Winhex restore partition tables and accidentally delete files

Winhex is a small tool dedicated to dealing with various daily emergencies. It can be used to check and repair various files, restore and delete files, and data loss caused by hard disk damage. It also allows you to see the files and data hidden by other programs. In general, it is a very good hexadecimal editor. Zdnetsoftwarelibrary has the highest rating and has powerful system functions.

First, let's talk about file recovery. Open the program menu-"tool"-"Open disk". You can choose the disk for file recovery and click open to browse all disk files in the upper part, find the file to be restored, right-click it, and select "Restore". Set the recovery location. (Note: no new data is written to the deleted file ).

Next, let's talk about restoring partition information. In this example, two hard disks are attached.

Start winhex and find that all MBR instances are zero. Next we will start to manually restore the partition table.

First, restore the Boot Code. This is the simplest. You only need to use winhex to copy the boot code to another system disk. Isn't there two hard disks hanging on my current machine? A maxcompute 2G, A Western data 40g, and a western data 40g are my system disks. Copy them from this disk.

Click "disk Editor ".

The "Edit disk" dialog box appears.

Select hd0 WDC WD400EB---00CPF0 and click OK"

In this way, we open the Partition Table of the system disk. Note that now we open two windows. The current window is "Hard Disk 0", which is displayed on the title bar. In addition, you can also see that the current window is checked. If you want to switch back to the original window, click Hard Disk 1 ".

First, select the Boot Code for the System Disk.

Right-click the selection area and select "edit"

Next, select "copy and select block"-"normal"

Switch back to Hard Disk 1, right-click the first byte of the zero sector, and select "edit"

Select "Clipboard data"-"write ......"

A window prompt appears. Click "OK"

In this way, we will copy the boot code on a normal system disk.

Next, we will start to restore the Partition Table (a total of 64 bytes, divided into 4 Partition Table items, each partition table item occupies 16 bytes, generally only use the first two Partition Table items ), first, we will restore the first partition item (that is, used to describe the C disk ).

First, fill in the partition guide flag at the second byte (the fifth line to the bottom of the 0 sector, and the second to the last byte). Because drive C is an active partition, fill in 80.

Next are 2nd, 3, and 4 bytes (start head number, Fan area number, and Cylinder Number of the partition). Fill in: 01 01 00.

5th bytes are the partition type characters. Because the original drive C format is FAT32, enter 0b. So what if you don't know the format of drive C? You will ask the customer. What if he doesn't know? Don't worry. I will teach you how to differentiate the partition format when we talk about restoring DBR later.

6th, 7, and 8 bytes are the ending head number, Fan area number, and cylindrical Number of the current partition. How can this problem be solved? Do not worry. The current disks are all LBA-oriented and not C/h/s (and cylinder, Head, and sector)-oriented, so it doesn't matter what you fill in here, but I want to tell you there is a general filling method: Fe ff.

9th, 10, 11, 12 bytes. The number of slice used before the current partition, that is, the number of slice occupied by MBR. Isn't that 63? Yes, but you need to convert 63 to a hexadecimal number, and then enter it in reverse order. Do you still remember how to use a calculator? Convert 63 to a hexadecimal value of 3f, and add zero before four bytes, that is, 00 00 00 3f. Then, convert the number from right to left to 3f 00 00.

13th, 14, 15, and 16 bytes are the total number of slices in the current partition, that is, the size of the drive C, which is calculated by a little bit. Because the C drive starts from 63rd sectors, and the C drive is followed by EBR, the first sector in which the EBR is located minus 63 is the size of the C drive. So how can we find the first slice where EBR is located? As we have said before, the EBR structure is the same as that of MBR. Therefore, the end mark of EBR must be 55aa. If we find this end mark, let's see if this slice is not EBR?

Click "Search" -- "Search for hexadecimal value ......", Then a dialog box is displayed.

Enter "55aa" in the text box, select "all" in the search box, select "condition", and set the offset to "512 = 510 ".

Click OK ". The figure is as follows:

First, find the first "55aa". We can see that the slice is on the first 63rd slice, not the EBR we are looking for. Then press F3 to continue searching.

I found several other sectors, none of them. Is this sector below?

As we have mentioned above, the EBR structure is the same as that of MBR, so the second and last bytes in the last five lines should be 00 01, and the first 446 bytes should be 0, obviously this is not an EBR. Continue to search by F3 ...... Finally, we found the real ebr in the 1435392 sector.

TIPS: Hard Disks are relatively large now. It is too slow to search for 55aa by sector. Is there a way to hurry up? Yes, you should first ask the customer about the size of the C drive. Most customers still know it. For example, if he says that the C drive has about 10 Gb, you should not start from scratch, because it is too slow. The 10 Gb is about 20 million sectors, so you can use the command to convert to the sector directly to the 19 million sector. It is much easier to start searching from that place.

Use 1435392 minus 63 to get 1435329, and then convert it to hexadecimal format, that is, 15e6c1. if you reverse it, It is c1e61500, which is the size of the C drive. In this case, the first Partition Table item is filled out. Save the item and enter the second partition table item.

The second partition table contains 1st Bytes: Write 00 because it is a non-active partition.

2nd, 3, 4 bytes, fill in 01 01 00 (General)

5th Bytes: Fill in 0f because it is an extended partition.

6th, 7, 8 Bytes: Fill in Fe FF (General)

9th, 10, 11, and 12 bytes are the number of slice used before the current partition, which should be the size of the C disk plus 63, that is, 1435392, which was just calculated above, convert to the hexadecimal number, and then convert it to 00 E7 15 00.

13th, 14, 15, and 16 bytes are the total number of slice in the current partition, that is, the total number of slice in the extended partition, that is, the size of the entire hard disk minus the size of the drive C and then 63, that is, 4124736-1435329-63 = 2689344. If it is converted to a hexadecimal system, it is 290940, and the other is 40092900.

In this way, the second partition table is complete.

Don't forget to fill in the final ending sign 55aa. In this way, the MBR will be completely restored. Finally, save and restart ......

After the boot is complete, I can't wait to open my computer and find that all three partitions are back, and the data is intact.

Right-click my computer and choose manage"

In the displayed dialog box, select "disk management". On the right side, you can see that all the three partitions (FAT32, fat16, and NTFS) of Disk 1 are back. At this point, the partition table is successfully restored.

Manual data recovery has a high success rate, which is interesting and challenging. It can retrieve files that many silly software cannot find. However, engineers must be patient and stay awake, clear what you are operating, what will happen after the operation, and whether you can return to the previous status. Especially for some destructive operations, we must be considerate. as long as conditions permit, we must back up the data before the operation. Otherwise, it will cause a "blood" lesson. Remember!