修复移动硬盘RAW格式winhex

1、USBC造成问题,造成分区无法访问，其实数据并无损坏，下面是解决办法1.打开 win hex，按 F9问题症状：移动硬盘，插入之后突然所有分区不能访问，出现如下提示。那么很有可能是 网上也有人视之为病毒。原理就是USBC文件将整个分区的MFT向后移了一个sector，2.选损坏的硬盘Li Fhysical&HDO： FUJITSU NMZ216OBH G1 (149 GB)HDl： HiUehi KTS545O5D阳幻皿 C46B 囲 USB)_J HD2： SANSUHG HM150JT (149 GE, USB吕 Optical drive 0QKCancel |3.双击损坏的分区i Fi

2、b EdH- $f4rri-i Pprtipri UFm _M：h 5ppriiifiit 门卩rim Wivdnw Hftpp a g ars? 壮旣迪x料 日自孕 自辛wr i oh 尋3i di ik 2 I朗-MTFTe口单tPartlMi 111B1SMTF337.7 00315 KB31 BIKB31 EffCB232+72706 155KI785 TTB34923 232472645PartlKtiPfirtiiW 观 Parlrten Qs PaitiKn qvFncmif鏗P UBR Hmy匚“伽37.1 CBHardduk? 叫初 3uNGt*iieaic Bus.U&BO

3、hEjEcM 屜* StalEcngindIWW IM*. LAidarevenes.Total cpaotf149 GB怔l沖加Brtes per sedDP. Su12B2fllBa(3E06ES16DOSBOflOD6ECO33EBCfiQ6OE00I0B-P- jAjlif a a .aZ6I2HBfl7010E3530弱QD(W阴&AozCEBAW刊0B4.*5.bi. .hj rl .5.IZBEZHBOaO08CD137305B9FFFF8AFlB6EFB6C64066-i.sJyylififUBE2W4$OOF朋D】帥U3：EF7E2酣tDCOED41筋OFIZBEZUBtla

4、07C966F7ElE fA3200003B44133558AA fiLTI124onCD1372DFSiFQ分47&0-9阳Cl01-5-1.r- .-flUfi-u .oA.1ZSEZBS0CII04FE06丄耳DDC36660IECt66Al100066t山 i f 1 f1.2BL2DE0Dfl031C00陆血2000OF823AOCIE百国3.-.f;.1 : . .FjIZSrZPBQEO0066500653B66S1000DI00BD3E0000.fP.SEli. V .12BE2IIB13FOOF65DCDOLB町IF803E14DOODDF346100.1. A； 3yli

5、. i . H .IZSK2HB1O0日44ZBA1624DD16IF3BF4CD13斫595007Bl辛 H占tDC12HE21DB11CI66566656JlFEB2D6633D2&cr37QE1600fXfX.OKIdlt space alumfcslKl:25 KB7TB13732Tsii 4 ek g Jjirii di ik 臨 ?u-Ll1j n 3Fil* EditPpfrtiQnTqqJi. paciaiit Qptipii MVindDHrC -*oatag r：?斡戈匚 丁料 色QFfgetQ1Z35 670 ?AHCQEFNTFSOOODDOOlDDEB5Z904E54

6、532020ZOZDDDD2OS000&oct MrtorODOODDD1D00000000DOIB003FDOFFDD3j0aa001Butrf bHtJEui ILnmpjdLc*Osfaifl Em 瞅啜 Stailrwiginai0000QQi0；900阳00oa斡軸仙00AC霜A3U404前0000Master File TjJble i；JjMFT)OODDDDDSDiooililf?rnooc00IQ00BA3h4 .acon j0niloo的kmc400CQCIDD4Q阳皿on010000QQ优陌ABDC91ABQCDCSearch FRE reccrd .cywiOOOQDD

7、DFilOFocDOEB3FF购JE14DDDDDF94Elg.1. .ibyh :：-.la .Cwsrt0Etodc.6.记下Start C# $MFT 的位置，移动硬盘一般为786432&ata irttrprMff |c诃呻-21 IfiStl-M-js 21MT 33 ；*: T3130H1Z；二 Boot Sector NTFS, Base Offset： 0OffsetTitleValue40L1P instructionEB 52903File system IDNTFS1 BBytes persector512DSectors per cluster3I EReserved

