What happens after the disk is incorrectly formatted?

What is the most expensive computer? is the CPU, or memory, or hard disk? None of these parts can be replaced, only the data is the most critical, data loss is the biggest loss. Do you often hear or see a friend complain that "I can't read the data on my hard drive?", "My hard drive has been incorrectly formatted, and there's important data in it, what do I do?", or "yesterday's just written document was mistakenly deleted, how to find it?" Wait, the sky has the accident situation, the person has the unforeseen, if which day this complains person is our own, how to do? If it is not important to the user data, then lost, not too much relationship, but if the data is important to the user, then the data loss How to do? Let me explain some of the basics of data recovery.

First of all, for important data, backup data is the fundamental way to prevent data loss, and data recovery relies on many factors, it is difficult to fully recover data, generally can only recover part of the data.

Data recovery is to retrieve lost data, such as completely delete a file or folder, reformat the disk, repartition the disk and so on will cause the loss of data. More serious data loss is the storage medium hardware damage, for example, the hard drive accidentally broken, hard disk is not recognized at all, the hard drive has a lot of bad way and so on. The most noteworthy point is that once you realize that the data is lost, immediately stop some unnecessary operations, mistakenly deleted, mistakenly, do not write data to the disk! After the disk is broken, do not add electricity! Disk appears bad way to read, do not repeatedly read the disk and so on.

The data is stored in the storage medium, the storage medium is divided into 2 kinds, one is temporary, such as memory, once the power off, will be completely lost, another one is permanent, large capacity is mainly optical media and magnetic media, such as hard disk, CD-ROM, floppy disk, tape machine, etc., can be a long time to save data, not by the impact of power outages, The newer storage devices are USB flash drives, CF cards, SD cards, xd cards, and more.

All along, the hard disk has the fast, the capacity is big, the operation is convenient, may the random access, the reliable and so on merit, are the computer system most main storage equipment, simultaneously also is the computer system most easily fails the component. Over the past more than 10 years, the computer CPU has been running faster than I know how many times, from dozens of MHz up to now more than 3GHz, computing and processing functions has been a few generations of leaps. Other parts, such as graphics cards, the sound card and the optical drive have been replaced many generations, only the hard disk of the most important storage device, although the capacity and speed has been greatly improved, but the basic structure and working principle is still not much change, and due to the speed of the hard disk and the increase in density, hard disk than before more easily damaged and CDs, floppy disks, tape drives and so on are mainly used as backup data, USB flash drive more for temporary exchange of data.

Hard disk failure can be divided into two major categories: hard and soft faults. Hard fault, namely PCBA board damage, disc scratch, chip and other original devices burnt out, broken needle break, the head voice coil motor damage, etc., is due to the hard disk of its own mechanical parts or electronic components damaged and caused. Violent vibration, frequent switching machines, circuit short-circuit, power supply voltage instability, such as easy to cause physical failure of hard disk, hardware fault generally performance for CMOS hard drive, often a "click click" of the magnetic group impact sound or motor does not turn, power after no sound, the head does not cause errors such as reading and writing, Most of the cases described above are typically sent to a dedicated data recovery Center to detect and recover data.

Hard disk software failure is the hard disk data structure for some reason, such as the virus caused by the hard disk data structure is not even recognized the formation of the fault. In general, the motherboard BIOS hard drive automatic detection (IDE HDD Auto detection) feature detects hard drive parameters and is a soft fault. Under normal circumstances, the hard drive in the event of a failure in the system will display a number of prompts on the screen, so we can follow the on-screen display of information to find the cause of the failure, targeted implementation of the solution. Soft faults include error partition, error format, mistakenly delete, clone, MBR loss, boot sector loss, virus damage, hacker attack, loss of partition information, RAID0 disk array, RAID1 disk array, RAID5 disk array failure, and other factors caused by data loss. Hard disk soft faults are easier to fix than physical failures, and the damage to the data is less than the physical failure of the hard disk.

The following mainly explains the hard disk after the soft failure of the approximate method of data recovery, part of the principle can be used for USB disk, CD-ROM and other data recovery.

Basic knowledge-hard disk, zoning and file system introduction

Hard drive internal structure

About the hard disk structure of the article has been very much, but really want to make it clear, even if a special book can not finish, so here is no longer from the beginning of the story.

