Introduction to Data Recovery

I have always believed that the maintenance of a simple maintenance of hard disk maintenance does not have much significance, unless it is those who obsessed to be second-hand merchants wholesale and retailers (but please do not be affected by my subjective concept, we can according to their own hard disk use, whether it is worth the maintenance of independent judgment). After all, the "maintenance" of HDD repair is very different from the maintenance of the common sense. If we break a motherboard, after inspection found is a transistor burned, we can replace a new transistor, so that this transistor can still achieve the original transistor function, the motherboard is not affected by any, bad place also does not exist, we can say-the motherboard repaired. But the hard drive is not the same, the so-called "maintenance", just the disc on the bad, hard disk internal defects and so on to cover up, do not let the hard disk control system and computer operating system to find it, those flaws are still really lying in the hard drive inside, become ready to explode the time bomb. Therefore, the simple maintenance, only can make the hard disk temporarily restores the usability, I thought the significance is not big. And if the maintenance is to make the hard disk can be used temporarily, so that users can re-read the data inside the disk and back to other places, then this should be worthwhile, after all, the user's data to a certain extent is priceless.

PS: More Ironically, when some second-hand traders hide the bad way by simply hiding the partitions, many hard disk maintenance operators also plausibly say that those people are using the ignorance of some consumers to deceptive, are profiteers, and they are the real maintenance, so their work is how complex, technical requirements how high, How they are upright and so on. Now, we find that they are only hiding the defects, but hidden, so that people can not find out, do not know how they should be from the place now? Or if the profiteers can not be found, you can turn into a rape? I think at least those who hide the zoning is relatively upright, because after all, they also reserved for consumers the right to find false ^_^.

In this respect, I have contacted a hard disk repair business, he is PC-3000 in the south of a new increase in a domestic agent, this person is more frankly, can be clearly told the customer hard disk repair and the original disk after the difference, let the customer decide whether to repair. This is in the hard disk repair industry is a kind of alternative. Data recovery is a relatively sensitive topic, for some specific theory, reduction algorithm, the instruments involved and the details of the operation, there are all kinds of restrictions, can not be described in detail. Here can only be as far as necessary, so as to completely let everyone on the data recovery has a general impression is enough. Data recovery can be divided into pure software recovery and hardware and software combination of recovery.

First, the recovery of pure software

The inside of the hard disk is a certain validation formula to ensure the integrity of the data, according to each sector in the data content, sector of the servo information, and then according to a certain calibration formula after operation, will produce a unique checksum, the value of each sector is different. When different data is stored in the same sector, the checksum is not the same, and different sectors store the same data, which produces the same checksum (SCSI drives are more sophisticated in this respect). Data recovery is the use of such a principle, through the reverse operation, in a certain aspect of information because of wrong operation and lost or changed, can still according to the rest of the original information, the data as complete as possible to restore.

In fact, in the actual operation, delete files, repartition and quickly format (format do not add the U parameter), fast low lattice, restructure HDD defect list, etc., will not be the actual data from the physical sector erased. Deleting a file simply erases the file's address information in the list, and the file's data itself lies in the same place, unless you copy the new data into those sectors, and the original data is actually erased. Re-partitioning and quick formatting simply reconstructs the new partitioned table and sector information, as well as the physical presence of the original data in the sector until new data is available to cover them. Fast low lattice generally only the original DM can be implemented, is the DM software to quickly rewrite the disk, head, cylinder, sector and so on initialization information, still will not be the data from the original sector erased. The reorganization of the HDD defect list is simply to add the new defect sector to the G list or P list. There is no way for the data that is stored in the defective sector, because the sector has been physically damaged, it is difficult to recover even if the list of defects is not added, but there is no real impact on other data. The data recovery of such a hard disk, which is a relatively simple data recovery, the most important point is that after the error operation, do not make any of the hard disk do not know the purpose of the meaningless operation and do not go to the hard disk to write anything.

The data of this hard disk can be recovered by pure software operation. At present, we can find the data recovery software is very much, roughly easyrecovery, Recover, Lost&found, FinalData, Disk Recover and so on, there are many other, do not enumerate. Some of these software run under DOS mode, some can run under Windows mode, and can even run under nt/2000 to handle the data lost in NTFS-formatted partitions. The software mentioned above has a pretty good effect for mistakenly deleting, error formatting, and no other data to overwrite these forms of data recovery. Of course, if you let a rookie and a veteran to use the software, the recovery effect will be very different. To improve the success rate of data recovery, the key is to master the characteristics of each software and the parameters and characteristics of each operation, targeted reasonable choice, with the use of, it is necessary to accumulate a certain amount of experience to do. At present the domestic data recovery company to this series of data recovery quote is each hard disk 350~1000 yuan Yuan.

