FAT Data Recovery Software http://www.datadoctor.biz/images/ntfs-hm.jpghttp://www.datadoctor.biz/images/ddr-pro-hm.jpghttp://www.datadoctor.biz/images/rem-media-hm.jpghttp://www.datadoctor.biz/images/pendrive-hm.jpghttp://www.datadoctor.biz/images/memory-card-hm.jpghttp://www.datadoctor.biz/images/dig-pic-hm.jpg
Affichage des articles dont le libellé est Data Recovery Articles. Afficher tous les articles
Affichage des articles dont le libellé est Data Recovery Articles. Afficher tous les articles

01/04/2011

How to Recover the Data You Accidentally Deleted or Formatted from Hard Drive?

How to Recover the Data You Accidentally Deleted or Formatted from Hard Drive? Accidently delete important files using Shift+Delete keys? Can't get valued pictures back from the recycle bin after you cleaned? How to retrieve lost data and reconstruct inaccessible partition?
You are lucky! Deleting or formatting won't make the data erased permanently.Those deleted data are still stored in the hard drive. it's just invisible or inaccessible.  Only the FAT or NTFS table is erased (the information about where those data were saved), but the real data are still intact there in sectors of the hard drive.

So as long as those data are not overwritten by new data, it's highly possible to recover them. The most effective way is to rely on some data recovery program.

Try this program called Tenorshare Data Recovery. It can recover data after deeply scanning your hard drive to look for lost data you accidentally deleted or formatted.

Tenorshare Data Recovery is the powerful data recovery program. It can easily recover lost, damaged, formatted and accidently deleted data from your laptop or computer hard disk and all kinds of USB digital media drives. Deleted or formatted files in USB Drive, Pen Drive, memory card, removable media and lost pictures in digital camera can be retrieved immediately with Tenorshare Data Recovery.

MS Access Password Recovery & Encryption

MS Access Password Recovery & Encryption
 

Microsoft Access Password Recovery & Encryption Methods


 
Maintaining privacy and sneaking into privacy is an age old phenomenon. People made locks and keys to prevent unauthorized access and keep privacy. Keys were kept at safe places to ensure their safety. Passwords used to lock files and applications are soft versions of keys kept in some nook of mind. But with growing digital technology, the number of password to remember grew to large number. There are so many passwords to remember, at least 5 to 6 debit card passwords, credit card passwords, email account passwords, files password and many more. In the maze of passwords, it is easy to forget a password or at least get confused from a number of new and old remembered passwords. Some times it can also become necessary to open a password protected file belonging to some other person. Many software applications are available in the market that can  perform  Microsoft Access password  recovery very easily by help of powerful programs coded in them.
 

Recommended Software for Microsoft Access Password Recovery


http://www.recoveryknowledgebase.com/images/img-new/access_password.gif
 

Stellar Phoenix Access Password Recovery

Stellar Phoenix Access password recovery is indigenous software of Stellar Information Systems Ltd. for Microsoft Access password recovery. It supports password recovery for Microsoft Access documents created in 97/2000/2003 and 2007. The software can perform  Microsoft Access password recovery for version 2003 and earlier, instantly. For password protected files made in higher versions, a separate option is given. User can set options and masks to optimize the character set for Brute Force attack done to recover Microsoft Access password. This method takes some time but if the file is not corrupt and the masking options are done correctly, then the password recovery is guaranteed.
 
Stellar Phoenix Access Password Recovery is recommended software to recover Microsoft Access password. More information about the software can be collected from the link Page: www.stellarinfo.com/password-recovery/access-password-recovery.php
 

Understanding Microsoft Access


 
MS Access is a member application of Microsoft Office Suite. It is a relational database system that stores database in *.mdb or *.mdw format. MS Access can also link to databases made in other applications like MS SQL Server, Oracle, Outlook, etc. To prevent unauthorized access to database MS Access gives a password facility that can be implemented at user and database level. Database level password prevent database from opening to unauthorized persons while user level passwords prevent unauthorized access to the application itself. User passwords are not stored in database file as it is the case with database files. Many times it happens that the user forgets the password. It can also be necessary to open a database file due to security reasons during investigation. Till MS Access 97, the database application used very weak encryption that was easily recoverable. In MS Access 2000 and later versions the encryption method is considerably improved and application user level password option is eliminated.
 

Understanding Microsoft Access Password Security


 
Microsoft Access gives an option to set password that restricts unauthorized users to open Access database file. Microsoft Access used to provide user level passwords before its 2003 version but this option was eliminated in later versions. The encryption method used in Microsoft Access 2003 and lower versions was very weak, so it was very easy for Microsoft Access password recovery. A XOR operation of password key and Access document was done and stored in the header. But in later versions, Access database security is considerably increased. The process of Microsoft Access Password recovery became complex and time consuming. Microsoft Access application employed strong encryption methods that are immune to any direct attack. Only strategies to recover Microsoft Access Password possible for now are dictionary attack and brute force attack. Brute Force with masked attack, a variation of Brute Force attack is also used generally for quick Microsoft Access password recovery.
 

