Ghost后数据恢复的研究与实现  

Research and Implementation for Data Recovery after Ghost

作　　者：陈培德[1] 吴建平[1] 王丽清[1] 

机构地区：[1]云南大学信息学院云南省高校数字媒体技术重点实验室,云南昆明650223

出　　处：《计算机技术与发展》2017年第1期112-116,共5页Computer Technology and Development

基　　金：云南省科技创新强省计划项目(2014AB021);云南省高校数字媒体重点实验室开放基金项目(2015KFKT002)

摘　　要：Windows用户在使用Ghost工具软件安装操作系统时,有时会将"选择镜像文件到分区"误操作为"选择镜像文件到磁盘";操作完成后,整个硬盘成为一个大C盘,造成各逻辑盘丢失。针对这一情况,以Ghost8.0为实验软件,Windows 7为平台,Win Hex 15.08为分析工具,对Ghost后硬盘中MBR分区结构进行分析,提出了两种恢复Ghost后硬盘分区的基本思路与方法。第一种是通过各逻辑盘的DBR所在扇区号和总扇区数,在硬盘0号扇区重建各逻辑盘的MBR分区表来恢复各逻辑盘;另一种是通过重建硬盘0号扇区扩展分区表来恢复各逻辑盘。实验结果表明:误Ghost后除第1个逻辑盘中前面的部分数据被覆盖后无法恢复外,只要恢复各逻辑盘的MBR分区表,后续逻辑盘中的数据均可完整恢复。通过实践表明,这两种恢复方法不仅实用而且方便、快捷。When the Windows users install the operating system with the Ghost tool software to their computers, they should make wrong operation of ＂to disk from image＂ instead of ＂to partition from image＂. After having finished it,the whole hard disk partition changes in- to a big Drive C,leading to the result that the primary partition in hard disk and the logical disk have lost. To aim the case, Ghost 8.0 is used as the experimental software, and the Windows 7 as the platform, and WinHex 15.08 as the analysis tool to analyze the primary par- tition structure in the hard disk after Ghost. The two thought and methods are put forward for recovering the partition in the disk. The first one is to rebuild the MBR partition table in the 0 sector for very logic disk by the DBR＇ s sector number and total sectors for very logic disk in DBR, to recover all data in every logic disk. The second is to rebuild the extension partition table in the 0 sector for recovery of all data in every logic disk. The results of experiments indicate that the part of data in the front of disk could not be recovered, and the other d^tta in the behind disk would be recovered integrally with, if the partition table would be recovered. The practice demonstrates that the two methods are not only useful,but also quick and easy.

关 键 词：GHOST 镜像文件 分区表 数据恢复 

分 类 号：TP311.12[自动化与计算机技术—计算机软件与理论]