外地客户如不方便将要进行数据恢复的储存设备(如硬盘,U盘等)送到我们数据恢复中心,可以通过快递至我数据恢复中心。

使用PC-3000 Data Extractor怎么恢复$MFT位图上有坏扇区的数据?

Data Extractor supports following operations with map:
Data Extractor 支持以下位图操作:
– Merge (two) maps;
– 合并(二)位图
– Intersection (two) maps;
– 交集(二)位图
– Merge (two) maps without crossing;
– 合并位图不进行交叉
– Cut (another) map (from current);
– 剪切(其他)位图(到这里)
– Compress map;
– 精简位图
– Inversion map.
– 逆向位图

A map is a suite of sectors, which are contained in one file.
一个位图是一套扇区,它被包含在一个文件中。
We can describe operations with maps by schemes:
我们可以描述位图与方案的操作:
The Merge maps is the set of all sectors that are members of either one map or other.
合并位图是一组或者一张或者全部扇区的集合

The intersection of maps is the set of all sectors that are members of both maps.
位图的交集是两个位图的所有扇区的成员集合。
Merge maps without crossing is the set of all sectors that are members of either one map or other but not of both maps.
合并位图不进行交叉是所有扇区的一组,无论是一个位图或其他,但不是这两个位图的交集。
Cut (another) map (from current) is the set of all sectors that are members of (current) map but not members of (another) map.
剪切(另一)位图(从当前)是所有的扇区,都是(当前)位图的成员,但不是成员(另一)位图。
Inversion map is the set all sectors that are not members of current map.
逆向位图是一组不是当前位图的所有扇区的集合。

Bad sectors in MFT map
MFT位图上有坏道是硬盘数据恢复时经常遇到的问题

We have received on-and-off cases where some files are lost due to bad sectors in MFT map. Partition analysis doesn’t help in these cases.
Only way to get data is RAW recovery, but there is one problem: we don’t know where to search these lost files.

We can build two maps:
1. Used sectors map (from Bitmap). NTFS is a journaling file system and uses the Bitmap ($Bitmap) to record whether its corresponding cluster is used (allocated) or free (available for allocation). So we can build map from Bitmap.
2. Map of Root folder. This map indicates all files are shown in Explorer of Data Extractor.

Usually the second map is little less that the first one. In our case there is big difference due to lost files.

There is detailed procedure how to get this map:
1. Build map of Root

2. Save it file 保存文件

3. Come back to Explorer and build used sectors map from Bitmap

4. Cut the map 选择位图

5. Run RAW recovery

转载请注明:成都千喜数据恢复中心 » 使用PC-3000 Data Extractor怎么恢复$MFT位图上有坏扇区的数据?

喜欢 (7)or分享 (0)

您必须 登录 才能发表评论!

(1)个小伙伴在吐槽
  1. 谢谢分享,对我帮助很大。
    kk6012018-04-24 14:46
顶部 电话 微信
微信号:18328458868
QQ 地图 底部