Password Mechanism in MS Access 97


 
MS Access 97 uses a weak password implementation system. It does XOR operation of password string and a constant array. The resultant is attached to the start of file as first 256 bytes of file. When XOR operation is done between two series of bits and if the resultant is again XORed with one of the operand, first operand is the resultant. This property of exclusive-OR operation is used to extract the password from the file. The password is stored in the file in plain text format. Array that is used for XOR operation with the password text is {&H86, &HFB, &HEC, &H37, &H5D, &H44, &H9C, &HFA, &HC6, &H5E, &H28, &HE6, &H13, &HB6, &H8A, &H60, &H54, &H94}. An XOR operation is done with Byte (I + &H42) and Array (I). The result of this XOR operation is the character of password. ‘I’ is an incrementing value and this process is repeated 16 times. Like this, all the characters of the password are found. A fraction of the algorithm used for password extraction process can be written as,
 
Array_For_Compare = Array {&H86, &HFB, &HEC, &H37, &H5D, &H44, &H9C, &HFA, &HC6, &H5E, &H28, &HE6, &H13, &HB6, &H8A, &H60, &H54, &H94}
    strPasswd = vbNullString;
    int I = 0;
   
    do {
        // Get a character from the password by doing a XOR with the appropriate value in  // XorBytes array.
        Currentalphabet = Char (Bytes (I + &H42) XOR Array_For_Compare( I));
        // If Currentalphabet = NULL get out of the loop.
         If (Currentalphabet = 0)
break;
        // concatenate Currentalphabet password character to password string.
        strPasswd = concat (strPasswd,  Currentalphabet);
        I ++;
}
    While (I<=17)
   
    File_password = strPasswd;
 
With such an easy method to find MS Access password, security in MS Access is considered as very fragile. Microsoft Access improved its password mechanism in its subsequent versions after Access 97.  Passwords of other versions of MS Access like 2000, 2003 can be recovered using techniques like dictionary attack, brute force attack, or brute force masked attack.
 

Various Password Attack Methods


 

Dictionary Attack

Many people keep meaningful words of some object or other dictionary word as password. The password can be name of animal, place, thing, habit or any other dictionary word. People think that setting dictionary words as password will help them in remembering the password easily. Dictionary attack is based on this psychology. All the words of dictionary are compared linearly with the password to find a suitable match and  Microsoft Access password recovery ultimately.
 

Brute Force Attack

 
Brute Force attack is based on the fact that if password exists then it is among one of the permutations of the available set of characters. Brute Force attack makes words of all the possible arrangement of characters and matches them with the file one by one. Eventually, at any point of time the combination that makes the password will be matched and found. This method of Microsoft Access password recovery can take time from seconds to a number of days.  
 

Brute Force with Mask Attack

 
Brute Force matches all the possible combinations of the given character set. The length of character set ranges from one to unlimited and also the character set includes all the characters that can be typed from keyboard. If all the possible combinations of all the possible characters is matched then it will take a lot of time may be thousands of years for Microsoft Access password recovery. Brute Force with masked attack works on the principle that if any information about the password is known, it can be used to reduce the number of combinations of characters made for  Microsoft Access password recovery. Maybe the starting characters are known, length of password is known, boundary of the length is known, only small letter alphabets are used or characters that are not used for making the password are known. All these factors reduce the number of attacks needed for Microsoft Access password  recovery considerably.
http://www.recoveryknowledgebase.com/Microsoft-Access-Password-Recovery.htm

31/03/2011

Deleted recovery Book v1.0 article

3. Deletedrecovery

Eg: Here is a folder” my file”, whose contents are as following:

Delete it:

Empty your “recycle bin”

---------Run Data Recovery Wizard 3.0:

Select “deletedrecovery” then choose the partition that you want to recover.


Click “Next” and scan the deleted files, choose the deleted folder” my file”
 Tick it and click “Next” to enter the interface of choosing path for saving files.

Choose a partition with large space to save the files

Data Recovery Book V1.0

Click “Next”, after recovery, there will be a Report interface.
  If you want to check the recovered files, please click “file saved to”.

Enter the folder “found files” created by Data Recovery Wizard 3.0 and you can see the recovered folder/file:


If you are not satisfied with the result, you can use “AdvancedRecovery” module, and repeat steps above.

4.FormatRecovery

Eg: Format a partition from NTFS to FAT32

Run and choose “FormatRecovery”, and then choose the formatted partition and tick the previous file system(here is “NTFS”)in “Previous File System”

Matters needs attention before recovery

2. Matters needs attention before recovery

(1)Never operate on partition (such as write and create file) where the data lost. (2)Please close any other application program when Data Recovery Wizard 3.0 is running. (3)Make sure that there is no physical failure (such as physical bad track) on the disk you are operating. If there is any problem, please stop running Data Recovery Wizard 3.0, and send your disk to maintenace station.

