Exploration: how to retrieve the original partition after the ghost Partition

Article 1:
Instead, you can retrieve the partition that was mistakenly cloned by the ghost.

 
Guan ghost is a good hard disk cloning software, but its hard disk backup and recovery functions are very convenient. However, if you fail to use ghost to restore the system, the consequences are serious. The most common error is that partitions should be restored, but the entire hard disk is restored, resulting in the loss of data in the logical partition of the hard disk! I have encountered this problem some days ago, but after careful analysis and Operations, I have successfully restored all the data on disk D, disk E, and disk F. Write this process for your reference!
1. Accidental misoperation
When restoring the backup of the primary partition, select "Local → partition → from image" (local → partition → slave image file ), the incorrect operation is "Local → disk → from image" (local → hard disk → from image file ). Because the primary partition data is backed up, the D, E, and F disks have a lot of daily work data and there is no backup. After misoperation, the entire hard disk becomes a C disk. D, E, and F disks all have no information.
 

 
Ii. Careful analysis
 

 
After a problem occurs, I immediately analyze it. Considering that ghost has the ability to automatically partition and format data when restoring data, I know from my practical experience that it only changes the data of the startup sector, and the actual data should still be there, so I started my recovery process.
 

 
Iii. Start recovery
 

 
1. Back up the Partition Table
First, find a hard disk with the same size and partition as the original hard disk. Then start the machine with the DOS boot disk, and then use the kv3000/B command under DOS to back up the data in the Partition Table of this hard disk to the hdpt. dat file on disk.
 

 
2. Restore A partitioned table
 

Replace it with the hard disk for data recovery due to misoperations, and use kv300/hdpt in DOS. the dat command restores the partition table and restarts. The cloned Win98 on drive C still runs, and the lost disks D, E, and F are all back, and the data is restored by 100%, in this case, the effect is the same as that for restoring the primary partition.
 

 
3. Recover disk C data
 

 
After the primary partition is restored, some new data in drive C also needs to be restored. What should I do? On the Internet, I found the easy remat 5.1 (Pro) software that can restore Data in windows. It has the diskfomat function. It is really good to use, and a lot of deleted data is retrieved. In addition, data that has not been overwritten can be restored.
 

 
Iv. Lessons learned
 

 
1. Back up the Partition Table
 

 
After this experience, I deeply felt that I had to back up the partition table after using a new machine or a new partition table. To prevent partition tables from being damaged by various forms (such as viruses), you can use the following methods to restore them.
 

 
2. Do not store the data on drive C.
 

 
It is best to store data on disks D, E, and F instead of disks C and desktops. In this case, it is difficult to recover from a disaster.
 

 
3. Use commands to secure backup/recovery
 

 
Copy ghost.exe to the root directory of drive D (you must use ghost 2001 or a previous version, otherwise some parameters in the following command are not supported) and generate a file named backup. bat command, the content is as follows:
 

@ Echo off
Ghost.exe-clone, mode = pdump, src = 1:1, DST = D: \ SYS. gho-Z9-Sure
Create another batch file named rest. BAT and enter the following content:
@ Echo off
Ghost.exe-clone, mode = pload, src = D: \ SYS. gho: 1, DST = 1:1-Sure-Rb
In this way, we only need to use Windows 98 boot disk to start the machine to the DOS state, to the root directory of disk D, enter rest to restore the system, and use backup to back up the system. Avoid entering the ghost, causing unnecessary troubles due to misoperations.
 

Article 2:
Yes. Try the partition table repair software.

I found some information on the Internet, hoping to help

[Quote]
First, use the fdisk/MBR command in DOS to recover the hard disk partition table. If the hard disk partition table cannot be restored, try the command in diskgen (formerly diskman) to recover the partition table. Similarly, run the command in DOS.

Recommended repair Software

1: Sanming hard drive doctor is another powerful tool for restoring the partition table after kv3000 and diskgen. Due to its unique functions, Sanming hard drive doctor is more powerful than the two predecessors in rebuilding the partition table. For example, although diskgen can also scan a lot of partition table information, most of the information is useless data, and it takes too long, while Sanming hard drive doctor's "hit rate" is much higher.

2: fdisk
You can use fdisk to create new partitions and recreate the primary Partition Table. However, this method does not overwrite the primary Boot Record.Code. If you want to ensure that the number of hard disks is not damaged, the partition must be consistent with the original partition; otherwise, the data is not guaranteed. We recommend that you use the Chinese version of fdisk to get started easily.

