电子取证中主分区表的手工恢复技术研究

Study on the Manual Recovery Technology of Primary Partition Table in Electronic Forensics

在电子取证的教学中,对硬盘的分区结构进行分析和研究,提出一种手工恢复主分区表的方法,利用DBR扇区和EBR扇区中有关分区的冗余信息,获取分区的起始位置、大小等信息,从而重建主分区表。通过对分区连续的硬盘主分区表的恢复实验,证明该方法可行。文章最后提出了研究工作下一步的重点。

Through the analysis and research of the hard disk partition structure in the teaching of electronic forensics,this paper puts forward a manual way to restore the primary partition table.By computing the size and starting position of partition and using the formation of DBR and EBR,we can rebuild the primary partition table.The recovery experiment of the partition table on partition continuous hard disk has proved that the method is right.the article concludes with a research focus on the next step.