运行中系统下引导扇区损坏及GPT/MBR被覆盖的数据恢复方案咨询

Oh no, that’s a terrifying spot to be in—but don’t hit that restart button yet! You’ve got a solid shot at recovering those disk headers because your running system’s kernel already has the full disk layout cached in memory. Here’s what you need to do step by step:

First and Foremost: Do NOT Restart #

This is non-negotiable. Once you reboot, the kernel loses all cached partition and header data, and you’ll lose your best chance to recover without advanced forensics. Keep the system running, and avoid any operations that might unmount your partitions.

For Linux Systems #

1. Export the Cached Partition Layout #

The kernel keeps track of your disk’s partition structure even if the on-disk headers are gone. Use these commands to save that critical info:

• Run sfdisk -d /dev/sdX > partition_backup.txt (replace /dev/sdX with your target disk, like /dev/sda). This will export a text file with every partition’s start sector, size, type ID, and other metadata directly from the kernel’s cache.
• You can also use blkid to get UUIDs and filesystem types for each partition, which will help verify the layout later: blkid > filesystem_info.txt

2. Backup the Damaged Header Region #

Before making any changes to the disk, back up the area that was overwritten to avoid making things worse:

dd if=/dev/sdX of=mbr_gpt_damaged_backup.img bs=1M count=32

This saves the first 32MB of the disk (which includes the MBR, GPT primary header, and partition entries) to a file.

3. Reconstruct the GPT/MBR Headers #

• If you’re using GPT, you can use gdisk to rebuild the headers using your exported partition layout:
  1. Run gdisk /dev/sdX
  2. Use the r command to enter recovery mode
  3. If the GPT backup header (usually at the end of the disk) wasn’t overwritten, use b to restore it. If it was, use the partition details from your backup file to manually recreate the entries and rebuild the primary header.
• For MBR, you can use sfdisk to reapply the partition layout:

  sfdisk /dev/sdX < partition_backup.txt
  

  Warning: Only do this if you’ve already backed up the damaged region and confirmed your partition layout is correct.

For Windows Systems #

1. Extract Cached Partition Data #

Open an elevated Command Prompt (Admin) and use these tools to get the partition layout from the kernel:

• Run diskpart, then:

  list disk
  select disk X  # Replace X with your disk number
  detail disk
  list partition
  detail partition Y  # For each partition Y
  

  Note down the starting offset, size, and type of each partition.
• You can also use WMIC to export this info to a file:

  wmic partition get deviceid, startingoffset, size, type > partition_details.txt
  

2. Backup the Damaged Area #

Use diskpart to get the disk’s sector size, then use a tool like Win32DiskImager to back up the first 32MB of the disk to an image file (this preserves the damaged state in case you need to roll back).

3. Rebuild Headers #

• You can use tools like TestDisk (run it in read-only mode first to verify) to scan the disk and detect partitions using the cached info, then write the recovered partition table back to the disk.
• Alternatively, use the diskpart command create partition primary offset=... size=... to manually recreate each partition using the details you noted, then assign drive letters and check if the filesystems are intact.

Critical Precaution: Backup Your Data First #

Before attempting to rebuild headers, prioritize copying your important files to an external drive. For Linux, use rsync or cp -a to clone mounted partitions. For Windows, use robocopy or drag-and-drop (avoid moving files, just copy them). This ensures even if header recovery fails, your data is safe.

备注：内容来源于stack exchange，提问作者help_i_fd_up