaking of this, I have to say sorry to some friends. These calculations involve the principle of partitioning. If I have not touched it before, it is not easy to understand. Now if you understand the problem, you can refer to the second method.
After calculation, we calculated the C partition from 0/1/1-1019/254/63 and the extended partition from 1020/0/1-2087/254/63. With these parameters, we write two partition tables in the partition table of the 0 sector of the hard disk, respectively describing the C partition and the extended partition. As shown in the figure below, the parameters of the two partition tables are 80 01 01 00 07 FE FF FF 3F 00 00 00 BD 08 FA 00 and 00 00 C1 FF 0F FE FF FF FC 08 FA 00 2C CD 05 01. After modifying the partition table, save the settings and restart the computer.