时间戳

首页 > 解决方案 > Windows分区期间的数据丢失| 最重要的验尸工具

data-recovery - Windows分区期间的数据丢失| 最重要的验尸工具

问题描述

我目前正在处理丢失 320gb 的数据。在安装windows的过程中，我不小心删除了一个分区（目前处于“未分配空间”状态）请看示例图。

我尝试了 Autopsy 和 Foremost，但两者都没有检测到此 SATA HHD 上的任何数据。有什么建议可以继续吗？

磁盘没有被触及，并且在该操作之后没有做任何事情

数据丢失阶段

标签： data-recovery

解决方案

You have to recreate partition table. To do that you have to find where your deleted partition(s) started with some hex editor, write down where they start and then create new partition table.

Your picture says you're under windows. If partition is windows then it will start like this (hexdump -C of first 8 bytes):

00000000  eb 52 90 4e 54 46 53 20                           |.R.NTFS |

which you can use as search pattern.

I would advise to create new partition table under linux as you can quickly check your work with mount. Unless you have some magical tools for windows. You can use any live linux you like (here is small list with desriptions) even in virtual box.

推荐阅读