8、sectorsQ10(always zero)00 00 0013(unused)00 0015Media descriptorFB16(unused)00 0018Sectors per track631AHeads2551CHidden sectors6320(unused)00 00 00 0024(always 30 00 80 00)80 00 30 0028Total sectors77818796r30Start C# &MFT78643238Start C# SMFTMirr486367440FILE record size Indies-1041(unused)0上INDX

9、buffer size indica 1二7.clt叶G,Go to sector ，把刚才复制的 MFT位置填进去Go Ta SectorSE8发现原本应该为MFT文件的位置0C0000000变为了 USBC下面进行替换工作d cs stffis： 唔旦ds? 出出性丫粕 -*遇中 吕I：.a Ph|if lL3l factor Mn161!1453-MDCUOQDOBU000000叩OD00000000ODDODC000000K Br . i i, ,Lejgksi 阳 d 佃 Nw.DCDDDDDCnoaoa0000DD00aoaa00DODDODOQoaaa00U J .K000DDD

10、couaaaoa帅00仙ao口口aoaoOD前oaCi.Br F ,raitirf3T1GBOCOODDOEO00000000DDDDaoina0000DDDDDGoa000019.-E43.2Z4.0e thlMOCdOaDDFO加DOnnaODQO00oaDODO00D0DO00oann1Hrtes Mr dUFteT4.映DCDDDD1DUaa0000OCIDDDD00oa0000DDDDDOaa00DOi. a.1 . 1rotii dUsiEfs-Q727.S4.UOCDDODllO00OUUODD00OD00aoLIUDODDODOD00au00-EIse w sedDB.51SD

11、CDOODJIZDi00000000QDDDao00000000DDDO000000n r i i| | |Sbdcr CMirt7T1B.7#7DCDDDD13DaaoaQDDDDDQDOQoa00DDDDODDfl00aa00-_ b. s. sPlTfiiral tfSSlL2CDDQDKDOD00no00ODDD00000000QQDDDO000000,9r a i i1 ,DCODDDianoaoa00DDDDDDdoaaODODDDDD01oaaaDDfc a i , . 8Disjfty lime znn?uTC*fla.ooXOOOOl&OUDDOCOQi0000ODUO04O

12、D00._r r , , ,MidieIeS0C0DDDJl7noa000000DDDDoaa00ODDDDDOOoaao00u u, ,CdMi：呻洒師*OCOOOQWO1QQ000000ma0Q抽aaQQQOoa00nd轴goQQF .3r4es per pap-tocooDDig-noa000000DODD00a0000DDDDDGoa0000j aB r , , * ,ndiTDCOanDlAOoa000000DDan00aa0000CDDDDfl00000_ _. .2DCDDDD1BUaa000000DDDDaaan00DODDDDDfl000000n n , (, * ,DCOO

13、D01CQoa0000ODDD00aaso0000DDoaDCanoa00-_. .2DCQDODWD0000nn00ODODcm00nonoDDDD0410000001, r 1 1| | |OCODDOlinaa0000ODDDDDaaoa00DDDDDDDO00aa00._S. 8. ：, SDCOOOOIFD0000000000000000000DDDDO00ZA00,* ,B.1X-J 3i ! 7dl ck !IEi 3s-KSwoasifl or?Tgia?STCOdDHfOswlOfErtn/3”Cata IrttnxMerSt忖J. 02309M1CVB/39向下移动到0C0

14、000200,发现这就是 MFT文件的开头，即 USBC把 MFT信息往下推了一个 sector，修复方法就是把MFT信息往前平移七! fib gdH- furch foption 蜀aw gpl鼻 pqHitl:Qptiptr 團rpgw-E *Dto S?出鵲匕A I +百畔B.M.-ii di tic 3 1jmd di ik 2. ?uLl1-i iei 3SC LED八日 XEi! W.XEi； uf. xi； i-.xEi；E.l-airrt yVyh- 2 PWflmi 3OFFaet01Z 345709ABCDEFFl 出 PrMSM.NTFSOCDOI3DZDO4649+c4

15、530DD0300FB7435DZDOOU00nog 伽 44 MWDCDDDD21OQi00Dl003BDDdlaA0DIDDEDQiO040000DCQD0020000000加0000600UU叩0000SUlJEnQinzI0C0DDDJ3D2Aaa0000DDDDdoaa10DDDDDD6(aaa00 M IfrrSt0MOOQOZ1#00onIP00OOdoao4自00aa00aoanonLftidn rrrenes.iVaOCOODDZ5053ca69A6B92BCAai56CB69A6B92BCA01MkK crlubledrr# edkfoccmtmD別co的AEiB92HCA