3: kv3000
On the main menu of kv3000, press the F10 key to test the system parameters and the fast speed of the hard disk partition table. If the hard disk partition table is abnormal, kv3000 saves the bad partition table to a floppy disk to prevent it from being tested. Then, it automatically recreates the hard disk partition table to bring the hard disk back to life.
However, if the hard disk has only one partition, and the file allocation table (fat table) and file directory table (root table) are seriously damaged, the data will no longer exist. Therefore, even if the Partition Table of drive C is restored, the data cannot be recovered even if drive C is used. In this case, you need to use other hard disk repair tools to restore data. If the hard disk has D, E ,... and so on. In general, kv3000 can retrieve undamaged partitions, create a new hard disk partition table, and then use the DOS system floppy disk to guide the machine, you can enter Several partitions behind the hard disk, and then partition and format the hard disk after the data is backed up. For details about how to use kv3000 to repair a hard disk, you can view the kv3000 anti-virus software instructions or go to the Jiangmin website.
[/Quote]

Article 3:

Testdisk retrieval of the lost Hard Disk Partition Table

Partition Table loss When I started my notebook in the morning, I was told that the operating system was not found. I was a little surprised. I started the USB flash drive boot system in Linux and checked my main hard drive device fdisk-L/dev/SDA. I couldn't find any partitions, the partition table is lost because it is unknown. I used Windows software finaldata to restore hard disk data that has been quickly formatted or even partitioned. So I removed the hard disk and mounted it in the second hard disk bracket. I borrowed ThinkPad and installed fanaldata, however, it can only restore files, but cannot restore partition tables, and does not support LINUX partition data. Restore A partitioned table After trying to make it easier for a table doctor to read this article, GoogleArticle: This article introduces a GPL Partition Table Repair Tool testdisk | BT flower. Find testdisk, download windows, and read the document below using testdisk, then I started to perform analyse on the faulty hard disk. However, after deeper search, I only looked for the first three primary partitions. The two most important logical partitions in the Windows extended partition were not found. The following section describes how to adjust parameters such as the cylindrical (C), track (H), sector (s), and slice size (SS) in geometry: 9730, 255, 63, 512, change the head to 240 (the number of cylinders is not modified, testdisk will automatically read the remaining cylinder. If you need to calculate the number of cylinders, the SS will not change, and should meet the following requirements: new_c = 9730*255/240), execute analyse again, testdisk reads all partition information! The p command can be used to list the files in each partition. After careful confirmation, the partition information is correct and then written to the partition table. Repair MBR grub Install it back to the hard disk and start it. A few letters appear in the upper left corner of the screen and then stop it. It is estimated that MBR grub is damaged. boot from the USB flash drive, mount the/boot partition of the primary hard disk, and enter the/boot/GRUB directory, execute grub and re-write it to the master hard disk MBR: # Grubgrub> root (hd0, 0) grub> setup (hd0) grub> quit   After the hard disk is started again, it enters the system and the data in all partitions is accessed normally. Postscript If a partition table is backed up, you can use Linux fdisk to directly create the original type of partition based on the original start and end cylinder. The data can also be found. It seems that it is very important to back up a partition table. You can add such a command to crontab to back up the partition table information for the last seven days. (There should also be a mechanism to automatically mail the backup file out or synchronize it to mobile storage, or SCP to a host other than the local hard disk ): 00 12 * fdisk-L> ~ /. Pt_backup _ $ (date '+ % Y % m % D'); find ~ -Name ". pt_backup _ *"-mtime + 7-exec Rm-F {}\; When cygwin is installed in the system for testdisk windows, an error occurs when the system starts. This error is probably because cygwin1.dll is updated in the system. After testdisk is deleted, testdisk can be started normally after cygwin1.dll is removed from the decompressed directory of testdisk.

Article 4

Partition Table loss
I started my notebook in the morning and was told that the operating system was not found. I was a little surprised. I started the USB flash drive boot system in Linux and checked my primary hard drive device: fdisk-L/dev/SDA. No partition is found. The partition table is lost because it is unknown.
in the past, the Windows software finaldata was used to restore hard disk data that was quickly formatted or even partitioned. Therefore, the hard disk was removed, mounted in the second hard disk bracket, and a ThinkPad was borrowed, fanaldata is installed, but it can only restore files, but cannot restore partition tables. It is also powerless to partition data in Linux.
restore a partitioned table
Google this article after trying to make it easier for my partitioned table DOCTOR:
introduce a GPL partitioned table Repair Tool testdisk | BT flower
, find
testdisk
, download windows, read the document under using testdisk, and then start to analyze the faulty hard disk. However, after deeper search, only the first three primary partitions are located in the Windows extended partition. The two most important logical partitions for me are not found. Remember the parameters described in the help document
geometry
below you can adjust the cylindrical (C), track (H), sector (s), Sector size (SS), and so on, currently, it is set to 9730, 255, 63, and 512, and the head is changed to 240 (the number of cylinders is not modified, and testdisk will automatically read the remaining cylinder. If it needs to be calculated, the SS will remain unchanged, must meet: new_c = 9730*255/240), execute analyse again, testdisk read all partition information!
the p command can be used to list the files in each partition. After careful confirmation, the partition information is correct and then written to the partition table.
fixed MBR grub.
after the hard disk was installed and started, several letters appeared in the upper left corner of the screen and then stopped. It is estimated that MBR grub was damaged and guided from the USB flash disk, mount the/boot partition of the primary disk, go to the/boot/GRUB directory, execute grub, and re-write it to the MBR of the primary Disk:
# grub
grub> root (hd0, 0)
grub> setup (hd0)
grub> quit

