Hard drive as the main place for users to store data, and its biggest use than store data, but it is sometimes due to user mishandling, resulting in the loss of user data. If the average user, the data is not important relative to the user, then lost to lost, not so much; but if the data is very important to users (for such users should always back up data), then data loss how to do it? This article is through a process of recovery for hard disk data to a brief description of what the hard disk data recovery, and I hope you recover hard disk data can be helpful.
Related Concepts
MBR (Main Boot Record) that the master boot record area,battery for ACER Aspire 3680 it is located in the hard disk cylinder 0 track 0, sector 1, including the hard disk boot program and partition table.
DBR (Dos Boot Record) that the operating system boot record area, usually located in the hard disk cylinder 0 track 1, sector 1, is the operating system can directly access the first sector, it also includes a boot program and a program called BPB (BIOS Parameter Block) record parameters of the partition table. Each logical partition has a DBR.
FAT (File Allocation Table) file allocation table that is DOS, Windows9X file system addressing format for data security reasons, FAT generally made of two, the second for the first FAT FAT backup.
DIR is the Directory that is shorthand for the root zone, DIR immediately after the second FAT table.
Estimated cause of data loss:
1. Install multiple boot software, causing abnormal operation.
2. Was a virus infection. Loss of data before the state: 2.5GB hard disk, the original partition: C: 2GB + D: 500MB, D disk with important data.price of TOSHIBA PA3457U-1BRS battery Two partitions are FAT16 format.
The process of data loss
After a system reboot, D drive missing.
Operation after data loss
The client has to re-partition with Fdisk, trying to re-partition the original partition size, without success. But did not format the D drive, just format the C drive and reinstall the system.
Data recovery requirements of customers
Recovery under the root directory D “digital camera” all the files within the directory.
The tools:
NORTON DISK DOCTOR: diskedit.exe
Data recovery process:
First, the data backup of all the major sectors including physical Track 0, Track 0 of the logical partitions, FAT table and root directory area, etc., which together with GHOST backup data area of each partition.
Second, the analysis of the hard disk master boot sector MBR (including the primary partition table and boot loader), the partition boot sector DBR, FAT table and root directory area. As has been re-start the C partition and a smooth disk (aside virus reasons), so the MBR of the logical structure should be no problem, look through the Diskedit MBR command where the first sector of Track 0, confirmed that estimation is correct, but now with the original partition table is fully consistent with the partition table, it can not be determined.
Through the partition table, you can find the boot sector of the partition where the physical location analysis to determine the important data in C drive (boot sector, the first FAT table, the second FAT table,dell xps m1330 battery root directory area) are not abnormalities, but D-DBR boot sector in addition to, the above correspond to the other data are not, DBR no exception reason is that the results of re-zoning, and FAT1, FAT2 and root directory area beyond recognition because, generally should have two possibilities: First, partition is inconsistent with the original partition, resulting in the data do not add up; Second, the data has been destroyed by the virus.
MBR because look, they found the other sector of track 0 unknown process leaving the residual code, by looking at some of the display information, can be determined to leave some sort of multi-system software, and that too many customers have installed systems management software . This can generally be excluded from the virus may damage partition, the partition operating loss should be the exception due to multi-system management software.
Third, find the original partitioned according to the preceding analysis, the customer data loss after a re-zoning, and the estimated existing partition with the original partition is inconsistent,Dell LATITUDE D500 Replacement battery this would no doubt increase the difficulty of data recovery, but fortunately is not formatted D drive, because if only just Fdisk, rewrite the original hard drive only the first sector of each partition. If this sector does not fall on the important parameters of the original partition area (DBR, FAT, root directory), then the success rate of repair is pricey. The next step is to find the original D-important data zone. According to information provided by the customer can see, the original D under the root directory called “digital camera” subdirectory, so the search function provided by DISKEDIT, search for “digital camera” corresponds to the hexadecimal code, you can find the original D the root directory area. Lasted 30 minutes, by filtering search results, and ultimately find the root directory where the sector, and then follow it forward two FAT tables turn (based on experience about 400 sectors to 500 sectors) to find where the original D-DBR sectors, and then turn forward again 63 sectors, to find the original D drive partition table, thus, overcome the most difficult problems.
Fourth, the primary partition table reconstruction because the customer was using Fdisk primary partition table to re-establish the original partition table is not consistent, it must be manually rebuild the original partition table, find through the front of the original D drive partition table and the original D disk DBR, can calculate the primary partition table, including the district’s start time and end sector, partition size, partition type and so on. Calculated results, rewritten sector 0 track 1, the primary partition table (the computer automatically shut down.)
Fifth, reboot the system,battery for APPLE A1181 there the original D drive, basically all the recover all the files. Copy of the “digital camera” directory, make a backup. Notify the customer to retrieve data.
Description:
1. Data backup, do not over-confident GHOST, GHOST only recognize the right of the district, for it does not copy the hidden partition. The partition is not correct, it will report an error and stop the replication process. GHOST is not a pure sense of the overall copy software, copy only those files that exist on FAT table is not copied all the data on the disk!
2. Unfortunately for the customer to re-points D D than the original disk drive big just a few tracks, so the new D drive partition table is built in the original C-terminal of the data area. So basically this can be said that 100% of repair to restore the original data in D drive.
3. More lucky is that the customer does not have to reformat the D drive, otherwise there can be such a high recovery rate of the.
Recommendations to the reader
After the hard disk data loss occurs, immediately contact your local data recovery company. Best not to write to the hard drive, that would increase the difficulty of repair, also affected the success rate of repair.