16、01SBce&9Ab抽2EI3U1CIUBWrNo0C0D0DZ7U06000000DDDDaa000000ODDdDfl000000DCDDDiDlZMoa00ao0DD00100aa0000DD00Ofl0000DDDC00DD25D!CO00on00DDDDcm00300000DD冏0000nnSiMPihOl lAUfi2h4uiftA9&OCODDOZAOoa001600DD0003aa4ADDDDCDIB0001ODPhYlL2l sfldorJioOC0DQ02BD05000000QQQ050050CB6?A6B5ZBCA01Lg 曲3291*57DCODDD2CD53C0旳Ab

17、E52B亡Aai56C69A6B92BCA010CMM2M的帕強A&阳扑CA01004000do04如oa00r3! rf371GBDCODDDZEDa400000DDDDaoaa0600DDDDDflaao0019.-M-3.ZZ4.0C000DO00日相 m per duslw0CD0DD3DDaa0000004BDDaaaa0100IDDDDG000100TDtdl OUSlGfEig 727 彌MDDjmilDoa000000DOOD00noEFQ5DDDOOCaooa00Bf4e5 per sedDP.fl12CUD0D3ZD000000DDDDQG0000no5FDDDC00000

18、0SbdcrcaiTtTTIB.WDCDDDD33Doaoa5F0DDD00oc0000DD5FoaDfl00aa00PlWtSI 空弓 L2DCD0DD34O32F0050000DCocFFB000DDSC0000no0C0DDD35D01004D0DDDDDasa0000DDCDOQomaaODOisiA-imezoneuTCfl.Od-DC叩叭鵜0QlDQQQCDQQ帅Q0QQ400QQQ00Q4OQDQmMade riur artar tfitTSJt tf-JSIASCI0C0DDD37Doa2000DDDDDD00aaF012DDDOOeQoaaa00叶刑朗MRX00Q03BQIF

19、0埠no00帕QiQ003101FFFFOB31口 1粥Bites per pap-t32?.1fi=：Sl2-DCDDDD39Dai6500016DThFFFFFFEFFFEFdfloa0000潮n半卿牛DCOOnDO0Dso00DODDOD00oa000DCDDDDC00000臧盘MfidOwS20CD0003BUao30000DDDDDao0031DBODDDDC000100DCODDDacnB00000004B00cmno01DD4DDDDC000500C000Q3DD!0000nnoaDDDDaouo0000ODDDDO0000nnDCDODDEDiaoa00DDDDDDdoaa00

20、10DDCDOOoaaaDDDCOOQD3FO900000000 all . B B 9甘-1 .yyd - - iyvmpy Z4FF色.八,&a!a Irttrprriff|cI HEK |承冏|云r “ 蟲mGWODliS - CKKW13J 电lBW.0 0*41 TO it?a33 ；*: 11E242739B10.MFT信息由四个文件组成分别是 $MFT, $MFTMirr, $LogFile, $Volume，结构是一个数据区，一个空区，再一个数据区共四个。直到$AttrDef为下一个扇区的数据，已经不是MFT信息，这后面的数据并没有受到USBC的修改选中从0C0000200到0

21、C0000E00的所有数据，按 ctrl+C复制定位到0C0000000,按ctlr+B填充Qffaet01Z 3q 5670 9A BCDEF刁占丨Fiie&rMtiffl：NTFSCODOOIOII1D46肝+C453DDD0300FR7435DZDCm0000FILED.rt5DC0DDDD1D 10001OD3E00aiaAO01DDEDOQ04aa00 C _ _ 0fa faL ：, :：0W0如他QQQQQU帕帥mQQUOQQQQQQfb r r r r r i i i i0CDDDDD3DI2k000000DDDDdoaa1000DDDD60oaao004-uwao1DCOOO

