FAT32被格式化成NTFS后数据恢复的研究

Research for Recovering Data after the Logic Disk for FAT32 was Formatted into NTFS

摘要: 逻辑盘被格式化后,数据能否恢复取决于格式化操作对原来文件系统中所存储数据的破坏程度。该文以Windows XP为平台、WinHex 15.08为分析工具,将FAT32文件系统格式化成NTFS文件系统后,对被破坏的FAT32文件系统结构进行分析,提出了恢复格式化前FAT32文件系统全部数据的基本思路、方法与步骤。实验结果表明,将FAT32文件系统格式化成NTFS文件系统后,只要恢复被破坏的FAT32_DBR,除部分被NTFS文件系统元文件覆盖的数据无法恢复外,其他未覆盖的数据均可全部恢复。

Abstract: After logical disk was formatted,the data can be restored depends on the original format fo the operation of the data stored in the file system to destory the extent.In this paper,the Windows XP is used as the platform,and WinHex 15.08 is used as the analysis tool,the logic disk for FAT32 file system would be formatted into NTFS file system,and the destoryed FAT32 file system structure is analyzed.Put forward the basic idea,methods and steps of recovering the entire data of formatted FAT32 files system.The results of experiment indicate that after the FAT32 file system is formatted as an NTFS file system,as long as the corrupted FAT32_DBR is restored,the data that is partially covered by the NTFS file system metafile can not be recovered,and other uncovered data can be completely recovered.