EMC存储服务器数据恢复的思路整理

0x01 背景知识

  With few exceptions, disk drives are set to 512 bytes per block, and operating systems expect disks to be formatted to 512 bytes per block. In fact, some operating systems and/or disk controllers won’t even “see” disks that aren’t formatted to 512 bytes/block. Certain RAID controllers require disks to be formatted to 520 or 528 bytes/block. EMC, and NetApp are two vendors that format their disks to use these extra bytes. (Each Block written out to the disk is 520 bytes in size. Of the 520 bytes, 512 bytes is used to store the actual DATA written to the block. The remaining 8 bytes per block is used by the VNX/CLARiiON to store system information, such as a timestamp, parity information, checksum data.)

0x02 数据恢复步骤

步骤1： 制作硬盘镜像

Turbo On Block 0 100 
CopyIntoNewFile "D:\copy1.img" Save Turbo Off
1
2
3
4
5

待续~~

步骤2： 转换备份数据的扇区（520 to 512字节）

turbo on Assign FileSize  GetSize //ASSign Pagecount  ((FileSize%520) - 1) ASSign Pagecount 10 goto 0 read MyVariable 512 Create "D:\copy512.img" 0 write MyVariable
{
    nextobj
    move 8     read MyVariable 512     nextobj
    write MyVariable
}[Pagecount]
save
MessageBox "完成" turbo off
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

待续~~

步骤3： RAID重组

待续~~

[1] WinHex数据恢复工具常用关键字与脚本编写 
[2] WinHex数据恢复实用脚本 
[3] xls文件取证 
[4] 光纤硬盘520字节每扇区转换成512字节每扇区WinHex脚本 
[5] X-Ways Forensics&WinHex官方手册 
[6] WinHex API说明 
[7] EMC FC AX-4存储崩溃，raid5硬盘损坏的数据恢复过程 
[8] 使用WinHex脚本恢复尼康NEF文件 
[9] 用WinHex恢复删除的文件(NTFS文件系统) 
[10] WINHEX高级教程(困惑的浪漫－高志鹏） 
[11] Linux – Hard Drive – Sector size 512 / 520 bytes）