22、OlQ00DU1H00no00AO004H00an軸ia00u00Hretenes. dREtioaid wn1r*sDC00DD05D53ca69A6B92BCAaiSOOB69A6B92BCA01XEiJ 4-fi.XEi； j4.iRJtec nl Riubte- diT# spscrDCQDQDD6D關C03hhpg肋CA0150CQ&4Abpg2QI2A01XEi； e.Xti；E.Na-7旳切ocoDoonzu000000DDDDao0000DOODDDDCOQ00onDCnODDOBDoa00CD00DD01QGnonoDDDOanDConoa00COOOQDSDi0000nn0

23、0DDDDao0030noDDDDUE4iioi!aii.en 3r4uiAADCODDDDADaaoa18DDDDDDaa心ODDDCDIBoaaiDDJPhlCJlSdilor- 1619453lDCUOQDOBU050000000000050059CBMB32BCA01-羅XEi；:麗l； fg.瓠LejgieflJsedwl*.:DCODDDIKD53 翳C8H6969AbA6E9 刖2B 抻CA.CAai015600C640的0A6 軸耐042BCA ao0100rai scair371 GBOCDDDDDEDoa400000DDDDdOaa0600DDDOOO00000019.4-

24、3.224.CIGi 5?4mOCdOaDDFO04224a4D0046aaS4DOaoDO*oo00DOon-5.H.F.T07如 per dutef.4JJ沁0CDDDD1DD的0000on4&DDaaaa01004DDDDO0001001 aHa暉 TDtJldUslH-5-0 727.349DCDODDlin000000ODDDao00aaEF05DDDOno00aa001Bes per seclp5lSDCDOODJIZDi*30000000ODDDOG0000005FDDDO000000飢八3Kteraurt7T.S1B.7i7DCDDDD13Daa005FODDDDDoa0000

25、DD5FonDO00ao00Pl询闭2CDDQDKD3ZFO0500DOQC00FFBO00ODDD5fl000000ZCV. . . F .0CDDDD15D01004DODDD00asa00DDDDonOH0000DD-色DislmezQnr UTC+flfi.OO1DCOCD0U001DO00加帅4000UO叩00c00Baaanrr C r i MidisleiOCODDDJI7Doa2000DODDDDdoaaFO12DDDD01oaao00-.-_ - S *OflWeheaaaetimBocooaoi99e-q12no00帕00ddaa3101FFFF013101黑l.yyd店S

26、rtespef papt3Se16=512ocooDDig-n0165000160Ik77FFFFFFFFFFan000000心 uymw. 曙And卿工2DCOODDlAOaSO00OQDDaa00oa00BQDODDDCao000.1. I血&whdOw$2DCDDDD1BUan300000DDDDaa0031OBDDDDDC0001onalia JIli DCOOD01CQ0000OQ00泌0000aa01004DDDOC000500*-.M建CU00DWDQQ00nnDDDDDDcm00nn00ODDDOC000000acoDDDiin4Q0000ODDDDD00aa0010DDDDO

27、d000000色SKtor riZSUtfl ；r.r818 ?9TDCOOOOIFD03 00Ofsrt00a叩0000 00 00000DDDO00ZA00=1jBO曲200”I：0X帕FF 沁.Tsii di tk 工 JjitI di ck ,aiu 3D S4Ef dr -防屯 w曰 Q 甜斗卜11.将0C0000E00的数据改为空区的格式，即保留最后两位，其他位清零。按&ata Irterpreief | cRB趴钳1 时64申1 32BIW. *37ctrl+S保存修改 WinHn - IHmrdKJii!gdH-f pvtipn 蜀 e ooh $ipac|HEiiQptipn

28、i： 更pgw_*賈D序日爭Ef #i a ：& i mA*yA I +書畔Em-1 di ifc 3 ljiri dwk L!a ?u-LL4iti 3 13033B4 ；i*: Z7U2512ftafca Irtfrprricf |chUrddi$k2.PMtln 3 A&FM4ffl：NTFSOFFaet01Z 345e7n9ABcDEFDCOOQQEQD0000no0000DDao00no0000DDao0000nnDCDDDDLinaa00DDDDDDDDCIOaa0000DDEDDOaa0000g伽44滋懿 SUiemodfiedXOOQiOrESO00UQ000dQ000000QQ00UQuogo00DCDDDUE3Dmaa0000DDDDaaaa0000DDCDDAaaaa00IWWHwet LAidQrrwnes.2Nock Nln?000000140DOononanODaaonnoan0004anOBOCDODDE5Da000000DDDD00aa0000