Two moves to easily recover a wrong Ghost Hard Disk

 

Recently, I have helped my friends recover several hard disks with the wrong Ghost. Today, I am taking some time to write and handle these hard drives. I hope I can give some reference to my friends who have encountered such problems. There are two possible causes of incorrect Ghost. One is to misuse the XP installation disk with the Ghost function. This installation disk will recreate the partition table and divide your hard disk into four areas, then, the Ghost of the XP system is restored to the C drive. The second is to use the Ghost backup to restore the system, which should have been restored to the C drive, but accidentally restored to the entire hard drive. These two operations are essentially the same. They both rewrite the Partition Table of the hard disk and overwrite some data to the hard disk. From the data recovery perspective, partition C is covered by data. Because there is no deep recovery technology in China, basically covered data cannot be returned, however, data after partition C can be completely restored. An example shows that a hard disk originally has three partitions: C, D, E, D, and E with important data. I originally intended to use Ghost to mount an XP system on disk C, but I accidentally restored the Ghost backup to the entire hard disk. This sub-hard disk has only one C partition. As shown in the figure, the hard disk has a total of 16 GB. Originally, the C disk is 8 GB, and the D and E are 4 GB each. Now there is only one C disk, and the size is 16 GB.

 

 

 

As you can see, Ghost does two things. One is to cover part of the space on disk C, and the other is to rewrite the partition table. Except for some data covered by Ghost, the rest of the data is undamaged. As long as we can reconstruct the partition table, we can see the data of the original D disk and E disk again. To recreate a partition table, the key is to know the starting position of the first extended partition. After finding this position, all the problems will be solved. I usually use Winhex or Diskgen to solve this problem. Now I write both methods for your reference.

One Winhex

Winhex is a five-star sector editing tool. It is only 2 MB in size, but it has powerful functions. What are the analysis of partition tables, DBR analysis, calculation offset, and cluster chain tracing, it is a weapon reserved by data recovery engineers. We invite it to appear first, but using Winhex requires a certain understanding of the data storage principle (I will not introduce the principle in detail today). Otherwise, the Winhex interface will crash even if I read it.

We mount the hard disk to be restored to another computer, as shown in. Disk 1 is the target hard disk. Now it has only one partition, and we want to restore its partition to its original state.

 

Start Winhex and select "disk Editor" from the tool menu, as shown in. Select to open the second physical hard disk HD1 (wmware's experimental environment ).

 

 

 

Winhex opens the physical hard disk, as shown in figure. The content of the 0-sector is divided into three parts: the boot program, the partition table, and the ending sign of 55AA. The green part in the figure is the partition table. Since there is only one partition in the hard disk, there is only one partition table.

 

Now we need to re-create the correct partition table. There are two items in the Partition Table: one is the description of the primary partition C, and the other is the description of the extended partition. The key is to find out the starting point of the extended partition. Since the C partition of the original hard disk is about 8000 M, the size of each cylinder is 255 × 63 × 512 = 8225280 bytes = 7.8 M, therefore, the starting point of the original extended partition is approximately 8000 bytes 7. 8 = 1025, that is, the starting point of the extended partition is near the 1025 cylinder. Considering the error, we relaxed the range and asked Winhex to start searching for the starting sector of the extended partition from the 950 cylindrical surface. The starting sector of the extended partition has the extended partition table, and the slice ends at 55AA. We can specify the search conditions based on this feature. The specific idea is that each slice contains 512 bytes, ranging from 0 to 511, we asked Winhex to retrieve the 510 and 511 bytes of which are 55 and AA. This sector may be the starting sector of the extended partition we are looking. Of course, it is also possible that an irrelevant slice end with 55AA, so further screening is required. In general, the starting sector of the extended partition is always located in the 0 head and 1 sector of a cylindrical disk. We need to exploit these conditions.

 

 

 

Now, first locate the 950 cylindrical 0 head 1 sector. We are going to start searching from here and select "go to Sector" in the "position" menu of Winhex, as shown in, enter the parameter 950/0/1. Again, the 950 cylinder is just an empirical estimation result.

 

 

In the Winhex "Search" menu, select "Search hexadecimal value", as shown in.

 

As shown in, we entered the search parameter. The hexadecimal value for the search is 55AA, And the search direction is downward. This tells Winhex to search backward from 950 cylinder. The condition is set to start from the offset of 510. Because one sector has 512 bytes, the number ranges from 0 bytes to 510, 55 is at 511, and AA is.

 

After the search starts, a qualified slice will be found. Do we need to expand the start slice of the partition? In Winhex's "View" menu, select "details panel" to display the LBA and CHS parameters of the slice, as shown in, this sector is located in 1019 cylindrical 254 head 63 sectors. Obviously, it is the ending sector of an NTFS partition, probably the last sector of the original C disk. This sector is not what we need. Continue searching!

 

The sector we find down is very similar to our target. As shown in, there is a partition table in this sector, and the position is in the 1020 cylindrical 0 head and 1 Sector, which is almost the same as the estimated 1025 cylindrical, based on experience, we can basically determine that this is what we are looking.

