Full solution of Hard Disk Data Recovery instances

After hard disk data is damaged for various reasons, can we blame ourselves?
The full solution of this example is to hope that readers can quickly find the corresponding solution when the unfortunate situation occurs, so as not to waste their hard work.
Of course, our greatest expectation is that you will never use the following methods! Because a complete post-event solution cannot ensure that all data is intact. To be truly foolproof, the more important task is to prevent problems before they happen.

File deleted

I. Symptoms

This may be the simplest and most common data corruption. The direct expression is that the recycle bin is cleared after the file is deleted, or the Shift key is held down to delete the file, otherwise, you can select "delete without moving the file into the recycle bin, but delete it completely" in "properties" of the "recycle bin ".

Ii. Solutions

Since data corruption is the most common, of course it is the easiest to recover, we will provide corresponding solutions based on different operating systems.

1. Solutions Under Win9x/Me

That is, the files in the FAT16/32 partition are deleted and restored by mistake. This should be the basic function of most recovery software. The software Recover4all, which we use as an example, the function provided is only to restore accidentally deleted files Under Win9x/Me. In fact, many things are not just about seeking for perfection. They are enough, but simple is beautiful.
We need to download r4a.exe from the main site of Recover4all (http://www.recover4all.com unzip, this is a self-extracting file, you can extract the files to a directory on a floppy disk or hard disk (by default, the files are extracted to a floppy disk ). Run rec4all.exe and you will see a registration window. You can click the "To star the progam click" button To try it out (the unregistered version can only restore files smaller than 10 KB ). As shown in the main window of the program, this is a window similar to "Resource Manager". You can scan the deleted files in the corresponding partition by clicking the drive letter button under the main menu, select the file to be restored in the window on the right, and then click "Recover" under the main menu, in the dialog box that appears, select the storage location of the recovered file. In this case, you can restore the deleted file by mistake in Win9x/Me.

2. Solutions in WinNT/2000

In other words, how to restore a deleted file in the NTFS partition. For this relatively simple requirement, File Scavenger (http://www.quetek.com/) is fully qualified. Of course, File Scavenger is very targeted-it can only be used in WinNT/2000 systems (at the same time, it must log on to the system as Administrator), and only effective for partitions in NTFS format. However, it supports the recovery of compressed NTFS partitions or files in folders, and is also effective for files in formatted NTFS partitions (note: file Scavenger can only restore the files in formatted partitions, and cannot restore the entire formatted partition ).
Currently, File Scavenger has two versions: hard disk installation and floppy disk (the download addresses are http://www.quetek.com/32fs140.exeand http://www.quetek.com/32fs140f.exe ). The installation of hard disk is similar to that of general software, the only thing to note is that the safest way to restore a File using File Scavenger is to install File Scavenger after the File has been deleted (of course, you should not install the software in the partition where the File is deleted ). Because File Scavenger has a single function, a MB Floppy Disk can be attached to the execution File and the required library File, therefore, the floppy disk version may be used by many people (you should put the floppy disk version directly in a directory of the hard disk as usual ). The following example uses a floppy disk.
A non-important File, veryimportant.txt, was accidentally deleted and cleared the recycle bin. Fortunately, you have read this article "instance analysis" and File Scavenger has been prepared on a floppy disk or hard disk. OK ,now you are running filescav.exe, and you will see the window as shown in. Note: The "Search Condition" can be in multiple formats (for example ,*. doc, *, data *. txt, etc.), according to your own needs fill in the most convenient search; Exhaustive Sear check box selection will allow you to specify the size of the search partition cluster and the scope of the search cluster, after the File is specified, File Scavenger searches for and displays the names of all existing files, whether deleted or not. Therefore, it is not necessary to have special requirements; in the search results window, you can click "Filename", "Size", and "Modified" to sort the search results.
Now we have found veryimportant.txt. Select it and click "Recover". If the File can be recovered, you can find it in the previously specified recovery File storage path (if you are using File Scavenger for the first time, there is also a window to remind you to register. If you do not register, you can only restore files smaller than 4 kb ). What else can I worry about?

Iii. unrecoverable situations

If a file is deleted and its disk space has been written, the probability of restoration is usually 0. Therefore, to restore a deleted file by mistake, do not perform write operations on the partition where the file is deleted.
Virus destruction

I. Symptoms

Nowadays, people who use computers are basically talking about "virus" color changes, and data damage caused by viruses is often unpredictable (including Partition Table damage and data coverage; such as hard disks damaged by CIH viruses, its partition table has been completely rewritten, and hard disks cannot be found after disk A is started). The symptoms of virus damage to hard disk data are also hard to describe, basically, most data corruption may be caused by viruses. Therefore, the most secure method is to install an excellent virus firewall.

