Professional on-site protection after data disaster on WINDOWS

Preface]

A large number of data recovery cases show that if the data can be effectively protected from damage after an error, the salvage rate is extremely high. However, the reality is that, when data errors occur, operations that do not understand or inadvertently damage the site may lead to a reduction in the recovery rate or failure to recover. The most essential skill for a professional data recovery engineer is how to protect the site and ensure that operations can be traced as much as possible.

Body]

For WINDOWS platforms, after a data disaster occurs, the common response process is: 1. Determine whether the hardware level is damaged. 2. ensure that data is not automatically written to any system. 3. Back up data as much as possible. 4. recover data during Backup.

I do not intend to describe the hardware-level judgment in detail in this article, but there are two simple standards: 1. If an I/O error is reported on the hard disk before an error occurs, 2. If the hard disk has different abnormal sound, it needs to be transferred to a professional organization for processing.

It is the original intention of this article to eliminate hardware issues and how to ensure that the status quo remains unchanged after data loss. Under normal circumstances, WINDOWS will automatically load the mounted drive letter, which is writable and modifiable. This is a behavior without any warning. If a file system error occurs or a hard disk is a member disk in RAID (it happens that the partition table and the Boot Sector of the file system are on this hard disk ), automatic mounting will trigger chkdsk behavior, which is quite fatal. In existing cases, there are a large number of data disasters caused by this cause. Therefore, we must ensure the read-only performance of the system when loading disks. If no third-party monitoring tool is available, the solution is as follows:

Use Windows Server 2003, Windows Server, or Windows 7, and disable the automatic volume loading function. Run the "mountvol/N" command. After that, the attached drive will not automatically load the drive letter, thus ensuring the read-only media. The server version is disabled by default. For Windows 7, you must manually disable it as an administrator.

After that, you can use the mirroring method described in other articles in the http://zhangyu.blog.51cto.com to make a complete image of the faulty device.

Even if you do not have the image conditions and do not automatically load the drive letter, you can also ensure that there is no misoperation, you can also use the data recovery software to recover this set of disks. (Professional data recovery software is designed for disks. If you can use partitions with the drive letter as objects for restoration, you will be very amateur)

 

This article is from the "Zhang Yu (data recovery)" blog and will not be reproduced!