备份MBR的分区表,并破坏后恢复
方案1
用hexdump -C /dev/sda -n 512查看分区表前512字节
通过修改分区表修改如图的64个字节来达到破坏效果
前512字节中最后的64个字节
80 04 |..........Y+....|
000001c0 01 04 83 fe c2 ff 00 08 00 00 00 00 20 00 00 fe |............ ...|
000001d0 c2 ff 83 fe c2 ff 00 08 20 00 00 00 40 06 00 fe |........ ...@...|
000001e0 c2 ff 82 fe c2 ff 00 08 60 06 00 00 40 00 00 fe |........`...@...|
000001f0 c2 ff 05 fe c2 ff 00 08 a0 06 00 f8 5f 12
[root@centos8 ~]#lsblk
#查看分区表
[root@centos8 ~]#hexdump -C /dev/sda -n 512
#备份MBR分区表
[root@centos8 ~]#dd if=/dev/sda of=/data/dpt.img bs=1 count=64 skip=446
[root@centos8 ~]#scp /data/dpt.img 10.0.0.102:
#破坏MBR分区表
[root@centos8 ~]#dd if=/dev/zero of=/dev/sda bs=1 count=64 seek=446
[root@centos8 ~]#hexdump -C /dev/sda -n 512
#无法启动
[root@centos8 ~]#reboot
重启后报错的界面
步骤
-
先确保鼠标在VMware界面里
-
重启进入进度条时,按一次Esc键(两次会退出)
-
-
根据提示先按1回车再按enter即可
-
#配置网络 #ip a #ip a a 10.0.0.8/24 dev ens160 #复制前面拷贝的另一主机上的dpt.img文件 #scp 10.0.0.102:/root/dpt.img . #恢复MBR分区表 #dd if=dpt.img of=/dev/sda bs=1 seek=446 #reboot
方案2
这次是破坏分区表第510到512的标记位(图中最后的55 aa)最后能够恢复数据
[root@centos8mini ~]# hexdump -C /dev/sda -n 512 -v
00000000 eb 63 90 10 8e d0 bc 00 b0 b8 00 00 8e d8 8e c0 |.c..............|
00000010 fb be 00 7c bf 00 06 b9 00 02 f3 a4 ea 21 06 00 |...|.........!..|
00000020 00 be be 07 38 04 75 0b 83 c6 10 81 fe fe 07 75 |....8.u........u|
00000030 f3 eb 16 b4 02 b0 01 bb 00 7c b2 80 8a 74 01 8b |.........|...t..|
00000040 4c 02 cd 13 ea 00 7c 00 00 eb fe 00 00 00 00 00 |L.....|.........|
00000050 00 00 00 00 00 00 00 00 00 00 00 80 01 00 00 00 |................|
00000060 00 00 00 00 ff fa 90 90 f6 c2 80 74 05 f6 c2 70 |...........t...p|
00000070 74 02 b2 80 ea 79 7c 00 00 31 c0 8e d8 8e d0 bc |t....y|..1......|
00000080 00 20 fb a0 64 7c 3c ff 74 02 88 c2 52 be 05 7c |. ..d|<.t...R..||
00000090 b4 41 bb aa 55 cd 13 5a 52 72 3d 81 fb 55 aa 75 |.A..U..ZRr=..U.u|
000000a0 37 83 e1 01 74 32 31 c0 89 44 04 40 88 44 ff 89 |7...t21..D.@.D..|
000000b0 44 02 c7 04 10 00 66 8b 1e 5c 7c 66 89 5c 08 66 |D.....f..\|f.\.f|
000000c0 8b 1e 60 7c 66 89 5c 0c c7 44 06 00 70 b4 42 cd |..`|f.\..D..p.B.|
000000d0 13 72 05 bb 00 70 eb 76 b4 08 cd 13 73 0d 5a 84 |.r...p.v....s.Z.|
000000e0 d2 0f 83 de 00 be 85 7d e9 82 00 66 0f b6 c6 88 |.......}...f....|
