修復(fù)移動硬盤RAW格式winhex

1、USBC造成問題,造成分區(qū)無法訪問，其實(shí)數(shù)據(jù)并無損壞，下面是解決辦法1.打開 win hex，按 F9問題癥狀：移動硬盤，插入之后突然所有分區(qū)不能訪問，出現(xiàn)如下提示。那么很有可能是 網(wǎng)上也有人視之為病毒。原理就是USBC文件將整個分區(qū)的MFT向后移了一個sector，2.選損壞的硬盤Li Fhysical&HDO： FUJITSU NMZ216OBH G1 (149 GB)HDl： HiUehi KTS545O5D陽幻皿 C46B 囲 USB)_J HD2： SANSUHG HM150JT (149 GE, USB呂 Optical drive 0QKCancel |3.雙擊損壞的分區(qū)i Fi

2、b EdH- $f4rri-i Pprtipri UFm _M：h 5ppriiifiit 門卩rim Wivdnw Hftpp a g ars? 壯旣迪x料 日自孕 自辛wr i oh 尋3i di ik 2 I朗-MTFTe口單tPartlMi 111B1SMTF337.7 00315 KB31 BIKB31 EffCB232+72706 155KI785 TTB34923 232472645PartlKtiPfirtiiW 觀 Parlrten Qs PaitiKn qvFncmif鏗P UBR Hmy匚“伽37.1 CBHardduk? 叫初 3uNGt*iieaic Bus.U&BO

3、hEjEcM 屜* StalEcngindIWW IM*. LAidarevenes.Total cpaotf149 GB怔l沖加Brtes per sedDP. Su12B2fllBa(3E06ES16DOSBOflOD6ECO33EBCfiQ6OE00I0B-P- jAjlif a a .aZ6I2HBfl7010E3530弱QD(W陰&AozCEBAW刊0B4.*5.bi. .hj rl .5.IZBEZHBOaO08CD137305B9FFFF8AFlB6EFB6C64066-i.sJyylififUBE2W4$OOF朋D】帥U3：EF7E2酣tDCOED41筋OFIZBEZUBtla

4、07C966F7ElE fA3200003B44133558AA fiLTI124onCD1372DFSiFQ分47&0-9陽Cl01-5-1.r- .-flUfi-u .oA.1ZSEZBS0CII04FE06丄耳DDC36660IECt66Al100066t山 i f 1 f1.2BL2DE0Dfl031C00陸血2000OF823AOCIE百國3.-.f;.1 : . .FjIZSrZPBQEO0066500653B66S1000DI00BD3E0000.fP.SEli. V .12BE2IIB13FOOF65DCDOLB町IF803E14DOODDF346100.1. A； 3yli

5、. i . H .IZSK2HB1O0日44ZBA1624DD16IF3BF4CD13斫595007Bl辛 H占tDC12HE21DB11CI66566656JlFEB2D6633D2&cr37QE1600fXfX.OKIdlt space alumfcslKl:25 KB7TB13732Tsii 4 ek g Jjirii di ik 臨 ?u-Ll1j n 3Fil* EditPpfrtiQnTqqJi. paciaiit Qptipii MVindDHrC -*oatag r：?斡戈匚 丁料 色QFfgetQ1Z35 670 ?AHCQEFNTFSOOODDOOlDDEB5Z904E54

6、532020ZOZDDDD2OS000&oct MrtorODOODDD1D00000000DOIB003FDOFFDD3j0aa001Butrf bHtJEui ILnmpjdLc*Osfaifl Em 瞅啜 Stailrwiginai0000QQi0；900陽00oa斡軸仙00AC霜A3U404前0000Master File TjJble i；JjMFT)OODDDDDSDiooililf?rnooc00IQ00BA3h4 .acon j0niloo的kmc400CQCIDD4Q陽皿on010000QQ優(yōu)陌ABDC91ABQCDCSearch FRE reccrd .cywiOOOQDD

7、DFilOFocDOEB3FF購JE14DDDDDF94Elg.1. .ibyh :：-.la .Cwsrt0Etodc.6.記下Start C# $MFT 的位置，移動硬盤一般為786432&ata irttrprMff |c訶呻-21 IfiStl-M-js 21MT 33 ；*: T3130H1Z；二 Boot Sector NTFS, Base Offset： 0OffsetTitleValue40L1P instructionEB 52903File system IDNTFS1 BBytes persector512DSectors per cluster3I EReserved