Pure software Recovery Of course has great limitations, the prerequisite is that the hard disk must also be able to use the normal line. Therefore, for some slightly defective hard disk, a little repair, so that the hard disk can be used normally, then the software data recovery is sensible, because this can save a lot of data recovery costs. After all, for those hard drives that can't be moved at all, the software is powerless, which requires a more costly combination of hardware and software recovery.

Two, "Hardware and software Combination" data recovery method

With the combination of hardware and software data recovery methods, the key is to restore the equipment used. These devices are required to be placed in a clean, dust-free workshop, and the workbench inside these devices is also a very high level of clean space. These devices are also very similar to the principle of recovery, are the hard drive apart, put the disk into the machine's Super Clean workbench and then scan the disc surface with a laser beam because the magnetic signal on the disk is actually a digital signal (0 and 1), so it is also different from the signal emitted by the laser beam. These instruments are through such a scan, a trace of the entire hard disk of the original signal recorded in the machine attached to the computer, and then through a special software analysis to carry out data recovery. It can be said that the data recovery rate of this equipment is quite alarming, even if the data is located in the physical bad road, because of the lack of a variety of information can not find the exact data value, but also through a large number of operations, in a variety of possible data values between the generation, combined with other related sectors of data information, logical reasonable check, So as to find the most logically consistent truth.

For the above mentioned equipment and methods, the current domestic data recovery equipment, can do a combination of soft and hard recovery methods of the company, according to the data show that currently only two, respectively, located in Beijing and Guangdong (data is valid for April this year, and perhaps other companies say they have such equipment, But I think the possibility of speculation than I missed the possibility of a larger. Now many data-recovery companies boast that they have more advanced equipment, more sophisticated technology, but in fact most of them stay at the level of pure software recovery. Really hit a tough plate, they will express to the companies in the two places, let them go to use the machine to recover, and these two companies also recognize this mode of operation, because they do not need to spend money to advertise, but also to ensure that the machine can have enough work load, shorten the payback period. This level of data recovery, the current domestic market price is about every hard drive 3000~5000 yuan or even more. Of course, the two companies received from other data recovery companies transferred to the hard disk, the collection is the wholesale price, which is about hundreds of to 1000 yuan in the difference, of course, let those data recovery company as intermediary fee to eat.

Third, "deep signal restore" data recovery

But this is still not the ultimate way to restore data. Because they all have a premise that the data is not covered. For already covered data, complete low lattice, total clear 0, strong magnetic field damage to the hard disk, still have the ultimate data recovery way, the old American tube this is called "deep signal restore."

The specific principle is more complex, but it can be illustrated by a related example. For example, a person driving hit a person, ran away, in order to escape the police investigation, he crashed the car into the sunken place to straighten up, and sprayed with new paint. So, the car that has been treated like this, can not see the collision traces under the naked eye observation. But the forensics people only need to use arc lamp to illuminate the car, wear a special polarizer to see, the traces of collision immediately at a glance. "Deep signal restore" applies a similar principle. From the point of view of the hard disk head, the same data, copied into the original no data of the new disk and copy into the old disk to overwrite the original data, there is no difference, because this time the magnetic head to read the digital signal is the same.

But for the magnetic medium crystals, the situation is a little different, the previous data, though covered, still retains the "remnant" of the original data, and by using different wavelengths and intensities of rays to illuminate the crystal, different reflections, refraction and diffraction signals can be produced, which means that Using these devices emits different rays to illuminate the disk surface, and then by analyzing a variety of reflection, refraction and diffraction signals, we can "see" the residual shadow of this magnetic medium crystal at different depths. According to current data, it is possible to observe the 4~5 layer, that is, even if a data is repeated over 4 times with different data, there is still the possibility of being read out by the "deep signal restore" device. Of course, such operating costs are undoubtedly very high, it can only be used at the level of national security, and few countries around the world can have such technology, and only a handful of large computer companies and government agencies without cost can have such a level of data recovery equipment, and are largely owned by Americans.