切换到宽版
  • 3289阅读
  • 0回复

FAT32分区 MDF碎片提取(winhex脚本)(转自海云) [复制链接]

上一主题 下一主题
离线山东老王
 

只看楼主 倒序阅读 0 发表于: 2011-02-28
海云抛砖引玉之 ___FAT32分区 MDF碎片提取(winhex脚本)]
使用范围:
1.FAT32分区
2.在程序开头处加上 GOTO 根目录位置*512


ForAllObjDo

Assign MyVariable  0
Assign MyVariable1  0
Assign MyVariable2  0
Assign MyVariable3  0

Assign MyVariable4  0
Assign MyVariable5  0
Assign MyVariable6  0
Assign MyVariable7  0
Assign MyVariable8 0
Assign temp  0
Assign my1 0
Assign my2 0

{Label my


Assign MyVariable1  0
Assign MyVariable2  0
Assign MyVariable3  0
Assign MyVariable4  0
Find 0x013F3F3F3F3F3F3F3F3F3F003F3F3F3F3F3F3F003F3F3F3F3F3F3F3F3F3F3F3F3F3F3F00  Wildcards  Down
IfFound

Assign MyVariable  CurrentPos
IfGreater  (MyVariable%512) 0
move 1
JumpTo  my
EndIf

move 32

Read MyVariable1 4

move 8156

Read MyVariable2 1



move 31
Read MyVariable3 4




IfEqual  MyVariable2 1
Else
move 1
JumpTo  my
EndIf

Assign MyVariable4  (MyVariable3-MyVariable1)

IfEqual  MyVariable4 1
Block1 MyVariable
Assign temp MyVariable3
JumpTo  my1
Else
move 1
JumpTo  my
EndIf

EndIf







Label my1

move 8156
Assign  temp (temp+1)
Read MyVariable5 1

move 31

Read MyVariable6 4



Assign MyVariable7  (MyVariable6+MyVariable5)

IfEqual  MyVariable7 0

JumpTo  my1

EndIf



IfEqual  (MyVariable6-temp) 0
JumpTo  my1

Else
move -37
Block2 CurrentPos
JumpTo  my3

EndIf
Label my3


CopyIntoNewFile "D:\hy\ +MyVariable1+ file +temp+.mdf"


}[2]
山东回天盛邦数据恢复中心------磁盘阵列恢复专家,真正具备开盘实力和条件的专业数据恢复机构。电话:0533-6207528
快速回复
限100 字节
欢迎来到中国数据恢复技术联盟,请勿发表暴力、色情、广
 
上一个 下一个