8、sectorsQ10(always zero)00 00 0013(unused)00 0015Media descriptorFB16(unused)00 0018Sectors per track631AHeads2551CHidden sectors6320(unused)00 00 00 0024(always 30 00 80 00)80 00 30 0028Total sectors77818796r30Start C# &MFT78643238Start C# SMFTMirr486367440FILE record size Indies-1041(unused)0上INDX

9、buffer size indica 1二7.clt葉G,Go to sector ，把剛才復(fù)制的 MFT位置填進(jìn)去Go Ta SectorSE8發(fā)現(xiàn)原本應(yīng)該為MFT文件的位置0C0000000變?yōu)榱?USBC下面進(jìn)行替換工作d cs stffis： 唔旦ds? 出出性丫粕 -*遇中 呂I：.a Ph|if lL3l factor Mn161!1453-MDCUOQDOBU000000叩OD00000000ODDODC000000K Br . i i, ,Lejgksi 陽 d 佃 Nw.DCDDDDDCnoaoa0000DD00aoaa00DODDODOQoaaa00U J .K000DDD

10、couaaaoa帥00仙ao口口aoaoOD前oaCi.Br F ,raitirf3T1GBOCOODDOEO00000000DDDDaoina0000DDDDDGoa000019.-E43.2Z4.0e thlMOCdOaDDFO加DOnnaODQO00oaDODO00D0DO00oann1Hrtes Mr dUFteT4.映DCDDDD1DUaa0000OCIDDDD00oa0000DDDDDOaa00DOi. a.1 . 1rotii dUsiEfs-Q727.S4.UOCDDODllO00OUUODD00OD00aoLIUDODDODOD00au00-EIse w sedDB.51SD

11、CDOODJIZDi00000000QDDDao00000000DDDO000000n r i i| | |Sbdcr CMirt7T1B.7#7DCDDDD13DaaoaQDDDDDQDOQoa00DDDDODDfl00aa00-_ b. s. sPlTfiiral tfSSlL2CDDQDKDOD00no00ODDD00000000QQDDDO000000,9r a i i1 ,DCODDDianoaoa00DDDDDDdoaaODODDDDD01oaaaDDfc a i , . 8Disjfty lime znn?uTC*fla.ooXOOOOl&OUDDOCOQi0000ODUO04O

12、D00._r r , , ,MidieIeS0C0DDDJl7noa000000DDDDoaa00ODDDDDOOoaao00u u, ,CdMi：呻灑師*OCOOOQWO1QQ000000ma0Q抽aaQQQOoa00nd軸goQQF .3r4es per pap-tocooDDig-noa000000DODD00a0000DDDDDGoa0000j aB r , , * ,ndiTDCOanDlAOoa000000DDan00aa0000CDDDDfl00000_ _. .2DCDDDD1BUaa000000DDDDaaan00DODDDDDfl000000n n , (, * ,DCOO

13、D01CQoa0000ODDD00aaso0000DDoaDCanoa00-_. .2DCQDODWD0000nn00ODODcm00nonoDDDD0410000001, r 1 1| | |OCODDOlinaa0000ODDDDDaaoa00DDDDDDDO00aa00._S. 8. ：, SDCOOOOIFD0000000000000000000DDDDO00ZA00,* ,B.1X-J 3i ! 7dl ck !IEi 3s-KSwoasifl or?Tgia?STCOdDHfOswlOfErtn/3”Cata IrttnxMerSt忖J. 02309M1CVB/39向下移動到0C0

14、000200,發(fā)現(xiàn)這就是 MFT文件的開頭，即 USBC把 MFT信息往下推了一個 sector，修復(fù)方法就是把MFT信息往前平移七! fib gdH- furch foption 蜀aw gpl鼻 pqHitl:Qptiptr 團(tuán)rpgw-E *Dto S?出鵲匕A I +百畔B.M.-ii di tic 3 1jmd di ik 2. ?uLl1-i iei 3SC LED八日 XEi! W.XEi； uf. xi； i-.xEi；E.l-airrt yVyh- 2 PWflmi 3OFFaet01Z 345709ABCDEFFl 出 PrMSM.NTFSOCDOI3DZDO4649+c4

