Data recovery base – 8. InsPro Disk and Winhex software tools

1.4 tools

"We must first sharpen his tools." In working with the research process of data recovery, the inevitable need to use the software with different functions. Here, we first introduce several software tools for use in the learning process at the reader.

1.4.1 Virtual Disk software InsPro Disk

In the process of learning and research disk data structures, often need to explore the law, lessons learned through a lot of experiments. If all use real disk, first, not everyone will have a lot of disk hands, moreover it is not easy. Therefore, there is a handy virtual disk software is particularly important. Here, we introduce a more practical software InsPro Disk virtual disks to the reader.

After InsPro Disk software is installed, you can run two programs shortcuts appear in the Programs menu, one is "DiskCreator", another is "InsPro Disk Loader", here we introduce them separately.

1. DiskCreator

DiskCreator used to create a virtual disk, click Run after having created a virtual disk dialog box shown in Figure 1.9.

In creating a virtual disk dialog box, click the Browse button to select a virtual disk file storage path and file name extension by default ". Hdd". Here we create a name for the "shiyan" virtual disk. Enter Virtual Hard Disk Size text box to create a virtual disk size, the default unit is MB.

When you click the Create button to create a successful program will prompt, click the OK button to exit Exit. At this point, we can see in the save path selection has generated a virtual disk file, as shown in Figure 1.10.

Now, it's just a file, only the latter will be loaded into a disk. Loading and unloading virtual disk using InsPro Disk Loader program.

2. InsPro Disk Loader

InsPro Disk Loader for loading and unloading the virtual disk. After the operation, the dialog box will pop up disk loading and unloading. Click the Browse button to specify the path to the virtual disk file, and then click the Load / Unload button to load all the way to determine success, shown in Figure 1.11.

Figure 1.9 Figure 1.10 Figure 1.11 Load Virtual Disk

Right-click on the desktop "My Computer" in the shortcut menu, select "Manage" → "Disk Management" command, then initialize the disk wizard will pop up dialog box shown in Figure 1.12. This is because the Disk Management program detects the new disk, but found it "uninitialized" Those who wish to initialize operation.

Figure 1.12 Initialize Disk Wizard

Note that the need to protect the data on the disk, remember to click the "Cancel" button, because the initialization be accountable to the number 0 sector write code.

Then, you can see more than one disk management disk, shown in Figure 1.13.

Figure 1.13 Virtual Disk

1.4.2 Hex editing software Winhex

Winhex is a hex editing software disk under Windows, can be edited directly from the bottom to access the disk, and the disk contents, but also can be edited on the memory. With the upgraded version, more powerful. In addition, its data recovery capabilities also continue to improve, not only can perform basic data recovery, but also the reorganization array of RAID data recovery. Here we introduce it simple, for the convenience of the reader new to Winhex, we first finished version to its introduction as an example. But later chapters, more perfect than the English version will feature a new version is mainly used objects.

1. The main interface

Open Winhex, in the "Start Center" screen, click "Disk Editor" button (some versions may be translated as " open disk " ), or turn on the main interface, select "Disk Editor" tool button "Start Center" , as shown in 1.14.

Figure 1.14 Start Center

In the dialog box, select the "physical media" in the hard drive, you can open the physical disk. At this time, Winhex all sectors of the contents of the entire physical disk in hexadecimal form presented in front of us. In the disk interface 512 bytes per block was divided into a sector of each block, shown in Figure 1.15.

Figure 1.15 Winhex displayed in the disk sector

Figure 1.16 Schematic offset

We go back to Figure 1.15, on the main interface Winhex a brief introduction:

_{The largest part of the middle hexadecimal display area, display the corresponding position in the disk contents stored in hexadecimal form.}

_{Text character area on the right shows the contents of the corresponding characters according to the type of character code form.}

_{Offset Offset ordinate and the abscissa to the left of the top to form a two-dimensional coordinate plane, plus the value of the abscissa ordinate value can be uniquely positioned to any location within the region hex, this value is absolute offset corresponding position, that is, relative to the disk first byte}_-_offset_0x00_{bytes of displacement. You can use the mouse to click on the vertical axis zone offset to convert to achieve offset displayed in hexadecimal and decimal.}

_{Lower left corner of the interface "}_{Sector 1 of 312,581,808}_{"is now in a position, said}_one_{number of sectors, the disk, a total of}_312581808_{sectors, numbered from}₀_{to start until}_312,581,807_.

