Recover 500G hard disk after re-partitioning data with Winhex

1: Right-click on the desktop computer icon "-" Management "-" Disk Management "to view the status of the hard disk , mainly see the disk when you need to restore the first few hard disks, this time need to restore the hard disk , so 465G of disk 1

650) this.width=650; "src=" Https://s3.51cto.com/wyfs02/M02/97/AA/wKiom1kxAnKwRXhhAAE7lFH9Zmk397.png "title=" 1. View this secondary recovered hard disk from Disk Management. png "alt=" Wkiom1kxankwrxhhaae7lfh9zmk397.png "/>

2: Open this hard drive from Winhex, It is important to note that the disk is opened from the physical drive

650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M00/97/AB/wKioL1kxAhuze7blAAFwEMEjsrE001.png-wh_500x0-wm_ 3-wmp_4-s_2775105320.png "title=" 2. Open the disk from the physical drive in Winhex. png "alt=" wkiol1kxahuze7blaafwemejsre001.png-wh_50 "/>

3: Pull the data area slider to the lowest, search from bottom to top 55AA offset condition is 512=510 , can quickly find a backup of the NTFS file system DBR , the current sector area code of the backup DBR minus the total number of sectors of the file system can quickly find the true starting sector area code for this partition.

4. jump to the beginning of the file system Start sector area code, and then press F3 to continue to search up, quickly find a 55AA , then this 55AA is likely to be an extended partition table. Then press F3 to continue the search and quickly find a backup DBR for the NTFS file system , which calculates the starting sector area code for the file systembased on the total number of file system slices recorded by the backup DBR. Then jump to the calculated start sector area code.

5. continue up search find partition is not found, just find the two partitions written to the partition table to verify that after writing to the partitioned tables, then update the Winhex disk snapshot can see two partitions, double-click Open View, Find the data that we need to find. This means that we are back to the right, but there are 5 partitions now recovering two partitions, which is clearly not enough. And then search for 55AA in just the same way, you can't find the rest of the partition.

650) this.width=650; "src=" Https://s1.51cto.com/wyfs02/M01/97/AA/wKiom1kxAomiDw1tAAB1_VNwYQs765.png "title=" 3. In Winhex, see the recovered two partitions. png "alt=" Wkiom1kxaomidw1taab1_vnwyqs765.png "/>

6. A different method to find the partition, according to the data storage law, pull slider, the slider stop at the junction of the XX and garbled areas of a little bit of position, and then search down 55AA offset condition is 512=510. Locate a backup DBR in the 102402046 location, then scroll slider The next sector is the starting sector area of the DBR for the next partition . Writes the found partition to the partition table to verify that the data for this partition is the partition we think of recovering

650) this.width=650; "src=" Https://s1.51cto.com/wyfs02/M00/97/AA/wKiom1kxApTD9_ruAABymWwpReI541.png "title=" 4. Another partition was found in a different way. png "alt=" Wkiom1kxaptd9_ruaabymwwprei541.png "/>

7. double-click to open this partition and find that the data is the disk we need to recover

8.according toDbrtotal number of file system sectors recorded in theDbrthe current sector area code, calculate the end of the file system sector code, jump to the end of this section of the sector area code, and then search down55AA, the offset condition is512=510.soon found aNtfsof BackupDbr, this we directly ignore, pressF3continue searching, and you will find aDbr, this is the realDbr, get thisDbrtotal number of file system sectors, then add thisDbrThe starting sector area code you can get the sector area code for the last sector of this partition. here we find that the end-of-sector area code is approximately the same as the one found in the previous search from the bottom up, indicating that the two partitions are connected. The task of finding a partition here is complete. Originally5a partition we recovered the back.4partitions, The First partition is exactly formatted,This class does not say how to recover first. This lesson only tells you how to find the missing partition.

9. write the found partition to the partition table, where you need to repair the extended partition table because the number of partitions exceeds 4. 650) this.width=650; "src=" Https://s5.51cto.com/wyfs02/M00/97/AB/wKioL1kxArqxc5CdAACN9I82gB4056.png "title=" 6. After finding all the partitions, see the partitions in the Winhex. png "alt=" Wkiol1kxarqxc5cdaacn9i82gb4056.png "/>

After re-flushing the disk management, you can see that the partition is restored directly , and the data in it is restored.

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M02/97/AB/wKioL1kxAsii5UtdAAGQobMnszQ655.png-wh_500x0-wm_ 3-wmp_4-s_1703312017.png "title=" 7. In Disk Management, you see that the partition is restored directly and that it has data. png "alt=" wkiol1kxasii5utdaagqobmnszq655.png-wh_50 "/ >

Recover 500G hard disk with Winhex after re-partitioning the data video: http://pan.baidu.com/s/1kVmhbVp

Recover 500G hard disk after re-partitioning data with Winhex