15、530DD0300FB7435DZDOOU00nog 伽 44 MWDCDDDD21OQi00Dl003BDDdlaA0DIDDEDQiO040000DCQD0020000000加0000600UU叩0000SUlJEnQinzI0C0DDDJ3D2Aaa0000DDDDdoaa10DDDDDD6(aaa00 M IfrrSt0MOOQOZ1#00onIP00OOdoao4自00aa00aoanonLftidn rrrenes.iVaOCOODDZ5053ca69A6B92BCAai56CB69A6B92BCA01MkK crlubledrr# edkfoccmtmD別co的AEiB92HCA

16、01SBce&9Ab抽2EI3U1CIUBWrNo0C0D0DZ7U06000000DDDDaa000000ODDdDfl000000DCDDDiDlZMoa00ao0DD00100aa0000DD00Ofl0000DDDC00DD25D!CO00on00DDDDcm00300000DD冏0000nnSiMPihOl lAUfi2h4uiftA9&OCODDOZAOoa001600DD0003aa4ADDDDCDIB0001ODPhYlL2l sfldorJioOC0DQ02BD05000000QQQ050050CB6?A6B5ZBCA01Lg 曲3291*57DCODDD2CD53C0旳Ab

17、E52B亡Aai56C69A6B92BCA010CMM2M的帕強(qiáng)A&陽撲CA01004000do04如oa00r3! rf371GBDCODDDZEDa400000DDDDaoaa0600DDDDDflaao0019.-M-3.ZZ4.0C000DO00日相 m per duslw0CD0DD3DDaa0000004BDDaaaa0100IDDDDG000100TDtdl OUSlGfEig 727 彌MDDjmilDoa000000DOOD00noEFQ5DDDOOCaooa00Bf4e5 per sedDP.fl12CUD0D3ZD000000DDDDQG0000no5FDDDC00000

18、0SbdcrcaiTtTTIB.WDCDDDD33Doaoa5F0DDD00oc0000DD5FoaDfl00aa00PlWtSI 空弓 L2DCD0DD34O32F0050000DCocFFB000DDSC0000no0C0DDD35D01004D0DDDDDasa0000DDCDOQomaaODOisiA-imezoneuTCfl.Od-DC叩叭鵜0QlDQQQCDQQ帥Q0QQ400QQQ00Q4OQDQmMade riur artar tfitTSJt tf-JSIASCI0C0DDD37Doa2000DDDDDD00aaF012DDDOOeQoaaa00葉刑朗MRX00Q03BQIF

19、0埠no00帕QiQ003101FFFFOB31口 1粥Bites per pap-t32?.1fi=：Sl2-DCDDDD39Dai6500016DThFFFFFFEFFFEFdfloa0000潮n半卿牛DCOOnDO0Dso00DODDOD00oa000DCDDDDC00000臧盤MfidOwS20CD0003BUao30000DDDDDao0031DBODDDDC000100DCODDDacnB00000004B00cmno01DD4DDDDC000500C000Q3DD!0000nnoaDDDDaouo0000ODDDDO0000nnDCDODDEDiaoa00DDDDDDdoaa00

20、10DDCDOOoaaaDDDCOOQD3FO900000000 all . B B 9甘-1 .yyd - - iyvmpy Z4FF色.八,&a!a Irttrprriff|cI HEK |承冏|云r “ 蟲mGWODliS - CKKW13J 電lBW.0 0*41 TO it?a33 ；*: 11E242739B10.MFT信息由四個文件組成分別是 $MFT, $MFTMirr, $LogFile, $Volume，結(jié)構(gòu)是一個數(shù)據(jù)區(qū)，一個空區(qū)，再一個數(shù)據(jù)區(qū)共四個。直到$AttrDef為下一個扇區(qū)的數(shù)據(jù)，已經(jīng)不是MFT信息，這后面的數(shù)據(jù)并沒有受到USBC的修改選中從0C0000200到0

21、C0000E00的所有數(shù)據(jù)，按 ctrl+C復(fù)制定位到0C0000000,按ctlr+B填充Qffaet01Z 3q 5670 9A BCDEF刁占丨Fiie&rMtiffl：NTFSCODOOIOII1D46肝+C453DDD0300FR7435DZDCm0000FILED.rt5DC0DDDD1D 10001OD3E00aiaAO01DDEDOQ04aa00 C _ _ 0fa faL ：, :：0W0如他QQQQQU帕帥mQQUOQQQQQQfb r r r r r i i i i0CDDDDD3DI2k000000DDDDdoaa1000DDDD60oaao004-uwao1DCOOO

