Common data recovery methods in Windows)

From: http://user.qzone.qq.com/409133413/blog/1208935431

The original article is as follows:

Common data recovery methods in Windows (original)

Note:
1. Here we will only discuss recovery ideas, not the principles of the file system and specific methods for recovery (For details, refer to other materials)
2. personal opinions are for reference only!
First, let's take a look at how we usually use hard disks:
For a new hard disk, we need to use partitioning software (such as fdisk, diskgen, partitionmagic) to split it into Several partitions (c, d, e...) according to our own needs .........) For ease of management, this process only writes MBR and partition table information in the first sector of the hard disk (if there are extended partitions, partition table information will also be written in other corresponding sectors ); but at this time, data cannot be written into the partition, because each partition is still an empty city, just like a library just built by the construction workers. There are no bookshelves or numbers in it, there is no system or equipment for managing books in this library. To use each partition, you must format the partition, that is, advanced formatting. Advanced formatting is for a certain partition, not for the entire hard disk, the common partition formats in the Windows operating system (called the file system in professional materials) are FAT32 and NTFS. After formatting, we can write data to it: first install the operating system (if it is the primary disk), and then write the content you want to write in it.
I. Partition Table Restoration
If only partition table information is damaged, as long as the partition table information is written back, the data in the hard disk can be restored by 100%. Restoration Method: Use the Partition Table restoration software (such as diskgen and easy-to-use Partition Table doctor) or use winhex for manual restoration. In comparison, software recovery is faster, but it may not be able to be restored successfully (if the hard disk is re-partitioned, it will leave some previous partition table information, software recovery errors may occur); the success rate of manual recovery with winhex is relatively high, but it takes a longer time, and you need to be familiar with the winhex software, at the same time, you also need to learn about partition tables.
Ii. FAT32 partition data recovery
Data structure of the FAT32 partition: DBR fat1 fat2 data (including the root directory)
Restoration principles:
1. If DBR or DBR and fat1 are damaged, manual recovery is better than data recovery software, and all data can be recovered.
2. If you want to restore the data in the partition after formatting (FAT32 partitions are used before and after formatting), data is generally restored using the data recovery software (unless you need to manually recover some data in it ), the success rate of data recovery (which can be opened normally after recovery) mainly depends on whether there are no fragments in the file storage (whether the file is stored in a continuous sector). If there are fragments in the file storage, recovery software cannot open this file even if it recovers it. The FAT32 partition clears all the fat tables during formatting. Although the file data is still on the hard disk, the chain for organizing the data is gone, the software can only depend on the directory item information of this file (the starting cluster number and file size of the file) to determine the location of the file (based on the principle that the file is not fragmented during storage ), then organize the content of this file into a file to restore it (the principle of software recovery is my guess, not necessarily correct !!). After formatting A FAT32 partition, it is like an E-document that you cannot understand. It is intended to be translated by someone else, but this book has no page number and is preparing to be bound. Suddenly, a burst of wind is blowing, blow them to the full room. After you collect them, you do not know the order in which they are arranged. Sometimes there may be several pages together, but they are not scattered, these pages may be a chapter in this book, so you can ask others to translate this part.
Iii. NTFS partition data recovery
Restoration principles:
1. If some files in DBR or $ MFT are damaged and restored manually, the effect would be better.
2. After formatting (NTFS partitions are used before and after formatting), the software restores data. The success rate of restoration is higher than that of FAT32. After the NTFS partition is formatted, the data of the previously written files is not lost, so the recovery success rate is relatively high.
Iv. Recovery of different types before and after partition formatting
Because the structure of the FAT file system is very different from that of the NTFS file system, if the FAT32 partition format is NTFS or the NTFS partition format is FAT32, the recovery is more likely.
Restore method: manually restore DBR to the original partition status, and then check whether you can see the data you want. Of course, some data has been overwritten during formatting. If the data you want is overwritten, you can only say that your luck is too bad !!
V. Recovery of incorrect ghost
There are two types of false GHOST: one is that the hard disk becomes a partition after the ghost, and the other is that the content of this partition ghost is transferred to another partition. The first method for restoring the wrong ghost is the same as that for the partition table described earlier. After the restoration, all the data in other partitions except the first partition can be restored. The second method is to use the recovery software to recover the wrong ghost. data that is not covered may be recovered.
6. Restore deleted files
Manual recovery or software recovery. If the data is not covered, the recovery may be successful.
In addition, the data recovery of the USB flash disk and the card in the cell phone expansion slot is similar to that of the FAT32 partition.