The most basic component of hard disk is a platter coated with magnetic media made of hard metal materials, and the number of platters of different capacity hard disks varies. Each platter has two sides and can record information. The platters are divided into many scalloped areas, each region being called a sector, and each sector can store 128x2 N-n=0.1.2.3 bytes of information. In DOS, each sector is a 128x2 of 2 times = 512 bytes, the disc is centered on the disc center, concentric circles of different radii are called tracks. In a hard disk, a cylinder consisting of a track of the same radius of different platters is called a cylindrical surface. The track and the cylinder are circles of different radii, in many cases, the track and cylinder can be used interchangeably, we know that each disk has two faces, each face has a head, the habit of using magnetic number one to distinguish. sector, track (or cylinder) and the number of heads constitute the basic parameters of the hard disk structure. In older hard drives, the older CHS (CYLINDER/HEAD/SECTOR) structure is used. Because a long time ago, when the capacity of the hard disk was very small, people used the structure similar to the floppy disk production of hard drives. That is, each track of the disk disc has the same number of sectors, resulting in the so-called 3D parameters (disk Geometry), that is, the number of heads (Heads), cylinder number (cylinders), sector number (sectors) and the corresponding 3D addressing mode. For today's new hard drives, all have not adopted such a structure, but the use of a more scientific structure, the current hard disk is linear addressing is directly using the sector area code to access the hard drive, 137G below the hard disk using 32-bit integer as the sector area code, The hard drive above 137G uses a 48-bit integer as the sector area code.

CHS Structure System

Where: The number of heads indicates that the hard drive has a total of several heads, that is, there are several platters, the maximum is 255 (with 8 bits storage); The number of cylinders indicates that there are several tracks on each side of the disk, the maximum is 1023 (10 bits storage), and the number of sectors indicates that there are several sectors per track with a maximum of 63 ( 6 bits storage); Each sector is typically 512 bytes, so you can theoretically take any number you like, but it seems like you haven't found anything yet. So the maximum disk capacity is:

255X1023X63X512/1048576=8024MB (1m=1048576bytes)

or the hard disk manufacturer commonly used unit:

255X1023X63X512/1000000=8414MB (1m=1000000bytes)

Because the number of sectors per track is equal in the CHS structure of an older hard disk, the recording density of the heretics is much lower than that of the inner channel, which wastes a lot of disk space (the same is true for floppy disks). To further improve the hard disk capacity, now the hard disk manufacturers have to use the same density structure to produce hard drives. This means that the track length of each sector is equal, and the sector of the outer ring track is more than the inner ring track. With this structure, the hard disk no longer has the actual 3D parameters, the addressing mode is also changed to linear addressing, that is, the sector is the unit to address. In order to be compatible with old software that uses 3D addressing (such as software using the Biosint13h interface), vendors typically install an address translator within the hard disk controller that is responsible for translating the old 3D parameters into new linear parameters. This is why the 3D parameters of the hard drive can now have multiple choices (different working modes can correspond to different 3D parameters, such as LBA, LARGE, NORMAL). With the increase of disk density, the further complexity, function and speed of the mechanism, today's hard disk will be divided into a large capacity in the disk, known as the "System reserve" area, used to store the hard disk of various information, parameters and control procedures, Some even put the fireware of the hard disk into the system retention area (the original information is stored in the hard disk control circuit board on the chip). This can further simplify the production process, speed up production and reduce production costs, but on the other hand, but also greatly increase the number of hard disk fatal damage and shorten the life of the hard disk.

Principles and methods of data recovery

found that the hard drive failure, need to recover data, the first step to do is to detect, determine the cause of the disk failure and data corruption degree

You can take the correct steps to recover data only by clarifying the extent of the damage to the disk and the cause of the failure:

Hard disk internal failure, the performance of the general is CMOS does not recognize the hard drive, hard drive abnormal sound, then the probable cause of failure physical track damage, internal circuit chip breakdown, head damage and so on, can be used to repair means: internal circuit overhaul, in the super clean Open the disc cavity repair, this situation can only be sent to professional data recovery company.

Hard drive external circuit failure, if the CMOS does not recognize the hard drive, the hard drive is no different, then the possible cause of the failure of the circuit board is damaged, chip breakdown, voltage instability and so on, you can take the means of external circuit repair, or replacement of the same type of hard disk circuit board, generally need to send to professional data recovery

Soft fault, if the CMOS can identify hard disk, usually hard disk soft fault, the cause of damage is generally the system error caused by data loss, partition, mistakenly delete, false cloning, software conflict, virus destruction, etc., can be used in a dedicated data recovery software or manual methods.

The following is a detailed explanation of the soft fault data recovery method

Identify the cause of data loss failure

Hard drive data is missing and the cause of the failure includes:

Virus destruction, false cloning, hard disk error format, the partition table lost, mistakenly deleted files, mobile hard disk letter can not recognize (unable to read the data, hard disk 0 track damage), hard disk partition, disc logic bad area, hard disk has physical bad area.

Document data corruption, such as damaged Office series data files, Zip, MPEG, ASF, RM and other file data corruption.