22、OlQ00DU1H00no00AO004H00an軸ia00u00Hretenes. dREtioaid wn1r*sDC00DD05D53ca69A6B92BCAaiSOOB69A6B92BCA01XEiJ 4-fi.XEi； j4.iRJtec nl Riubte- diT# spscrDCQDQDD6D關(guān)C03hhpg肋CA0150CQ&4Abpg2QI2A01XEi； e.Xti；E.Na-7旳切ocoDoonzu000000DDDDao0000DOODDDDCOQ00onDCnODDOBDoa00CD00DD01QGnonoDDDOanDConoa00COOOQDSDi0000nn0

23、0DDDDao0030noDDDDUE4iioi!aii.en 3r4uiAADCODDDDADaaoa18DDDDDDaa心ODDDCDIBoaaiDDJPhlCJlSdilor- 1619453lDCUOQDOBU050000000000050059CBMB32BCA01-羅XEi；:麗l； fg.瓠LejgieflJsedwl*.:DCODDDIKD53 翳C8H6969AbA6E9 刖2B 抻CA.CAai015600C640的0A6 軸耐042BCA ao0100rai scair371 GBOCDDDDDEDoa400000DDDDdOaa0600DDDOOO00000019.4-

24、3.224.CIGi 5?4mOCdOaDDFO04224a4D0046aaS4DOaoDO*oo00DOon-5.H.F.T07如 per dutef.4JJ沁0CDDDD1DD的0000on4&DDaaaa01004DDDDO0001001 aHa暉 TDtJldUslH-5-0 727.349DCDODDlin000000ODDDao00aaEF05DDDOno00aa001Bes per seclp5lSDCDOODJIZDi*30000000ODDDOG0000005FDDDO000000飢八3Kteraurt7T.S1B.7i7DCDDDD13Daa005FODDDDDoa0000

25、DD5FonDO00ao00Pl詢閉2CDDQDKD3ZFO0500DOQC00FFBO00ODDD5fl000000ZCV. . . F .0CDDDD15D01004DODDD00asa00DDDDonOH0000DD-色DislmezQnr UTC+flfi.OO1DCOCD0U001DO00加帥4000UO叩00c00Baaanrr C r i MidisleiOCODDDJI7Doa2000DODDDDdoaaFO12DDDD01oaao00-.-_ - S *OflWeheaaaetimBocooaoi99e-q12no00帕00ddaa3101FFFF013101黑l.yyd店S

26、rtespef papt3Se16=512ocooDDig-n0165000160Ik77FFFFFFFFFFan000000心 uymw. 曙And卿工2DCOODDlAOaSO00OQDDaa00oa00BQDODDDCao000.1. I血&whdOw$2DCDDDD1BUan300000DDDDaa0031OBDDDDDC0001onalia JIli DCOOD01CQ0000OQ00泌0000aa01004DDDOC000500*-.M建CU00DWDQQ00nnDDDDDDcm00nn00ODDDOC000000acoDDDiin4Q0000ODDDDD00aa0010DDDDO

27、d000000色SKtor riZSUtfl ；r.r818 ?9TDCOOOOIFD03 00Ofsrt00a叩0000 00 00000DDDO00ZA00=1jBO曲200”I：0X帕FF 沁.Tsii di tk 工 JjitI di ck ,aiu 3D S4Ef dr -防屯 w曰 Q 甜斗卜11.將0C0000E00的數(shù)據(jù)改為空區(qū)的格式，即保留最后兩位，其他位清零。按&ata Irterpreief | cRB趴鉗1 時64申1 32BIW. *37ctrl+S保存修改 WinHn - IHmrdKJii!gdH-f pvtipn 蜀 e ooh $ipac|HEiiQptipn

28、i： 更pgw_*賈D序日爭Ef #i a ：& i mA*yA I +書畔Em-1 di ifc 3 ljiri dwk L!a ?u-LL4iti 3 13033B4 ；i*: Z7U2512ftafca Irtfrprricf |chUrddi$k2.PMtln 3 A&FM4ffl：NTFSOFFaet01Z 345e7n9ABcDEFDCOOQQEQD0000no0000DDao00no0000DDao0000nnDCDDDDLinaa00DDDDDDDDCIOaa0000DDEDDOaa0000g伽44滋懿 SUiemodfiedXOOQiOrESO00UQ000dQ000000QQ00UQuogo00DCDDDUE3Dmaa0000DDDDaaaa0000DDCDDAaaaa00IWWHwet LAidQrrwnes.2Nock Nln?000000140DOononanODaaonnoan0004anOBOCDODDE5Da000000DDDD00aa0000