 

Well, assuming that the 1020 cylindrical 0 head 1 sector is the starting point of the extended partition, we can determine that the original C partition started from the 0 cylindrical 1 Head 1 sector, end at 1019 cylindrical 254 head 63 sectors. Where does the extended partition end? You can find the answer from the second item in the partition table. The second item in the partition table describes the start and end points of the second extended partition, the end point of the second extended partition is the end position of the extended partition we are looking. From the partition table, the start point of the second extended partition is 7D to the current sector and the size is 88 C8 AE. After calculation, the end point of the extended partition is 2087 cylindrical 254 head 63 sectors. Speaking of this, I want to say sorry to some friends. These calculations involve partition principles. If you have never touched them before, it is really hard to understand. I will take the time to write some articles about the principles of data recovery. If you have any questions, refer to the second method.

 

 

After calculation, we calculated the C partition from 0/1/1-1019/254/63, and the extended partition from 1020/0/1-2087/254/63. With these parameters, we can write two partition tables in the partition table with 0 sectors of the hard disk, describing the C partition and the extended partition respectively. As shown in, the two Partition Table parameters are 80 01 01 00 07 fe ff 3F 00 00 00 BD 08 FA 00 and 00 00 C1 FF 0F fe ff fc 08 FA 00 2C CD 05 01. After modifying the partition table, save the settings and restart the computer.

 

After restarting the computer, we found that disk 1 already has three partitions, as shown in, where F and G are D and E in the original hard disk. Now these two partitions can be accessed normally, data should be restored by 100%.

 

 

 

Open drive F, as shown in. All data is returned. You can verify that the content of the third partition is restored in the same way. Now the first partition in the hard disk cannot be accessed, but we only need to use the Ghost backup to perform a recovery operation on the first partition. So far, data recovery has been completed!

 

 

This method is suitable for users who know the partition principle. If you do not know the parameter meaning of the partition table, you can choose one of the following methods.

 

 

 

 

 

 

 

Ii. Diskgen

Diskgen is a well-known partition restoration software in China. It can quickly reconstruct, back up, and recover partition tables. It is a good helper for partition recovery. Especially when it looks for a partition table, it is optimized. Each head only checks the first sector, so the search speed is very fast. However, this feature is sometimes troublesome, the specific case will be introduced later. Diskgen has the DOS version and Windows version, which can be used. I usually use the DOS version Diskgen in the dark red leaf disc. I feel it is enough. Remember, we can rely on tools but never rely on tools. Tools are just an extension of the engineer's thinking.

Recover the hard disk to the fault state, in the computer into the dark red leaves boot CD, as shown in, the dark red leaves of the startup interface, we choose the second "ten thousand MS-DOS toolbox".

 

 

Go to the dostoolbox and run Diskgen, as shown in.

 

 

 

 

After Diskgen is started, select hard disk 2nd in the "Hard Disk" menu, because the hard disk we want to restore is the second hard disk in the computer. As shown in, the second hard disk has only one partition. We are going to recreate the partition table, and select "recreate Partition Table" from the "Tools" menu ".

 

 

Diskgen reminds you to back up the partition table first. We select "continue ".

 

 

Next, we should select the "Interaction Mode" to make the recovery process easy. Of course, if you really don't understand the principle, it's hard to try your luck in the automatic mode.

 

 

Diskgen first finds the current first partition. The partition result is generated by mistake of Ghost, which is not what we want. Therefore, select "Skip ".

 

Diskgen continues searching down, which is very fast. If Diskgen finds some partitions, but they are far away from the 1025 cylinder, it is likely that the partitions are left behind. We can skip this step ". As shown in, Diskgen finds the extended partition of the 1020 cylinder. This is what we need. Click "retain ". In this way, Diskgen will automatically create a partition item for this extended partition when recreating the partition table.

 

 

There is no partition for the 8 GB space before the expansion partition. Click the first 8 GB unpartitioned space on the hard disk and select "new partition" from the "partition" menu, as shown in.

 

Diskman asks whether to allocate all the space before the extended partition to this partition, and click "OK ".

 

 

 

Diskgen asks whether to set the partition type to FAT. Because we use Ghost to restore the partition File System to NTFS, select "no ".

As shown in, Diskgen requires manual input of the partition type. We enter the NTFS code 07.

As shown in, after the partition is re-built, a new partition is created, the original extended partition is retrieved, and the computer is restarted after the disk exits.

As shown in, after the computer is restarted, the partition returns to normal, and the data in the second and third partitions are restored.

Summary: partition errors caused by incorrect Ghost are better handled. As long as the partition table is correctly rebuilt, data after partition C can be restored by 100%. If you are familiar with Partition Table parameters, you can use Winhex to complete the task. Otherwise, it is good to use Diskgen for auxiliary processing. Do not use Easyrecovery or other tools to scan for recovery. First, it takes a long time. In addition, the scanning and recovery effects are not satisfactory, at least not 100%. Recovery error: Ghost only involves partitions. Generally, it does not involve file systems. Unless data on disk C is overwritten by the Ghost, Easyrecovery can be used to try your luck.