Getting Started tutorial on hard disk data recovery

Data structure of hard disk

First buy a hard disk, we have no way to use, you need to partition it, format, and then install the operating system before you can use. The data for a full hard drive should include five parts: the Mbr,dbr,fat,dir and the data area. Only the primary boot sector is unique, and others increase as your number of partitions increases.

Primary boot Sector

The primary boot sector is located in the 0-track 0-cylinder 1-sector area of the entire hard drive, including the hard disk master Boot record MBR (main boot records) and the partition table DPT (disk Partition table). The primary boot record is to check that the partition table is correct and to determine which partition is the boot partition and to execute the partition's startup program (that is, the operating system boot sector) into memory at the end of the program. As for the partition table, many people know that with the 80H or 00H as the beginning flag, with 55AAH as the end sign, a total of 64 bytes, at the end of this sector. It is worth mentioning that the MBR is produced by partitioning programs (such as DOS Fdisk.exe), and that different operating systems may vary from one sector to another. If you have this intention can also write one, as long as it can complete the task described above, this is why can achieve multiple system startup reasons (to say the topic: Because this master boot record is easy to write, so there are a lot of boot area virus).

Operating system Boot Sector

OBR (OS boot record) is the operating system boot sector, typically located on the hard disk's 0-track 1-cylinder 1-sector (which is for DOS, the system that boots in multiple boot is located in the first sector of the corresponding primary partition/extension partition) is the first sector that the operating system can access directly. It also includes a bootstrapper and a BPB parameter record table called the BIOS Parameter block. In fact, each logical partition has a OBR, whose parameters vary depending on the size of the partition and the type of operating system. The primary task of the bootstrapper is to determine whether the first two files in the root directory of this partition are operating system boot files (such as Msdos or Io.sys and Msdos.sys originating from Msdos win9x/me). If so, read the first file into memory and hand the control over to the file. The BPB parameter block records important parameters such as the starting sector, end sector, file storage format, hard disk media descriptor, root directory size, fat number, allocation unit (allocation, formerly known as cluster). OBR are generated by advanced formatters (for example, DOS Format.com).

File allocation table

Fat (file allocation table), which is an Dos/win9x system file addressing system, for data security, fat is generally done two, the second fat is the first fat backup, fat area immediately after OBR, Its size is determined by the size of the partition and the size of the file allocation unit. There are always many options for fat formats, and Microsoft dos and Windows adopt the familiar FAT12, FAT16, and FAT32 formats, but there is no other format for fat, like Windows NT, OS/2, Unix/linux, Novell and so on have their own way of managing documents.

Directory Area

Dir is the shorthand for directory, dir, immediately after the second fat table, only fat cannot locate the file on disk, and fat must work with Dir to pinpoint the location of the file. Dir records the starting cell (which is the most important) for each file (the directory), the attributes of the file, and so on. When locating the file location, the operating system, based on the starting cell in Dir, combines the fat table to know the location and size of the file on the disk. After the Dir area, it is the real data storage area, that is, the information area.

Data area

Although data occupies the vast majority of the hard disk space, but without the previous parts, it for us, it can only be some boring binary code, there is no meaning. Here is a point to note that we usually refer to the formatter (the advanced format, such as a DOS format program), and did not erase the data area, just rewrite the fat table, as for the partition hard disk, but also modified the MBR and OBR, The vast majority of data areas are not changed, which is why many hard disk data can be repaired. But even so, if one of the Mbr/obr/fat/dir was destroyed, it would be enough for the so-called DIY veteran to spend half a day ... You need to be reminded that if you often defragment your disk, your data area may be contiguous, so that even if the mbr/fat/dir is all broken, we can use disk editing software (such as Diskedit under Dos), as long as we find a location where the file is initially saved, Then the file may be restored (and, of course, it requires a prerequisite that you do not overwrite the file ...).

Hard disk partition mode

We usually talk about the concept of partitioning, nothing more than three kinds: primary partition, extended partition and logical partition. The primary partition is a relatively simple partition, usually in the front of the hard disk, which forms the logical C disk. Other logical disks are not allowed to be established in the primary partition.

The concept of extended partitions is complex and is a major cause of confusion between partitions and logical disks. Because the hard disk only retains 64 bytes of storage space for the partitioned table, and each partition's parameters occupy 16 bytes, the total in the primary boot sector can store 4 partitions of data. The operating system allows only 4 partitions of data to be stored, and if the logical disk is a partition, the system allows up to 4 logical disks. For specific applications, 4 logical disks often fail to meet actual requirements. To build more logical disks for the operating system, the system introduces the concept of extended partitioning.

The so-called extended partition, strictly speaking, is not a practical partition, it is just a pointer to the next partition, and this pointer structure will form a one-way list. In this way, in addition to the primary partition in the primary boot sector, only the partition data, called an extended partition, is stored, and the data from this extended partition can find the starting position of the next partition (which is actually the next logical disk), where you can find all the partitions by analogy. Regardless of how many logical disks are established in the system, each logical disk can be found individually by using an extended partition's parameters in the primary boot sector.