重建GPT分区与NTFS_DBR的研究

GPT分区是目前硬盘普遍使用的一种分区形式,克服了MBR对分区管理不能超过2 TB的缺点;而NTFS文件系统是Windows操作系统的重要组成部分。文中以Windows 7为平台,虚拟硬盘为实验对象,WinHex 15.08作为数据分析与恢复工具,对GPT硬盘结构和NTFS文件系统结构进行分析;对硬盘GPT分区、NTFS_DBR和NTFS_DBR备份同时被破坏后进行修复实验。实验结果表明,当GPT分区、NTFS_DBR和NTFS_DBR备份同时被破坏后,通过元文件$MFT的0号记录、1号记录和8号记录中的80H属性相关数据,计算NTFS卷的总容量与NTFS_DBR中BPB的参数。提出了通过NTFS卷的总容量重建GPT分区的基本思路、方法与步骤,并获得各GPT分区开始扇区号(即各NTFS_DBR所在扇区)在整个GPT磁盘中的位置,以及恢复NTFS_DBR和NTFS_DBR备份的思路、方法与步骤。解决了GPT分区和NTFS_DBR同时被破坏后难以恢复的技术难题。

Research on Rebuilding GPT Partition and NTFS_DBR

GPT partition is a common partition form of hard disk,which overcomes the disadvantage that MBR cannot exceed 2 TB for partition management.NTFS file system is the main part of the Windows operating system.With Windows 7 as the platform and virtual hard disk as the experimental object,WinHex 15.08 as the data analysis and recovery tool,the structure of GPT hard disk and NTFS file system is analyzed.Hard disk GPT partition,NTFS_DBR and NTFS_DBR backup are destroyed at the same time to perform repair experiments.Experiment shows that when the GPT partitions,NTFS_DBR and NTFS_DBR backups are destroyed at the same time,through the 80H attribute relate data in metafile$MFT record 0,record 1 and record 6,the total capacity of NTFS volume and BPB parameters in NTFS_DBR are calculated.The basic idea,method and procedure of rebuilding GPT partition by the total capacity of NTFS volume are presented,and the position of each GPT partition starting area(that is each NTFS_DBR sector)in the entire GPT disk,and the ideas,methods,and steps for restoring NTFS_DBR and NTFS_DBR backups are obtained.The technical problem that the GPT partition and NTFS_DBR are difficult to recover after being destroyed at the same time can be solved.