Yakanga iri 2019. Rabhoritari yedu yakagamuchira QUANTUM FIREBALL Plus KA drive ine huwandu hwe9.1GB, iyo isingawanzo kujairika panguva yedu. Sekureva kwemuridzi wedhiraivha, kutadza kwakaitika kumashure muna 2004 nekuda kwekukundikana kwemagetsi, iyo yakatora hard drive uye zvimwe zvikamu zvePC nazvo. Ipapo pakanga paine kushanya kune akasiyana masevhisi nekuyedza kugadzirisa dhiraivha uye kudzorera data, izvo zvisina kubudirira. Mune zvimwe zviitiko vakavimbisa kuti yaizova yakachipa, asi havana kumbogadzirisa dambudziko racho, mune vamwe raidhura zvakanyanya uye mutengi aisada kudzorera data, asi pakupedzisira dhisiki yakapfuura nepakati penzvimbo dzakawanda dzebasa. Yakarasika kakawanda, asi nekuda kwekuti muridzi wacho akachengetedza ruzivo rwekurekodha kubva kune zvakasiyana-siyana pane dhiraivha mberi, akakwanisa kuve nechokwadi chokuti hard drive yake yakadzorerwa kubva kune dzimwe nzvimbo dzebasa. Mafambiro acho haana kupfuura pasina tsvakiridzo, mitsetse yakawanda ye soldering yakaramba iri pabhodhi rekutanga controller, uye kushaikwa kwezvinhu zveSMD kwakanzwikawo nekuona (kutarisa kumberi, ndichataura kuti iyi ndiyo idiki yematambudziko eiyi drive).
Mupunga. 1 HDD Quantum Fireball Plus KA 9,1GB
Chinhu chekutanga chataifanira kuita kutsvaga mudura revanopa rekare kudaro mapatya eiyi drive ine inoshanda controller board. Pakapedzwa kutsvakwa uku, zvakave zvichikwanisika kuita matanho akakura ekuongorora. Mushure mekutarisa mamhepo emagetsi emhepo pfupi uye kuve nechokwadi kuti hapana dunhu rakapfupika, tinoisa bhodhi kubva kune donor drive kuenda kune murwere drive. Isu tinoshandisa simba uye tinonzwa yakajairika ruzha rweshaft ichitenderera kumusoro, ichipfuura bvunzo yekuenzanisa nekurodha iyo firmware, uye mushure memasekondi mashoma iyo drive inoshuma nemarejista kuti yakagadzirira kupindura kumirairo kubva kune interface.
Mupunga. 2 DRD DSC zviratidzo zvinoratidza kugadzirira kugamuchira mirairo.
Isu tinodzosera ese makopi e firmware module. Isu tinotarisa kuvimbika kweiyo firmware modules. Iko hakuna matambudziko ekuverenga mamodule, asi kuongororwa kwemishumo kunoratidza kuti pane zvimwe zvisinganzwisisike.
Mupunga. 3. Tafura yenzvimbo.
Isu tinoteerera kune zonal yekugovera tafura uye cherechedza kuti nhamba yemasilinda ndeye 13845.
Mupunga. 4 P-rondedzero (yekutanga runyorwa - runyorwa rwezvakaremara zvakaunzwa panguva yekugadzira kutenderera).
Isu tinokwevera kutarisa kune kushoma kwakawanda kwehurema uye nzvimbo yavo. Isu tinotarisa fekitori kukanganisa kuviga log module (60h) uye tinoona kuti haina chinhu uye haina imwe yekupinda. Zvichienderana neizvi, tinogona kufunga kuti mune imwe yenzvimbo dzakapfuura dzesevhisi, mamwe manipulations anogona kunge akaitwa nenzvimbo yebasa yedhiraivha, uye netsaona kana nemaune module yekune dzimwe nyika yakanyorwa, kana rondedzero yezvakaremara mune yekutanga. imwe yakacheneswa. Kuedza fungidziro iyi, tinogadzira basa muData Extractor ne "gadzira chikamu-ne-chikamu kopi" uye "gadzira chaiwo mushanduri" sarudzo dzakagoneswa.
Mupunga. 5 Task parameters.
Mushure mekugadzira basa, isu tinotarisa izvo zvinopinda muchikamu chetafura muchikamu zero (LBA 0)
Mupunga. 6 Master boot rekodhi uye tafura yekugovera.
Pakubvisa 0x1BE pane imwe yekupinda (16 bytes). Iyo faira system mhando pachikamu ndeye NTFS, yakagadziriswa kusvika pakutanga kwezvikamu zve 0x3F (63), chikamu chechikamu 0x011309A3 (18) zvikamu.
Muchikamu chemupepeti, vhura LBA 63.
Mupunga. 7 NTFS boot sector
Zvinoenderana neruzivo rwuri muchikamu chebhutsu chechikamu cheNTFS, tinogona kutaura zvinotevera: saizi yechikamu inogamuchirwa muvhoriyamu ndeye 512 bytes (izwi 0x0 (0) rakanyorwa pakubvisa 0200x512B), huwandu hwezvikamu musumbu 8 (byte 0x0 yakanyorwa pa offset 0x08D), ukuru hwesumbu 512x8 = 4096 bytes, rekodhi rekutanga reMFT rinowanikwa pachikamu chezvikamu 6 kubva pakutanga kwe diski (pakubvisa 291x519 quadruple izwi 0x30 0 00 00C 00 00 (00) nhamba yekutanga yeMFT cluster.Nhamba yechikamu inotarwa neformula: Cluster number * nhamba yezvikamu musumbu + offset kusvika pakutanga kwechikamu 0* 00+00= 786).
