使用PC-3000 Data Extractor硬盘数据恢复是发现数据偏移怎么办？

本文是成都数据恢复中心关于在硬盘数据恢复时数据偏移在PC-3000 Data Extractor实用程序中的修复方法。
This article is not about a cooperative platformer, even not about popular racing video game. It’s about shifted data and method for fixing it in PC-3000 Data Extractor utility.

通常，您已经修复了驱动器并获得了访问用户区域的权限。
As usually you have fixed the drive and got an access to the users area.

您在数据提取器中创建新任务，展开一个分区，但该分区为空。
You create new task in the Data Extractor, expand a partition(s) but it’s empty.

如何进行？ –是的，请使用“快速磁盘分析”并尝试查找分区，还检查填充图过程，也许某些扇区无法读取…
How to proceed? – yes, use a Quick disk analysis and try to find a partitions, also check a filling map process, maybe some sectors can’t be read…

但成都数据恢复中心采用的是另一种方法
But we are follow other method:

开LBA 0并像检查分区表一样检查MBR
Open LBA 0 and check MBR like a Partition table

正如我们看到的，这个驱动器只有一个分区，应该从LBA 2048开始，但是这个LBA是空的
As we can see this drive have only 1 partition which is should start from LBA 2048, but this LBA is empty:

让我们使用RAW恢复并尝试查找该分区的启动：
Let’s use a RAW recovery and try to find Boot of this partition:

找到了引导，但是它在LBA 2056中，所以我们可以从这个找到的引导中添加一个分区，然后使用鼠标右键添加虚拟分区
Boot is found but it’s in LBA 2056, so we can add a partition from this found Boot, use right mouse button then “Add virtual partition”:

好的，我们得到了一个完整的分区，其中包含结构和文件：
Ok, we got a full partition with structure and files inside:

我们开始读取数据并保存文件，但是只能打开很少的文件，而其他文件则已损坏。该怎么办？..
We are start to read a data and save a files, but only few files can be open, but other are corrupted. What to do?..

如您所知，每个文件都有一个签名，例如JPEG图像在文件的第一个扇区中具有“ JFIF”或“ EXIF” ASCII文本（您可以在“ HEX”选项卡中看到）：
As you know each file have a signature, for example JPEG-images have “JFIF” or “EXIF” ASCII text in the first sector of file (you can see it in HEX tab):

但是并不是所有的jpeg文件都有一个正确的签名，我们在文件夹里的文件由ABA排序，看到所有的图像(然后和所有其他文件)有一个错误的签名来自大约1亿lba
But not all JPEG-files have a correct signature, we are sort files in folder by ABA and see that all images (then and all other files too) have a wrong signature from approx 100 million LBAs :

这就是文件损坏的原因。分区是展开一个文件列表，其中包含文件位置、第一个LBA和每个文件的长度等信息，但实际上这些文件的主体是垃圾数据，整个用户从一个LBA转移到用户区域的末尾。
That’s why files are corrupted. Partition is expand a list of files with info about file location, first LBA and lenght of each file, but actually body of these files is garbage data and whole user are is shifted from one LBA till the end of user area. Drive can have few shifts in different places…

So, what to do?

首先需要在数据提取器中使用活动选项“创建虚拟翻译器”创建新任务：
Firstly need to create new task in Data Extractor with active option “Create virtual translator”:

然后将有可用的工具来手动添加班次。创建任务后，需要像上面一样扩展分区，并找到一个包含JPEG图像的文件夹（例如家庭照片档案）。
Then will be available tools for manually adding shifts. After task creation process need to expand a partition as we did above and find a folder with JPEG-images (for example family photo archive).

注意：对于此过程，您可以使用具有已知签名的任何其他文件。例如JPEG，PNG，TIFF，ZIP等。
Note: for this procedure you can use any other files with known signature. For example JPEG, PNG, TIFF, ZIP etc..

例如这个文件夹
For example this folder:

具有移位的第一个文件从111 889 848 LBA开始，如果尝试将其打开–它将被损坏，但此文件的整个扇区映射都可以。
First file with shift start from 111 889 848 LBA, if try to open it – it will be corrupted, but whole sectors map of this file is OK.

然后，我们需要找到该文件开始的原始LBA。
Then we need to find an original LBA where this file is start.

启动RAW恢复后退了大约一百万个LBA。在这种情况下，我们从111000万LBA开始搜索，并在111945152 LBA中找到JPEG文件
Launch a RAW recovery stepped back approx 1 million LBAs. In this case we start to search from 111 000 000 LBA and found JPEG-file at 111 945 152 LBA:

111 945 152 LBA – 111 889 848 LBA = 55 304 LBA

因此，我们得到55304是一个偏移值（扇区数）。
So, we got that 55 304 is a shift value (number of sectors).

返回分区，并通过“ Shifts”工具将此值添加为该JPEG文件的shift
Return back in the partition and add this value as shift for this JPEG file by “Shifts” tool:

结果，我们修复了从该LBA到下一个偏移（如果驱动器上很少偏移）的文件的签名。
As result we fixed signature for files from this LBA till the next shift (if there are few shifts on the drive).

因此，文件是正确的并且可以打开：
So, file is correct and can be open:

然后需要检查从此文件到用户区末尾的其他文件。
Then need to check a different files from this file till end of user area.

查看文件夹并检查从当前LBA到结束的每个文件中的签名，尝试查找有问题的文件（文件的第一个LBA中有错误），找到原始的第一个LBA并添加一个移位点。
Take a look in folders and check a signatures in each file from current LBA till the end, try to find a problem file (with garbage inside first LBA of file), find an original first LBA and add a shift point.

因此，该方法允许修复一个移位问题，并保存一个具有正确数据的文件。
As result this method allow to fix a shift problems and save a file with correct data.

因此，这里是当前任务中的转换列表
So, here is a list of shifts in the current task: