An introduction to Winhex and related concepts 1 Winhex
is the hexadecimal editing software that runs under Windows, this software is very powerful, has the complete partition management function and the file management function, can automatically analyze the partition chain and the file cluster chain, can carry on the different way to the hard disk the different degree backup, even clones entire hard disk ; It can edit binary content of any file type (in hexadecimal) its disk editor can edit any sector of a physical or logical disk, and is the preferred tool for manually recovering data.
2 Data Recovery Concept data recovery classification: Hard recovery and soft recovery. The so-called hard recovery is physical damage to the hard disk, then we will repair it, while retaining the data inside or later restore the data inside, so-called soft recovery, the hard disk itself is not physical damage, but due to human or virus damage caused by the loss of data (such as mis-formatted, mistakenly partitioned), Such data recovery is called soft recovery.
The main introduction of soft recovery, hard recovery also need to buy some tool equipment (such as pc3000, electric soldering iron, various chips, circuit boards).
3 MBR and EBRMBR, the master boot record, are located on the 0 cylinder 0 Track 1 sector of the entire hard drive, occupying a total of 63 sectors, but only 1 sectors (512 bytes) are actually used. In a total of 512 bytes of the master boot record, the MBR can be divided into three parts: the first part: The boot code, occupies 446 bytes; the second part: Partition table, occupies 64 bytes; The third part: 55AA, End flag, occupies two bytes. We're going to say later. Using Winhex software to recover the wrong partition, mainly to restore the second part: Partition table.
The role of the boot code: is to make the hard drive has a bootable function. If the boot code is missing and the partition table is still there, the hard disk will be the same as the partition data from the disk, but the hard disk itself cannot be used to boot into the system. If you want to restore the boot code, you can use the DOS command: FDISK/MBR; This command is only used to restore the boot code, not cause partition changes, loss of data. In addition, you can also use tool software, such as Diskgen, Winhex and so on.
But if the partition table is lost, the result is a partition of the entire hard disk, as if just bought a new hard drive has no sub-zone. is the area where many viruses like to destroy.
EBR
EBR, also known as extended MBR (Extended MBR). Because the master boot record MBR can only describe a maximum of 4 partition entries, if you want to divide more than 4 extents on one hard disk, you should use the extended MBR approach.
MBR and EBR are generated by partitions.
Each partition is composed of DBR, FAT1, FAT2, DIR, and DATA 5 parts.
4 Winhex menu and the top of the interface is the menu bar and toolbar, the following largest window is the workspace, now see the first sector of the hard disk, the contents of 16, and display the corresponding ASCII code on the right, the right is a detailed resource panel, divided into five parts: state, capacity, current position, window conditions and Clipboard conditions. These conditions are very helpful in capturing the entire hard drive. In addition, right-click on it to swap the detailed assets panel with the window, or close the resource panel. (If the resource panel is turned off, it can be opened by the View menu-Display command-detailed resource panel). The bottom column is useful for ancillary information, such as the number of current sectors/Total sectors ... such as
Pull down the scroll bar, you can see a gray bar, each to a bar for a sector, a sector total of 512 bytes, every two digits of a byte, such as 00.
5 Chinese Menu
Select the chinese,please!, can be converted to Chinese menu, but under a 17.x version, you need to register to switch to the Chinese menu, and a 18.x version, can be converted to Chinese menu;
Two Getting Started 1 open disk
Menu: Tools-Open disk;
Select the disk you want to open;
2 interface
Above is the directory and file situation; The bottom is the 16 binary value of the open disk;
3 Find the end sign of the MBR
As described earlier, the MBR accounts for 1 sectors, 512 bytes, the end flag is 55AA, the calculator can be opened directly from the Winhex, 10 binary 512 conversion to 16 is 200;
Find offset 00000200, for example, each sector end has a horizontal line flag, offset starting from 00000000, then the start offset of the second sector is 00000200; see, the Offset column value is the last 2 bytes of the corresponding row for 000001f0, It is the end sign of the MBR, so that the MBR area is found;
4 Viewing partitioned Tables
The partition table is 64 bytes before the end flag, 16 bytes per line, 4*16=64, and the fifth row of the first sector, the 2nd byte of the reciprocal, is the beginning of the partition table, and the value is 0 D;
There is a problem;
According to the information on the Internet, the first byte of the partition table is the boot flag, if the value is 80H, the active partition, and the 1th byte of 00H indicates the inactive partition. So what does my 0D mean?
The five bytes are the partition type;
00h--indicates that the partition is not in use
06h--fat16 Basic Partitions
0bh--fat32 Basic Partitions
05h--Extended Partition
07H--NTFS partition
0fh--(LBA mode) extended partition
83h--linux partition
Count to the fifth byte, why is my 4F?
Just open the C drive, then open the B-plate, is the same;
There is no way to go on, next time;
such as the arrow button, you can enter the offset value, to jump;
Getting Started with graphical Winhex