Ngatienderei kuchikamu 6.
Fig. 8
Asi iyo data iri muchikamu ichi yakasiyana zvachose kubva kuMFT rekodhi. Kunyangwe izvi zvichiratidza kuti shandurudzo ingangove isiriyo nekuda kwerondedzero isiriyo, hazviratidzi chokwadi ichi. Kuti tiwedzere kutarisa, tichaverenga dhisiki nezvikamu gumi mumativi ese ari maviri ane 10 zvikamu. Uye zvino tichatsvaga mataurirwo enguva dzose mune zvatinoverenga.
Mupunga. 9 Yekutanga MFT kurekodha
Muchikamu 6 tinowana yekutanga MFT rekodhi. Nzvimbo yaro inosiyana kubva kune yakaverengerwa imwe ne291 sectors, uye ipapo boka re551 rekodhi (kubva pa32 kusvika 16) rinoramba richitevera. Ngatipindei pachinzvimbo chechikamu 0 mutafura yekuchinja uye tienderere mberi nezvikamu makumi matatu nemaviri.
Fig. 10
Nzvimbo yerekodhi Nha. Ngatiitei tsvakiridzo yakafanana munzvimbo dzakatenderedza.
Mupunga. 11 MFT kupinda 0x00000011 (17)
Chikamu chikuru cheMFT chinoonekwa, kutanga nerekodhi nhamba 17 nehurefu hwe53 zvinyorwa) nekuchinja kwezvikamu zve646. Pachinzvimbo 17, isa shanduko ye +12 zvikamu mutafura yekuchinja.
Sezvo tasarudza nzvimbo yezvimedu zveMFT muchadenga, tinogona kugumisa kuti izvi hazviratidzike sekutadza kurongeka uye kurekodha kweMFT zvidimbu pane zvisiri izvo. Shanduro ine muturikiri asina kururama inogona kunzi yakasimbiswa.
Kuti tienderere mberi nekuisa nzvimbo dzekuchinja, isu tichaisa iyo yakanyanya kunaka yekusimuka. Kuti tiite izvi, tinoona kuti yakawanda sei mucherechedzo wekupedzisira wechikamu cheNTFS (kopi yechikamu chebhoti) inoshandurwa. Mumufananidzo wechinomwe, pakugadzirisa 7x0, izwi requadword ndiro kukosha kwechikamu che 28x0 00 00 00 00 01 13 A09 (2) zvikamu. Ngatiwedzerei kukanganisa kwekuparadzanisa pachako kubva pakutanga kwe diski kusvika pakureba kwayo, uye tinowana kugadziriswa kwekupedzisira NTFS marker 18 + 024 = 866. Sezvaitarisirwa, kopi inodiwa yebhoti sector yakanga isipo. Paunenge uchitsvaga nzvimbo yakapoteredza, yakawanikwa ine kuwedzera kwekuchinja kwe +18 sectors maererano nekupedzisira MFT fragment.
Mupunga. 12 Kopi yeNTFS boot sector
Isu tinoregeredza imwe kopi yebhoti chikamu pa offset 18, sezvo isina hukama nekupatsanurwa kwedu. Zvichienderana nezviitiko zvakapfuura, zvakaonekwa kuti mukati mechikamu mune zvinosanganisirwa zvezvikamu makumi matanhatu neimwe "zvakabuda" mukutepfenyura, izvo zvakawedzera data.
Isu tinoita kuverenga kwakazara kwedhiraivha, iyo inosiya makumi matatu nemana zvikamu zvisina kuverenga. Nehurombo, hazvibviri kuvimbisa nekuvimbika kuti ese akaremara akabviswa kubva kuP-rondedzero, asi mukuongororazve zvinokurudzirwa kufunga nezve chinzvimbo chavo, nekuti mune dzimwe nguva zvichave zvichigoneka kuona nekuvimbika nzvimbo dzekuchinja. kurongeka kwechikamu, uye kwete faira.
Mupunga. 13 Disiki kuverenga nhamba.
Basa redu rinotevera richava rekusimbisa nzvimbo dzinofungidzirwa dzekuchinja (kune chokwadi chefaira mavakaitika). Kuti tiite izvi, isu tichaongorora ese maMFT marekodhi uye kuvaka maketani enzvimbo dzefaira (zvimedu zvefaira).
Mupunga. 14 Maketani enzvimbo yemafaira kana zvidimbu zvawo.
Tevere, tichifamba kubva kune faira kuenda kune faira, tinotarisa iyo nguva ichave neimwe data panzvimbo yeinotarisirwa faira musoro, uye musoro unodiwa uchawanikwa neimwe shanduko yakanaka. Uye sezvatinokwenenzvera mashift point, tinozadza tafura. Mhedzisiro yekuizadza ichave pamusoro pe99% yemafaira pasina kukuvara.
Mupunga. 15 Rondedzero yemafaira emushandisi (mvumo yakagamuchirwa kubva kumutengi kuti ibudise iyi skrini)
Kuti ugadzire mapoinzi ekuchinja mumafaira ega, unogona kuita rimwe basa uye, kana iwe uchiziva chimiro chefaira, tsvaga inclusions yedata isina hukama nayo. Asi mubasa iri rakanga risingakwanisike mune zveupfumi.
PS Ndinodawo kutaura nevandinoshanda navo, mumaoko avo kare disc iri. Ndokumbira uchenjere paunenge uchishanda nesoftware firmware uye tsigira data sevhisi usati wachinja chero chinhu, uye usawedzera nemaune dambudziko kana iwe usingakwanise kubvumirana nemutengi pabasa.
Source: www.habr.com