U盘手工恢复技巧

这里就拿2024年数证杯的题目进行演示

可以很清晰的看到这个就是一个损坏的U盘我们先将其放入R-studio进行查看文件系统

可以看到分区一是FAT32，分区二是NTFS

可以看到分区一的DBR区全是0

可以看到分区二的DBR区全是F
那么修复思路就是修复DBR区即可
DBR区修复

FAT32
EB58904D53444F53352E3000020862190200000000F800003F00FF000008000000580D004F030000000000000200000001000600000000000000000000000000800029F2E019B24E4F204E414D4520202020464154333220202033C98ED1BCF47B8EC18ED9BD007C885640884E028A5640B441BBAA55CD13721081FB55AA750AF6C1017405FE4602EB2D8A5640B408CD137305B9FFFF8AF1660FB6C640660FB6D180E23FF7E286CDC0ED0641660FB7C966F7E1668946F8837E16007539837E2A007733668B461C6683C00CBB0080B90100E82C00E9A803A1F87D80C47C8BF0AC84C074173CFF7409B40EBB0700CD10EBEEA1FA7DEBE4A17D80EBDF98CD16CD196660807E02000F842000666A0066500653666810000100B4428A56408BF4CD136658665866586658EB33663B46F87203F9EB2A6633D2660FB74E1866F7F1FEC28ACA668BD066C1EA10F7761A86D68A56408AE8C0E4060ACCB80102CD1366610F8274FF81C300026640497594C3424F4F544D475220202020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0A4469736B206572726F72FF0D0A507265737320616E79206B657920746F20726573746172740D0A0000000000000000000000000000000000000000000000000000000000000000000000AC01B901000055AA
复制十六进制

光标移动到第一位然后右键---->编辑---->剪贴板数据---->写入---->另存为一个文件
然后NTFS分区的也同理
NTFS
EB52904E5446532020202000020800000000000000F800003F00FF0080000000000000008000800000500E0000000000AA980000000000000200000000000000F6000000010000003F0D93B22D93B29A00000000FA33C08ED0BC007CFB68C0071F1E686600CB88160E0066813E03004E5446537515B441BBAA55CD13720C81FB55AA7506F7C101007503E9DD001E83EC18681A00B4488A160E008BF4161FCD139F83C4189E581F72E13B060B0075DBA30F00C12E0F00041E5A33DBB900202BC866FF06110003160F008EC2FF061600E84B002BC877EFB800BBCD1A6623C0752D6681FB54435041752481F90201721E166807BB166852111668090066536653665516161668B80166610E07CD1A33C0BF0A13B9F60CFCF3AAE9FE01909066601E0666A111006603061C001E66680000000066500653680100681000B4428A160E00161F8BF4CD1366595B5A665966591F0F82160066FF06110003160F008EC2FF0E160075BC071F6661C3A1F601E80900A1FA01E80300F4EBFD8BF0AC3C007409B40EBB0700CD10EBF2C30D0A41206469736B2072656164206572726F72206F63637572726564000D0A424F4F544D475220697320636F6D70726573736564000D0A5072657373204374726C2B416C742B44656C20746F20726573746172740D0A000000000000000000000000000000000000000000008A01A701BF01000055AA
然后就可以用x-way打开镜像文件

打开刚才修复的两个分区，发现修复完成