000000f0 64 ff 40 66 89 44 04 0f b6 d1 c1 e2 02 88 e8 88 |d.@f.D..........|
00000100 f4 40 89 44 08 0f b6 c2 c0 e8 02 66 89 04 66 a1 |.@.D.......f..f.|
00000110 60 7c 66 09 c0 75 4e 66 a1 5c 7c 66 31 d2 66 f7 |`|f..uNf.\|f1.f.|
00000120 34 88 d1 31 d2 66 f7 74 04 3b 44 08 7d 37 fe c1 |4..1.f.t.;D.}7..|
00000130 88 c5 30 c0 c1 e8 02 08 c1 88 d0 5a 88 c6 bb 00 |..0........Z....|
00000140 70 8e c3 31 db b8 01 02 cd 13 72 1e 8c c3 60 1e |p..1......r...`.|
00000150 b9 00 01 8e db 31 f6 bf 00 80 8e c6 fc f3 a5 1f |.....1..........|
00000160 61 ff 26 5a 7c be 80 7d eb 03 be 8f 7d e8 34 00 |a.&Z|..}....}.4.|
00000170 be 94 7d e8 2e 00 cd 18 eb fe 47 52 55 42 20 00 |..}.......GRUB .|
00000180 47 65 6f 6d 00 48 61 72 64 20 44 69 73 6b 00 52 |Geom.Hard Disk.R|
00000190 65 61 64 00 20 45 72 72 6f 72 0d 0a 00 bb 01 00 |ead. Error......|
000001a0 b4 0e cd 10 ac 3c 00 75 f4 c3 00 00 00 00 00 00 |.....<.u........|
000001b0 00 00 00 00 00 00 00 00 db d3 59 2b 00 00 80 04 |..........Y+....|
000001c0 01 04 83 fe c2 ff 00 08 00 00 00 00 20 00 00 fe |............ ...|
000001d0 c2 ff 83 fe c2 ff 00 08 20 00 00 00 40 06 00 fe |........ ...@...|
000001e0 c2 ff 82 fe c2 ff 00 08 60 06 00 00 40 00 00 fe |........`...@...|
000001f0 c2 ff 05 fe c2 ff 00 08 a0 06 00 f8 5f 12 55 aa |............_.U.|
#破坏MBR分区表
[root@centos8 ~]#dd if=/dev/zero of=/dev/sda bs=1 count=2 seek=510
#查看
[root@centos8 ~]#hexdump -C /dev/sda -n 512
#仅仅破坏标记位依然显示未分区
[root@centos8 ~]#fdisk -l /dev/sda
Disk /dev/sda: 200 GiB, 214748364800 bytes, 419430400 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
#创建名为55aa二进制文件输入2个区块数对应分区表的55aa标记位
[root@centos8 ~]#dd if=/dev/zero of=55aa bs=1 count=2
#查看55aa文件
[root@centos8 ~]#hexdump -C 55aa
00000000 00 00 |..|
00000002
#编辑55aa
[root@centos8 ~]#vim -b 55aa
-
#进入底行模式 shift 键和 ; 键
-
输入 %xxd 将文件转换为可读的十六进制文件
- 将命令中的0000改为如图55aa,
- 再进入底行模式输入 %!xxd -r 加粗样式返回格式,再在低行模式输入wq保存退出
#55aa文件输出到分区表对应位置
[root@centos8 ~]#dd if=55aa of=/dev/sda bs=1 count=2 seek=510
#查看
[root@centos8 ~]#hexdump -C -n 512 /dev/sda
#可以显示分区
[root@centos8 fdisk -l /dev/sda
```bash
d if=55aa of=/dev/sda bs=1 count=2 seek=510
#查看
[root@centos8 ~]#hexdump -C -n 512 /dev/sda
#可以显示分区
[root@centos8 fdisk -l /dev/sda