Manual data recovery

Recently, I have seen many posts about hard disk partition tables and hard disk data that are damaged and the machine cannot be guided or used. In the humanitarian spirit of helping the needy, I have posted a post with my computer experience in the last ten years and my previous experience in successfully repairing N (N is about 10) hard disks. The system will describe how to recover the hard disk Soft Fault!

Note: The premise is that the hard disk is not physically damaged, which can be obtained in diskedit (obtained in Norton 2.0 for Windows), diskman (huajun Software Park), Norton (version D ), unfomat (other compatible anti-formatting software can also be used) and other software as the basis. If you are proficient in the compilation under the Workshop, it would be even better! Haha ~~~~
Good. Everything is ready! First, it will occur when the system partition table is damaged by misoperations or viruses. 1: Start to display no rom basic. 2: Invalid Partition Table is displayed at startup. 3: No display (if attacked by CIH ). 4: The system prompts that the hard disk logical partition error cannot be properly identified (for example, the system prompts that the logical drive letter exceeds Z and fdisk is switched ). Program Unrecognized) 5: For Award bios, the system may prompt that the hard disk cannot be initialized (no ami is used, and there is no explicit image ......)
Now that we know the representation, let's take a look at its nature. I will try to explain the physical structure and various parameters of the hard disk as much as possible. As we all know, the primary boot area of the hard disk is located in the zero-column, zero-area, and one area of the hard disk contains several Partition Table items, a total of 64 bytes. Each partition item contains 16 bytes including the following information:
The first byte is the boot flag, where 80 is the active partition 00 and is not the active partition.
The second byte, starting head, indicating the starting position of the partition.
The second byte indicates the starting slice. The lower six bits (six bits on the right) are the starting slice, and the second two bits are the starting cylinder (and sometimes the fourth byte is added ).
The third byte, indicating the hard disk cylindrical information.
The fourth byte determines the lower eight bits of the Start cylindrical.
The fifth byte determines the partition type. 06 represents fat16, 0b represents FAT32, and 63 represents UNIX partitions.
6th Bytes: terminated head
7th Bytes: the lower 6 bits are the ending slices, and the higher 2 bits and 8th bits are the ending cylinders.
8th Bytes: Minimum 8 bits of the ending Cylinder
9-12 Bytes: number of sectors before the partition
13-16 bytes: number of sectors occupied by the partition
The information of the extended partition is located in the hard disk partition table shown above, and the information of the logical partition is located in the starting sector of the extended partition, you can find the sector corresponding to the starting address "x area/x sector/X column" in the table above. The 16 bytes of partition information indicate the logical drive (D: e :......) The start and end addresses. After learning about this, when the partition table is damaged, we can use various software for manual recovery. If there is no manual software, then the fdisk/MBR manual parameters are also very sloppy! Haha ~~~
We recommend that you use the all-Chinese interface and diskman that supports Virtual Operations when you restore partitions manually! As for the well-known diskedit, the operations are too complicated! Otherwise, it may be too late to cry ....... Step 1: Check whether the active partition of drive C has a valid value of 80. 2: edit the 0-column, 1-column head, and 1-sector head to check whether there is a valid 55 AA sign at the end. 3: Check the type mark of the partition in sequence based on your own partition. If the guiding and system signs are the same as your hard disk, change them to the correct one. As a result, the Partition Boot Record should be restored in. 4: select the diskman menu to re-create a partition table, and scan the hard disk in either automatic or interactive mode from the 0-column 0-head 2-sector, we recommend that you choose the interaction mode for those who have a deep understanding of the hard disk parameters. As you know your hard disk, the reliability of the operation is higher. People who don't know about it are still better to choose automatic ...... At this point, we should be able to recover the use of the hard disk if we are lucky. If there is a problem with the partition, and if we are lucky, it is also possible to enter 98! After necessary data is backed up, it is best to re-partition and foimat/U. If you cannot use it, but you can use the boot disk to boot the disk to gain control of the hard disk, that is, you can enter the partition. In this case, you can use the anti-virus software (kv3000) to re-create the partition function. After all, the regular army's approach should be more reliable than ours. If not, I have to come up with the final magic weapon! Use DEBUG to get it done!
I stated in advance that I only used the following debugging once. Although I was lucky enough to succeed, it was not guaranteed to be applicable to all hard disks. To be honest, my debug level is nothing more than enough to deal with scenes, we only provide some ideas. It is best to make it clear when you use it. If you do not copy it, you will not be able to use it any more ...... But I am not responsible for any consequences! Haha ~~~~~
Debug
A 100
MoV ax, 201 */The following three rows are register operations
MoV X, 200
MoC CX, 1
INT 13 */call interrupt 13 hard disk write operations
INT 3
G = 200
D 3b0 3ff
E 3be 80 */Add a boot zone effective indicator 80 to the boot Zone
E 102 3
G-100

If this is not the case, then I can't ...... We had to deliver repairs or find someone to read the residual data with dedicated devices. However, it would be costly to purchase new ones! Haha ~~~~

After restoring partitions, let's talk about how to restore data. Because the recovery data is closely related to the hard disk size parameter, you cannot specify a hard disk. Here we just give you a rough operation method. The specific operation depends on the hard disk of each user.
1: Assume that C is all destroyed (generally, we will immediately shut down the system when we see any bad situation, so other hard disks except C won't suffer too much loss) files on d need to be restored (most of the important files won't be stored on drive C ?). Restore the partition first using the above method. If one of the sizes and logical partitions is the same or at least not an exaggerated intact hard disk, it would be the best! Just back up its partition table and restore it! (This restoration method should be given the highest priority when only partition tables are destroyed !)
2: diskedit will be used here. Run diskedit D:/m after the recovery partition is restarted and press F6 to search for the partition table. Generally, you can find X-Channel 1 header 1 sector (the X value is hard to determine ). Since it is the first logical partition (d) from the first head, it may be very large, so the original connection should be in the X-channel 0 header 1 sector, run Info-> driver info to view the Ending position of the original primary partition. Because the primary partition generally starts with a zero-channel, zero-header and one fan, you can now roughly determine the information of the next primary partition.
3: Execute tools-> recalcuate partition to add the obtained parameter to re-calculate the partition, write it to the hard disk, and restart.
4: Format C:/s re-fill C's boot Information
5: restart again and run (un) format/Z: 8 d: restore the original cluster value of D (because it is more likely to restore the number of cluster partitions than the original number)
6: For FAT32 partitions, edit the disk in diskedit/M maintenance mode and change 0600 in 1c2h of the primary partition table to 0b00 to clear the fat and format FAT32 again.
7. Run format/Z: 8 d after the restart: After the unformat is completed, the file should be mostly restored. Of course, some file names may be different but will not change too much.

Note: This recovery operation is intended for fat16. If the partition is FAT32, it can save a lot of trouble, but in some cases, the operation may be more complicated.