GPT磁盘克隆成MBR磁盘后数据恢复的研究  

Research on Data Recovery after GPT Disk Cloned into MBR Disk

作　　者：陈培德[1] 吴建平[1] 王一景 邓剑 朱辰龙 CHEN Pei-de;WU Jian-ping;WANG Yi-jing;DENG Jian;ZHU Chen-long(School of Information Science and Engineering,Yunnan University,Kunming 650223,China)

机构地区：[1]云南大学信息学院,云南昆明650223

出　　处：《计算机技术与发展》2020年第5期94-98,共5页Computer Technology and Development

基　　金：国家自然科学基金面上项目(41571010);云南大学项目(C176240501007)。

摘　　要：用户在使用Ghost工具软件安装操作系统或者克隆磁盘时,有时会将"选择镜像文件到分区"误操作为"选择镜像文件到磁盘";克隆结束后,导致整个GPT磁盘成为一个大C盘,GPT磁盘中各逻辑盘丢失的现象。针对这种情况,以Windows7为平台,Ghost8.0为实验软件,WinHex15.08为数据分析与恢复软件,在虚拟GPT磁盘中建立5个卷,5个卷的文件系统都是NTFS。再制作一个镜像文件,在镜像文件中建立一个MBR分区,对应文件系统也是NTFS。将镜像文件克隆到GPT磁盘中,造成GPT磁盘中原来5个卷对应分区丢失。对克隆后的GPT磁盘结构进行分析,提出了恢复GPT磁盘各卷的基本思路、方法与步骤,即恢复克隆前的GPT头和GPT头备份。实验结果表明:除第1个分区中的部分数据被覆盖无法恢复外,GPT磁盘中剩余4个卷的数据均可完整恢复。When users install operating systems or clone disks using Ghost tool software,sometimes "Select Mirror File to Partition" is misrepresented as "Select Mirror File to Disk",leading to the entire GPT disk to become a large C disk and loss of logic disks on GPT disks after the cloning. In this case,with Windows 7 as the platform,Ghost 8.0 as the experimental software,WinHex15.08 as the data analysis and recovery software,5 volumes are created on virtual GPT disks. Five volumes of the file system are NTFS. Make another mirror file where a MBR partition is established. The corresponding file system is also NTFS. Clone a mirror file into a GPT disk,which causes loss of the original 5 volumes corresponding partition in GPT disk. Analysis of the cloned GPT disk structure,the basic ideas,methods and steps of restoring the volumes of GPT disk are presented,that is,restoring the GPT head and GPT head backup before cloning. The experiment shows that unless part of the data in the first partition is overwritten and cannot be restored,the data of the remaining 4 volumes in the GPT disk can be fully restored.

关 键 词：GPT分区 MBR分区 NTFS文件系统 NTFS_DBR中BPB参数 元文件$MFT 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]