According to the fault reason, adopt the corresponding means and steps

Backup data, depending on the importance of the data to determine whether the need to back up the data, the general steps to back up the data is

Remove the damaged hard drive, receive another good machine, note that there is enough hard disk space backup on the new machine

Using Ghost's Raw Mode (raw), a slice of a sector that backs up the damaged disk into a mirrored file. If there is a physical bad track on the hard drive, it is best to make a disk image in a ghost way, and then all operations are performed on a disk image, which will maximize the protection of the original disk from further damage and maximize the recovery of the data.

Repair hard disk data repair hard disk data There are 2 types, one directly on the original hard drive, one is to store the readout data on the other hard disk. The basic idea is that based on the existing information on the disk to maximize the inference of the missing partition and file system system information, the damaged files and systems restore, so if the information loss too much, then it is impossible to recover the data. For example, after the deletion of a file, and then copied the larger file over, then most of the deleted files are new copies of the file covered, almost cannot recover.

One common sense is that if you want to recover data, do not run ScanDisk or Norton Disk Doctor software that directly fixes file system errors on the wrong disk, remember.

The following are examples of different situations:

The partition table loses, the partition table is the hard disk important data structure, manages the entire hard disk the space. First, introduce the relevant knowledge

0 tracks, MBR and partition table DPT:

The 0 track is in a very important position on the hard disk, and the primary boot record area (MBR) of the hard disk is in this location. Once the 0 track is compromised, the hard drive's primary bootstrapper and partition table information will be severely compromised, causing the hard drive to fail to lift itself. The following figure.

Mbr:

When partitioning the hard disk through Fdisk or other partitioning tools, the partitioning software establishes the MBR (main boot record) in the hard disk 0 cylinder 0 Head 1 sector, which is the primary boot recording area, in the first sector of the entire hard drive, in a total of 512 bytes of the primary boot sector, The main bootstrapper occupies only 446 bytes, 64 bytes to DPT (disk Partition table), and the last two bytes (AA) belong to the partition end flag. The role of the primary bootstrapper is to check that the partition table is correct and to determine which partition is the boot partition, and to transfer the partition's launcher into memory at the end of the program.

Dpt:

The partition table DPT (disk Partition table) divides the hard disk space into several separate contiguous storage spaces, that is, partitions. The partition table DPT is marked with a 80H or 00H start, with 55AAH as the end sign. The partition table determines the number of partitions on the hard disk, the start and end sectors of each partition, the size, and whether it is an active partition.

By destroying the DPT, the hard disk partition information can be easily destroyed. Partitioned tables are divided into primary partitioned tables and extended partition tables.

The primary partition table is located in the back of the hard disk MBR. Starting from 1BEH bytes, it occupies 64 bytes and contains four partitioned table entries, which is why the primary and extended partitions of a disk can only have a total of four reasons. The length of each partitioned table entry is 16 bytes, which contains the boot flag, System flag, starting and ending cylinder number, sector area code, number of magnets, and the number of sectors in front of the partition and the sectors occupied by the partition. Where the boot flag indicates whether the partition is bootable, that is, whether the partition is active. This partition is an active partition when the boot flag is "80″". The system flag "determines the type of the partition, such as" 06″ dos FAT16 partition, "0b" is dos FAT32, "63″ is a UNIX partition, etc., the start and end of the cylinder number, the sector area code, the number of magnets indicates the starting and ending position of the partition.

The 16 bytes of the partitioned table entry are assigned as follows:

1th byte: Boot flag

2nd byte: Starting head

3rd byte: Low 6-bit is the starting sector, high 2-bit and 4th byte is the starting cylinder

4th byte: Low 8 bits of the starting cylinder

5th Byte: System flag

6th byte: Terminating head

7th byte: The lower 6 bit is the terminating sector, the high 2 bit and the 8th byte is the terminating cylinder

8th byte: End cylinder low 8 bit

第9-12 Bytes: Number of sectors before this partition

第13-16 Bytes: Number of sectors occupied by this partition

An extended partition occupies a table entry in the primary partition table as a primary partition. The sector indicated at the start of the extended partition (that is, the first sector of the partition) contains the first logical partition table, also starting with 1BEH bytes, and each partition table entry occupies 16 bytes. A logical partition table typically contains two partitioned table entries, one pointing to the current logical partition, and the other to the next extended partition. The first sector of the next extended partition contains a logical partitioned table, so that the extended partition can contain multiple logical partitions. For the convenience of illustration, we have numbered this series of extended partitions and logical partitions, and the primary extended partition is the 1th expansion partition, the first logical partition table contains two partitions labeled 1th logical AND 2nd, and so on.

The partition in the primary partition table is the primary partition, and the Extended partition table is a logical partition, and only one extended partition can exist.

FS is the file system, located within the partition, used to manage the storage of files in the partition and various information, including file name, size, time, actual disk space occupied. The file systems currently used by Windows include FAT12,FAT16,FAT32 and NTFS systems.