After the hard disk is started again, it enters the system and the data in all partitions is accessed normally.
Postscript
If a partition table is backed up, you can use Linux fdisk to directly create the original type of partition based on the original start and end cylinder. The data can also be found.
It seems that it is very important to back up a partition table. You can add such a command to crontab to back up the partition table information for the last seven days. (There should also be a mechanism to automatically mail the backup file out or synchronize it to mobile storage, or SCP to a host other than the local hard disk ):
00 12 * fdisk-L> ~ /. Pt_backup _ $ (date '+ % Y % m % D'); find ~ -Name ". pt_backup _ *"-mtime + 7-exec Rm-F {}\;
When cygwin is installed in the system for testdisk windows, an error occurs when the system starts. This error is probably because cygwin1.dll is updated in the system. After testdisk is deleted, testdisk can be started normally after cygwin1.dll is removed from the decompressed directory of testdisk.

This article is from the chinaunix blog. If you want to view the original text, click:Http://blog.chinaunix.net/u3/93831/showart_2044745.html

Article 5:

Http://hi.baidu.com/%D3%F6%CA%A6%D4%F2%D1%A7/blog/item/0875ee2bb4995afde7cd4077.html

Article 6:Use diskgen to reconstruct the partition table, repair (MOVE) the hard disk, and retrieve data(22:10:30)

Tags: it

Example 1: A computer cannot enter the Win98 system after it is started. The screen prompts "disk boot failure, insert system disk and press ENTER ". Start the boot disk with Win98, and then press "C:" after "A: \>" and run the "dir" command to check whether "invalid drive specification" is displayed ", it indicates that there is no hard disk partition, and it is suspected that the hard disk line is caused by false contact, but it is not possible to plug and plug in again and again, so it is suspected that the virus is infected, we started the system with the anti-virus floppy disk of Rising Star 2003 and detected two viruses named "wyx" and cleared them. It seems that the virus was caused by the virus. It was discovered that the virus was a DOS-induced virus, the MBR and/boot sectors of the hard disk can be infected. It can be seen that the virus has damaged the partition table, so that the computer cannot identify the partition of the hard disk. If the fdisk command is used to re-create the partition, the problem can be solved, but the data on the hard disk will be lost permanently, so we need to keep the data in the hard disk, so we thought of diskgen as the disk tool, in addition to the partition function, this tool also provides the repair, backup, and reconstruction functions of the partition table. It is possible that this tool can restore the Partition Table of the hard disk, use Win98 to start the disk into DOS, and execute diskg. Run the "Unzip diskgen.exe" command under the enfile folder to go to the main interface of diskgen. Run the "Rebuilding Partition Table" command in the "tool" column. Then there are two methods: "automatic" and "interaction" (automatic first, however, the original partition cannot be found correctly .) Select the "interaction" method, find the matched partition, and prompt that the disk takes effect after it is saved. Then select the "disk storage" command under "Hard Disk, after the system prompts "exit", "restart", "cancel", and select "restart", a familiar startup screen appears, and the partition is retrieved, the data is intact.

Example 2: A friend of the author has an IBM mobile hard drive that Copies files on his computer at a time, when you perform disk operations on a local hard disk, you forget to mount the mobile hard disk and mistakenly Delete the partition. As a result, you cannot find the previous partition when using this mobile hard disk, the above file no longer exists. At first, I just wanted to use some data recovery.ProgramSo I downloaded an easyrecovery program on the Internet to try to recover data. However, in easyrecovery, only one USB device, that is, the mobile hard disk, can be seen. Select it and click "Next ", when the program prompts that the partition cannot be extracted, we can only find another method, so we thought of diskgen again, because when a partition on the hard disk is deleted, the data in the partition is not actually deleted, instead, it only changed its partition table, so the data in the hard disk should be intact. As long as the lost Partition Table is found, the machine will re-Identify the hard disk in the partition, but there is another problem to use diskman, but the mobile hard disk is a USB device, diskgen this software in the Windows MS-DOS can not work very well or can not work at all, (note: I have done a test, in Windows 9x, you can run diskgen and view partition information in DOS, instead of saving disks. If diskgen and partition information cannot be run in WINXP or Win2000, the program will prompt that the hard disk cannot be found) therefore, only in pure dos can be run, but in pure dos, USB cannot be loaded Drive, so I want to split the mobile hard disk, find a laptop hard disk and the desktop hard disk adapter to directly connect the hard disk to the hard disk data cable in the chassis, after the system restarts find the hard disk in the bios, start from the boot floppy disk to the DOS prompt, go to diskgen to execute "recreate Partition Table" under "tool", and then restart the computer to solve the problem.

Conclusion: diskgen (formerly diskman, now renamed diskgenius) is a powerful hard disk partition management tool that can be used in many cases, I think the function of recreating a partition table is particularly useful. The principle is that when the hard disk partition table is damaged by viruses or other reasons, the partition table is re-created through the undamaged Partition Boot Record information, as long as the hard disk is not formatted, the partition table of the hard disk can be restored. After the repair, you must save the disk and exit, and restart the system. At the same time, its partitioning and formatting functions are faster and more convenient than fdisk. If you are interested, try it.

Article 7: