两种MBR分区表恢复方法

备份MBR的分区表，并破坏后恢复

方案1

用hexdump -C /dev/sda -n 512查看分区表前512字节
通过修改分区表修改如图的64个字节来达到破坏效果

前512字节中最后的64个字节

 80 04  |..........Y+....|
000001c0  01 04 83 fe c2 ff 00 08  00 00 00 00 20 00 00 fe  |............ ...|
000001d0  c2 ff 83 fe c2 ff 00 08  20 00 00 00 40 06 00 fe  |........ ...@...|
000001e0  c2 ff 82 fe c2 ff 00 08  60 06 00 00 40 00 00 fe  |........`...@...|
000001f0  c2 ff 05 fe c2 ff 00 08  a0 06 00 f8 5f 12

[root@centos8 ~]#lsblk

#查看分区表
[root@centos8 ~]#hexdump -C /dev/sda -n 512

#备份MBR分区表
[root@centos8 ~]#dd if=/dev/sda of=/data/dpt.img bs=1 count=64 skip=446
[root@centos8 ~]#scp /data/dpt.img 10.0.0.102:

#破坏MBR分区表
[root@centos8 ~]#dd if=/dev/zero of=/dev/sda bs=1 count=64 seek=446
[root@centos8 ~]#hexdump -C /dev/sda -n 512

#无法启动
[root@centos8 ~]#reboot

重启后报错的界面

步骤

• 先确保鼠标在VMware界面里

• 重启进入进度条时，按一次Esc键（两次会退出）
  

• 

• 
  

• 

• 根据提示先按1回车再按enter即可

• 

• #配置网络
  #ip a
  #ip a a 10.0.0.8/24 dev ens160
  
  #复制前面拷贝的另一主机上的dpt.img文件
  #scp 10.0.0.102:/root/dpt.img .
  
  #恢复MBR分区表
  #dd if=dpt.img of=/dev/sda bs=1 seek=446
  #reboot
  

方案2

这次是破坏分区表第510到512的标记位（图中最后的55 aa）最后能够恢复数据

[root@centos8mini ~]# hexdump -C /dev/sda -n 512  -v
00000000  eb 63 90 10 8e d0 bc 00  b0 b8 00 00 8e d8 8e c0  |.c..............|
00000010  fb be 00 7c bf 00 06 b9  00 02 f3 a4 ea 21 06 00  |...|.........!..|
00000020  00 be be 07 38 04 75 0b  83 c6 10 81 fe fe 07 75  |....8.u........u|
00000030  f3 eb 16 b4 02 b0 01 bb  00 7c b2 80 8a 74 01 8b  |.........|...t..|
00000040  4c 02 cd 13 ea 00 7c 00  00 eb fe 00 00 00 00 00  |L.....|.........|
00000050  00 00 00 00 00 00 00 00  00 00 00 80 01 00 00 00  |................|
00000060  00 00 00 00 ff fa 90 90  f6 c2 80 74 05 f6 c2 70  |...........t...p|
00000070  74 02 b2 80 ea 79 7c 00  00 31 c0 8e d8 8e d0 bc  |t....y|..1......|
00000080  00 20 fb a0 64 7c 3c ff  74 02 88 c2 52 be 05 7c  |. ..d|<.t...R..||
00000090  b4 41 bb aa 55 cd 13 5a  52 72 3d 81 fb 55 aa 75  |.A..U..ZRr=..U.u|
000000a0  37 83 e1 01 74 32 31 c0  89 44 04 40 88 44 ff 89  |7...t21..D.@.D..|
000000b0  44 02 c7 04 10 00 66 8b  1e 5c 7c 66 89 5c 08 66  |D.....f..\|f.\.f|
000000c0  8b 1e 60 7c 66 89 5c 0c  c7 44 06 00 70 b4 42 cd  |..`|f.\..D..p.B.|
000000d0  13 72 05 bb 00 70 eb 76  b4 08 cd 13 73 0d 5a 84  |.r...p.v....s.Z.|
000000e0  d2 0f 83 de 00 be 85 7d  e9 82 00 66 0f b6 c6 88  |.......}...f....|
000000f0  64 ff 40 66 89 44 04 0f  b6 d1 c1 e2 02 88 e8 88  |d.@f.D..........|
00000100  f4 40 89 44 08 0f b6 c2  c0 e8 02 66 89 04 66 a1  |.@.D.......f..f.|
00000110  60 7c 66 09 c0 75 4e 66  a1 5c 7c 66 31 d2 66 f7  |`|f..uNf.\|f1.f.|
00000120  34 88 d1 31 d2 66 f7 74  04 3b 44 08 7d 37 fe c1  |4..1.f.t.;D.}7..|
00000130  88 c5 30 c0 c1 e8 02 08  c1 88 d0 5a 88 c6 bb 00  |..0........Z....|
00000140  70 8e c3 31 db b8 01 02  cd 13 72 1e 8c c3 60 1e  |p..1......r...`.|
00000150  b9 00 01 8e db 31 f6 bf  00 80 8e c6 fc f3 a5 1f  |.....1..........|
00000160  61 ff 26 5a 7c be 80 7d  eb 03 be 8f 7d e8 34 00  |a.&Z|..}....}.4.|
00000170  be 94 7d e8 2e 00 cd 18  eb fe 47 52 55 42 20 00  |..}.......GRUB .|
00000180  47 65 6f 6d 00 48 61 72  64 20 44 69 73 6b 00 52  |Geom.Hard Disk.R|
00000190  65 61 64 00 20 45 72 72  6f 72 0d 0a 00 bb 01 00  |ead. Error......|
000001a0  b4 0e cd 10 ac 3c 00 75  f4 c3 00 00 00 00 00 00  |.....<.u........|
000001b0  00 00 00 00 00 00 00 00  db d3 59 2b 00 00 80 04  |..........Y+....|
000001c0  01 04 83 fe c2 ff 00 08  00 00 00 00 20 00 00 fe  |............ ...|
000001d0  c2 ff 83 fe c2 ff 00 08  20 00 00 00 40 06 00 fe  |........ ...@...|
000001e0  c2 ff 82 fe c2 ff 00 08  60 06 00 00 40 00 00 fe  |........`...@...|
000001f0  c2 ff 05 fe c2 ff 00 08  a0 06 00 f8 5f 12 55 aa  |............_.U.|

#破坏MBR分区表
[root@centos8 ~]#dd if=/dev/zero of=/dev/sda bs=1 count=2 seek=510

#查看
[root@centos8 ~]#hexdump -C /dev/sda -n 512

#仅仅破坏标记位依然显示未分区
[root@centos8 ~]#fdisk -l /dev/sda
Disk /dev/sda: 200 GiB, 214748364800 bytes, 419430400 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

#创建名为55aa二进制文件输入2个区块数对应分区表的55aa标记位
[root@centos8 ~]#dd if=/dev/zero of=55aa bs=1 count=2

#查看55aa文件
[root@centos8 ~]#hexdump -C 55aa
00000000  00 00                                             |..|
00000002

#编辑55aa
[root@centos8 ~]#vim -b 55aa

• #进入底行模式 shift 键和 ; 键

• 输入 %xxd 将文件转换为可读的十六进制文件

• 将命令中的0000改为如图55aa,

• 再进入底行模式输入 %!xxd -r 加粗样式返回格式，再在低行模式输入wq保存退出

#55aa文件输出到分区表对应位置
[root@centos8 ~]#dd if=55aa of=/dev/sda bs=1 count=2 seek=510

#查看
[root@centos8 ~]#hexdump -C -n 512 /dev/sda
#可以显示分区
[root@centos8 fdisk -l /dev/sda
```bash

d if=55aa of=/dev/sda bs=1 count=2 seek=510

#查看
[root@centos8 ~]#hexdump -C -n 512 /dev/sda
#可以显示分区
[root@centos8 fdisk -l /dev/sda