Study on the Manual Recovery Technology of Primary Partition Table in Electronic Forensics
Chao Chen · Xinxi wangluo anquan · 2012
Through the analysis and research of the hard disk partition structure in the teaching of electronic forensics,this paper puts forward a manual way to restore the primary partition table.By computing the size and starting position of partition and using the formation of DBR and EBR,we can rebuild the primary partition table.The recovery experiment of the partition table on partition continuous hard disk has proved that the method is right.the article concludes with a research focus on the next step.