恢复教程

以下是NTFS文件系统数据恢复80H属性DATA RUN 脚本，适用WINHEX任何版本

template "NTFS Data Runs"

//X-Ways Software Technology AG

description "To be applied to beginning of data runs" applies_to disk

begin

{ uint_flex "3,2,1,0" "ClusterCountSize" move -4 uint_flex "7,6,5,4" "ClusterStartSize" move -3

ifequal ClusterCountSize 0 ExitLoop endif

ifGreater ClusterCountSize 4 section "Unsupported value in Data Run" ExitLoop endif

ifGreater ClusterStartSize 4 section "Unsupported value in Data Run" ExitLoop endif

ifequal ClusterCountSize 1 int8 ClusterCount endif

ifequal ClusterCountSize 2 int16 ClusterCount endif

ifequal ClusterCountSize 3 int24 ClusterCount endif

ifequal ClusterCountSize 4 int32 ClusterCount endif

ifequal ClusterStartSize 0 section "(sparse or compressed)" endsection endif

ifequal ClusterStartSize 1 int8 ClusterStart endif

ifequal ClusterStartSize 2 int16 ClusterStart endif

ifequal ClusterStartSize 3 int24 ClusterStart endif

ifequal ClusterStartSize 4 int32 ClusterStart endif

endsection

}[150] //arbitrary end to avoid infinite loops

end