Data recovery procedures that are not open to all files

"Prophase Information" Shandong Company, Enterprise Scale is not small, but not IT companies, so did not do a good data storage planning. The company's important data is placed on a PC through Windows network sharing, as well as printers, and many people directly copy data files to print on this PC.

A few days ago, all of a sudden, all the files of F are unable to open, performance:

1, the file name, time, the path is completely correct, the disk occupies the space is also correct.

2, all jpg picture file opens prompts: "Windows Photo Viewer cannot open this picture because the photo Viewer does not support this file format, or you do not have the latest update for the photo viewer"

3, all the doc open prompt: "Please choose to make the document readable encoding", select any one of the encoded files are wrong.

4, all the docx open when prompted: "Unable to open the file, because the content has errors"

5, all XLS open when prompted: "You are trying to open the file format and file name extension specified inconsistent format, please open the file before you verify that the file is not corrupted and trusted source"

6, all xlsx open when prompted: "You cannot open the file, because the file format or file name extension is not valid, make sure the file is not corrupted, and the file name extension matches the format of the file"

7, all PDF documents open when prompted: "Open the document when an error occurred, the document is corrupted and cannot be repaired"

8, all other types of files are not open normally. (The purpose of typing the above error hint is that users can search for this article according to error prompts, no royalties, no words)

Users first recover from some of the data recovery software downloaded online, but without any results. After the repair to the local several data recovery, are not able to recover, or need to send to Beijing processing, the user thought, anyway is to send Beijing, the data is also very important (after the user told us that these data files, if not recovered, loss at least hundreds of thousands of yuan), so, to the Beijing data recovery company for consultation.

Our analysis and preliminary findings are roughly the same:

1, determine whether the storage raid. The conclusion is that there is only one 500G single disk, which eliminates the possibility of this failure after the possible raid old disk synchronization.

2, determine if there is a physical failure of the hard disk, such as whether there is a different sound, whether access is slow, whether or not prompted IO errors. The conclusion is that in addition to the F disk, the other partition data is completely normal, the hard disk in other data recovery company detection and no physical failure. Troubleshoot similar failures due to physical failures, such as hard disk firmware defect table errors, bad track, etc.

3, determine whether to use encryption. The conclusion is that no encryption has been enabled. Exclude some encryption system after the loss of the encryption chain direct access to the ciphertext caused by similar failures.

4, determine whether the use of Third-party software to do the partition size adjustment, merger. Get the conclusion that there is no. Eliminates similar failures due to software tweaks such as PQ (Norton partitionmagic), Diskgenius, Acronis Disk Director Suite, and merging partition errors.

5, determine whether the operating system failure. The conclusion is that the reload system is still after antivirus. Troubleshoot similar failures caused by viruses that hijack all executable files or join file system interception layers.

6, no other abnormal operation. It is inferred that the failure may be caused by a virus or Trojan.

Because of the many similar cases that have been encountered before, the damage is usually not complex and reversible (some unscrupulous hackers will blackmail users by this). After communicating with the user, the user will send the hard drive to the North Asian Data Recovery Center.

"Determination Scheme"

Connecting the hard drive to a secure operating environment (without loading the letter, not automatically writing the data, ensuring full read-only), found that the file system is completely normal on the bottom, but the data area is all wrong. Take a PDF file as an example, open in Winhex as shown below: