我被困在修复 NTFS 分区的问题中,我使用 MFT 备份恢复了它TestDisk 7.2-WIP在 Windows 7 上,即使如此,恢复的分区也已损坏。
在 Debian Linux 上应用说明 https://www.andreafortuna.org/dfir/how-to-extract-data-and-timeline-from-master-file-table-on-ntfs-filesystem/分析主文件表(和分析MFT.py)我可以获得硬盘的分区布局:
debian:~# mmls /dev/sdc
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
000: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001: ------- 0000000000 0000016063 0000016064 Unallocated
002: Meta 0000000063 0976773119 0976773057 Win95 Extended (0x0f)
003: Meta 0000000063 0000000063 0000000001 Extended Table (#1)
004: 001:000 0000016064 0976768064 0976752001 NTFS / exFAT (0x07)
005: ------- 0976768065 0976773167 0000005103 Unallocated
我感兴趣的是NTFS / exFAT (0x07)分区,从偏移量开始16064 但是它并没有显示该 inode 的内容,而是显示一个错误:
debian:~# icat -o 16064 /dev/sdc 0 > mft.raw
Cannot determine file system type
指定文件系统是徒劳的......
debian:~# icat -f ntfs -o 16064 /dev/sdc 0 > mft.raw
Invalid magic value (Not a NTFS file system (magic))
...甚至不是生的文件系统:
debian:~# icat -f raw -o 16064 /dev/sdc 0 > mft.raw
Function/Feature not supported (Illegal analysis method for raw data )
甚至磁盘管理说这是一个NTFS文件系统:
debian:~# fdisk -l /dev/sdc
Disk /dev/sdc: 465.8 GiB, 500107862016 bytes, 976773168 sectors
Disk model: 00LPVX-22V0TT0
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xa5eb893d
Device Boot Start End Sectors Size Id Type
/dev/sdc1 63 976773119 976773057 465.8G f W95 Ext'd (LBA)
/dev/sdc5 16064 976768064 976752001 465.8G 7 HPFS/NTFS/exFAT
ntfs修复最后对问题提供了一些见解:
debian:~# ntfsfix /dev/sdc5
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.
但我错了两次,校验甚至无法使用文件系统,它说这是一个生的文件系统:
C:\Windows\system32>chkdsk d: /f
The type of the file system is RAW.
CHKDSK is not available for RAW drives.
问题是:如何在不格式化分区的情况下将文件系统类型设置为 NTFS?