What to look for when data is recovered

What to look for when data is recovered

First, do not format the partition again. The partition type changes after the first time the user formats the partition, causing data loss, such as the FAT32 partition Gecheng NTFS partition, or the original NTFS partition formatted as a FAT32 partition. After data loss, the normal software can not scan the original directory format, the partition will be formatted again to the original type, and then scan the data. We point out that the 2nd time the format of the original partition type is a serious error operation, it is likely to restore some of the large files can be destroyed, resulting in permanent unrecoverable.

Second, do not restore the data directly to the source disk. Many users delete files, with the general software recovered from the file directly restored to the original directory, so the possibility of destroying the original data is very large, so strictly prohibit the direct restore to the source disk.

Third, do not rebuild the partition operation. Partition table destruction or partition is deleted, if directly using the Partition Table reconstruction tool directly to establish or format the partition, it is easy to destroy the original partition of the file allocation table (FAT) or file Records (MFT) and other important areas, resulting in a significant recovery difficulty. We have encountered many times in the process of recovery in the customer after the partition table is destroyed, first of all, I tried several partitioning tools can not recover data after the idea of looking for professional help, we found that after a variety of partition tools, damaged some important directory files, resulting in incomplete file directory recovery, some large files can not be restored. And according to customer description of the initial partition loss, these files can generally be fully recovered, it is a pity ah. Professional data recovery personnel in the reconstruction of the partition table before the specific location of the partition (logical sector area code), and then use the Sector View tool to check the partition's several important parameters such as DBR/FAT/FDT/MFT, and so on, confirmed before modifying the partition table, And after the partition table is modified, the system will be prevented from doing dskchk to destroy the partition directory to ensure the data will not be destroyed.

Four, data recovery process must not cause data damage two times, or recovery difficulty. In the process of data recovery, it is forbidden to write new data to the source disk.

Do not do dskchk disk check. General file system error, the system boot into the splash screen will automatically prompt for a disk check, the default 10 seconds after the start of the DSKCHK disk check operation, this operation can sometimes repair some small damaged directory files, but many times will destroy the data. Because of the complex directory structure, it cannot be repaired. After the repair fails, a directory such as FOUND.000 is formed in the root directory, which has a large number of files with the. chk extension. Sometimes these files can be restored by changing their names, and sometimes they are ruined, especially FAT32 partitions or large database files with NTFS.

Do not redo the array after the array is lost. We have been in the practice of saving the server array has encountered some network management in the server crash after the force to let the array online, even if the hard drive offline, or directly to do rebuilding. These operations are very dangerous, and any write disk operation is likely to corrupt the data.

Seven, after the data is lost, must forbid to need to restore the section to save the new document. It is best to turn off the download tool, do not surf the internet, turn off unnecessary applications, and then scan for recovery data. To restore a partition that is a system partition, when the data file deletion is lost, if this computer has no database and other important data, we recommend that you direct the computer power off, and then put the hard disk to the other computer to restore, because in the shutdown or power-on state, the operating system will write data to the disk, may destroy the data.