Ii. Solutions

Because the methods for destroying hard disk data by viruses vary, the recovery solution must be the right remedy. Here we take the common CIH as an example, because it is the most common and easy to judge (generally published in April 26 ).
Once the user's hard disk data is damaged by the CIH virus, KV3000's F10 function can be used to fix the problem as follows:
1. the size of the C disk is above 98% GB. The original FAT table is 32-bit, the repair rate of the C partition is 99%, and the repair rate of the D, E, F and other partitions is, with the help of manual C, D, E, F and other partitions, the repair rate is 100%.
2. the hard disk capacity is less than 0% GB, the original FAT table is 16 bits, the repair rate of partition C is 99%, and the repair rate of partition D, E, F is, with manual D, E and F disks, the repair rate is 100%.
Because the original drive C is a 16-bit short FAT table, the FAT table on the drive C and the file directory under the root directory are overwritten by the CIH virus. KV3000 can return disk C. Although the file name in the root directory has been overwritten by viruses and garbled characters, the file content and images are stored in certain slices of disk C. We recommend that you use KV3000 to retrieve the C drive, and then use the file repair software TIRAMISU. EXE to find some file images in the C drive (You Need To Know this software friends can visit the Ontrack company's home page http://www.ontrack.com ...... Can't I find TIRAMISU content on this website? Now TIRAMISU has been integrated into EasyRecovery, the flagship product of Ontrack. For more information, see "Partition Table Corruption" in the next section of this article. If the cluster where the original file and image are stored is connected, the retrieved file will be intact.
But is the C drive of FAT16 in CIH not saved? You can still try FIXMBR (ftp://www.newhua.com/fixmbr102a.zip), which can decide hard disk partitioning through full search, and rebuild the primary Boot Sector. Because the software only modifies the primary Boot Sector record and does not perform write operations on other sectors, it generally does not bring insecure directories (if the repair is not ideal, please manually fix it using tools such as DiskEdit ). Note: FIXMBR is an old program that does not take much consideration for WinNT, Linux, and FAT32.

Iii. unrecoverable situations

There are too many ways for viruses to damage the hard disk, and most of the damages cannot be easily restored using general software (if you like to use disk sector editing tools such as DiskEdit, there is still a glimmer of hope in some cases ), so ...... In case of virus damage to the hard disk, pray (from this point of view, it is absolutely necessary to install an excellent virus firewall )!

Partition Table Corruption

"The sky is unpredictable and everyone is lucky." This sentence is true. In the past few years, partition tables have been damaged several times. I think that I was helpless at the beginning, and I dared to start it later. I still have to fight for it until now. However, after so long suffering, finally I feel a glimmer of opportunities, do not dare to exclusive, hope to share with friends who have encountered difficulties, also hope you And I more communication (E-mail: clinuxer@yeah.net )......

I. Failure Cause and recovery Feasibility Analysis

Partition Table damage may be the most serious catastrophic damage except physical damage. The reason is as follows:
1. If you accidentally delete a partition, you can recover it as long as no other operations are performed.
2. Installing the multi-system boot software or using a third-party partitioning tool may lead to recovery.
3. Virus destruction, which can be partially or completely restored.
4. Use Ghost to clone the partition/hard disk and destroy it. You can only partially recover or cannot recover it. (Be careful when using Ghost ).

2. Two Suggestions

According to a survey by a foreign professional data repair company, after data corruption, the data can be restored to a large extent. The reason why many instances cannot be recovered exists, more than 90% of this is due to misoperation in the subsequent recovery process, resulting in greater damage. So I hope my friends will remember the following two points:
1. if data on the hard disk is lost, immediately shut down and do not perform any write operations on the hard disk. This will increase the difficulty of the repair and affect the repair success rate.
2. each step of your operation should be reversible (like the Undo function in Norton Disk Doctor) or the faulty hard disk is read-only (EasyRecovery and Lost & Found, well-known, work in this way ).

Iii. Solutions

This software package is included in the Norton Utility tools and has powerful functions. It can restore partition records and FAT tables. Note that it is not read-only for hard disk operations, therefore, you need to prepare the Undo file in every step, so that the file can be restored even if a misoperation occurs. Norton Disk Doctor and DiskEdit can also restore some files when the partition table cannot be recovered, it's a pity that Norton Disk Doctor does not support NTFS partitioning. This is a pity ......
The software from the most professional data recovery companies is of course very professional. EasyRecovery supports many File System formats such as FAT and NTFS, and has a dedicated For Novell version. EasyRecovery can be safely restored for partition damage and accidental formatting of the hard disk. All you need to do is to mount the damaged hard disk to another computer and recover it as much as possible, however, EasyRecovery does not work well for Chinese file names and directory names (some garbled characters, but the content of the article is absolutely correct ).
Hard Disk data produced by PowerQuest Corporation PartitionMagic