GPT分区是目前硬盘普遍使用的一种分区形式, 克服了MBR对分区管理不能超过2 TB的缺点.但是由于用户误操作、计算机病毒破坏、突然掉电等因素的影响, 使得GPT分区被破坏的情况时有发生, 从而导致存储在硬盘中的数据丢失.针对这一情况, 以Windows 7为平台, Win Hex 15.08为分析工具, 虚拟硬盘为实验对象, 对虚拟硬盘GPT分区结构进行分析, 通过DBR的特征值查找并获得DBR及DBR备份所在扇区, 将DBR中存储的总扇区数转换为逻辑盘的总容量, 以此为依据重建硬盘GPT分区, 最后通过DBR备份所在扇区恢复DBR.实验结果表明, 当GPT分区被破坏后, 只要获得逻辑盘总扇区数, 便可成功恢复GPT分区, 从而完整恢复各逻辑盘中的全部数据.%GPT Partition is a common partition form of hard disk at present, which overcomes the disadvantage that MBR cannot exceed2 TB in partition management.However, due to user's misoperation, computer virus damage, sudden power loss and other factors, the destruction of GPT partition occurs from time to time, resulting in the loss of data stored in the hard disk.In response to this situation, based on Windows 7 platform, WinHex 15.08 as the analytical tool and the virtual hard disk as experiment object, we analyze the GPT partition structure.The DBR and its backup in the sector are searched and acquired by the eigenvalues of DBR.The total number of sectors stored in DBR is transformed into the total capacity of the logical disk, based on which the hard disk GPT partition is rebuilt.Finally the DBR is restored by its backup in the sector.The experiment shows that when the GPT partition is damaged, as long as the total number of sectors of the logical disk is obtained, the GPT partition can be restored successfully, so as to completely restore all the data of each logical disk.
展开▼