_{"Offset" to the right of the display will be synchronized to the absolute position of the pointer offset tap.}

2 would be interpreted as disk mirroring

Winhex also supports directly open an image file, then the file will be interpreted as a disk.

(1) Select the image file you want to open. As shown in Figure 1.17, click the Tools button to open the file in Figure shown you can select the file path window appears, select the window you want to open the image file you can open it.

Figure 1.17 Open File tool button

(2) will be interpreted as a disk image file. After the file is open, select "Private" → "interpreted as a disk image file" menu command, you can directly open a disk reaches the same effect, as shown in Figure 1.18.

Figure 1.18 will be interpreted as a disk file

3. Making a disk image

Winhex can also be used to make the sector level disk mirroring. "Sector-level mirroring" is different from what we usually use Ghost software made "mirror", Ghost based on logic level mirrored file system exists only for the purpose of data operations. Sector-level mirroring is a "complete clone" approach, that is, from the physical sector level be copied to the sector on the original disk, resulting in an identical copy of the original disc, including the terms of the file system is not being used The free area is copied together. In this book, unless otherwise specified, "mirror" refer to this sector-level image.

(1) Open Winhex, select "Tools" → "Disk Utility" → "Clone Disk" menu command, you can pop up the "Clone Disk" Settings dialog box, shown in Figure 1.19, as shown in Figure 1.20.

Figure 1.19 Clone Disk menu

Clone Disk Settings dialog box in Figure 1.20

(2) select the image source. "Source: media" refers to going to be the source disk or file mirroring, under normal circumstances are mirrored disk, so choose the button on the left side of the disk , it will pop up the "Select Disk" dialog box, you can choose according to different situations is made for a single logical disk mirroring or physical conduct of a mirror, as shown in Figure 1.21.

Figure 1.21 Select Source Disk

(3) Select the mirror target. Choose a good source disk, you can select "Target: The original image file" button in the left column of the disk clone disk to disk, you can select the right of the File button to save the file into a mirror.

4 Clear Disk Data

The reason the operating system on the disk is formatted, the data delete operation is not completely clear the data, which is likely to be restored data resides. But sometimes due to various reasons need to be completely clear of data, such as classified equipment to non-classified equipment, office equipment scrapped. Winhex provided us with data on the disk completely clear function, a direct destruction of documents, and the other is for disk underfill. Here we take a look at how to fill all bytes through the bottom of all data on one disk thorough cleanup.

(1) Select the starting position. On the first byte sector 0 right-click on the shortcut menu, select "Select block start" command, as shown in Figure 1.22.

Figure 1.22 Select block start

(2) select the end position. Then pull the scroll bar to the last sector of the disk, right-click on the last byte in the shortcut menu, select "Select block end" command, as shown in Figure 1.23.

(3) set the parameters. Then, choose the block between the beginning and the end part will use a preset color display, which means that is selected. Right-click in the selected area, the shortcut menu, select "Fill election block" command, as shown in Figure 1.24.

igure 1.23 End Select block

Figure 1.24 blocks filled with election

Pop-up "Fill election block" dialog box, select "filled with the hexadecimal value" (the default), the default "00" to fill, you can also specify any hexadecimal value, you can also select "filled with random bytes "At this time no law will be used to fill values. Here, we fill "in the numerical box 26 ", and then click the" OK "button, as shown in Figure 1.25.

Figure 1.25 "Fill election block" dialog

Began to fill. In the pop-up dialog boxes are all warnings, click the "OK" button, which began filling, filling the entire disk after each byte is displayed as hexadecimal "26", which reached the original disk to the All data for the purpose of removal.

5 Data Interpreter

Winhex have a "data interpreter" function, very practical, you can see directly the decimal value of hexadecimal numbers. Select the menu "View" → "Display" → "Data Interpreter" brings up a window data interpretation can click on the pointer to convert hexadecimal values directly. The default data storage order is Little-endian, if the object of the analysis is based on Big-endian order of storage, you can right-click on the data interpreter window, and then on the shortcut menu, select "Big-endian" or "big bit sequence "can, as shown in Figure 1.26.

Figure 1.26 Data Interpreter

1 2 NextPage

<< Data recovery base – 9. MHDD software tools >>Data recovery base – 7. “Number” experience

Check all comments