(4)Do not save the recovered files to the original partition. You need make sure that there is enough free space to save the recovered data; also you can save your files to removable devices or network devices.

Here are some examples of using Data Recovery Wizard 3.0.

Introduction of Data Recovery Wizard 3.0

Case Study1
1. Introduction of Data Recovery Wizard 3.0

Data Recovery Wizard is an advanced data recovery software. In Windows, this software can recover data on different storage media and partitions.

General Functions of Data Recovery Wizard 3.0

Deletedrecovery: This module works only with deleted files and allows to “undelete” them (another popular term is “unerase”). Intact file system is important for this module. If you know that there is something wrong with your file system (for example, you did not delete some folder/files but you cannot access them) or if you see something strange with Windows, you should use “AdvancedRecovery” module.

Formattedrecovery: A common data recovery situation is accidentally reformatting a partition. The FormatRecovery tool will allow you to recover files from a partition, which has been accidentally formatted or reinstalled. This type of recovery will ignore the existing file system structures and search for structures associated with the previous file system. If you are not satisfied with the result, you should use “AdvancedRecovery” module

AdvancedRecovery:you can use this function to recover your damaged system, deleted partitions, misoperation of HD and deletion caused by virus.

RawRecovery:The RawRecovery tool allows you to scan severely corrupted partitions for files with a file signature search algorithm. This tool will help you recover files from a partition with damaged directory structures.
 

Common Cases of Partition Recovery book v1.0


Ⅵ.Common Cases of Partition Recovery

1.MBR Recovery

On condition that there is no problem with hardware, the first step is MBR recovery. MBR

recovery is simple because it is system data. Though it may be created by different software and the code might be different, the method is the same. Even if multi-system boot, it is not hard. You can backup the data to be recovered after the system boot turn to be normal, and then restore the multi system boot.

Recover MBR by fdisk

The simplest way to recover MBR is Fdisk, whose command is simple too; you can use

“Fdisk/MBR”. Please note that, the hard disk to be operated should be connected on mater IDE interface as the master hard disk. As to other connection way, we need appoint the interface location of IDE device in form of “Fdisk/CMBR”.

The command syntax of Fdisk command line is “Fdisk/parameter switch”. Besides that obtained by “FDISK/?”, there are some hidden parameters information:

/ACTOK

Parameter Function: not to check bad sectors on disk surface

Details: It can speed up partition operation.

/CMBR

Parameter Function: to re-create MBR of appointed disk

Details: Equals to /MBR parameter, except that it can appoint certain disk

/EXT

Parameter Function: to create extend partition.

Details: Creates extend partition on the currency disk , which used to create logical partition.

/FPRMT

Parameter Function: to check the usage of FAT16 and FAT32 in interactive mode. Details: When /FPRMT parameter is added, there will be no query of that whether supports high-capacity hard disk; while there will be a query that it uses FAT16 or FAT32 when creating a new partition.

/LO

Parameter Function: to rebuild logical partition.

Details: Used to create logical disk, /LOG and /EXT should work together.

/LOGO

Parameter Function: to create logical partition with FAT16

/MBR

------------------------------------------------------------------------------------------------------------------------------------23 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0  Parameter Function: to re-create MBR of master disk

Details: to clear the system booting choice recorded in MBR after uninstalling Windows NT or Windows 2000

/PRI

Parameter Function: to create primary partition and activate it.

Details: e to create primary partition, and the partition will be set active automatically.

/PRIO

Parameter Function: to create primary partition of FAT16 and activate it.

/Q

Parameter Function: not to restart computer when ending Fdisk

Details: unnecessary to restart computer after changing the partition table.

/STATUS

Parameter Function: to display details of current partition

Details: When there is no logical partition in extend partition, the extend partition will not be displayed.

/X

Parameter Function: no LBA attribute

Details: there would be no partition with LBA attribute.

It makes handier to use Fdisk with these parameters. However, to hide the parameter will be more dangerous, which calls for more caution.

Uses Fixmbr to restore MBR

Provided by Microsoft, Fixmbr is a MBR recovery tool, which determines hard disk partition and re-construct MBR through overall search.

Only when using Windows 2000 recovery console that we can use Fixmbr. Windows 2000 recovery console can boot from Windows install CD. Fixmbr only revises MBR; it does not write other sectors, which is safe. You can get help information of Fixmbr as following when using Fixmbr/?.

The parameter “DriveNo” is to write a new MBR (driver). The device name can be obtained from output of the map command. For example, device name:

/Device/HardDisk0

The following command is to write a new MBR to the appointed device:

------------------------------------------------------------------------------------------------------------------------------------24 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0
fixmar /Device/HardDisk0

Attention: If we do not assign DriverNo, the new MBR will be written in booting device, namely the driver that loads host system. If the system detects invalid or the non-standard partition mark, it will prompt that whether continue to execute this command or not. Only if there are some problems with the driver you visit; otherwise, please do not continue.

By default MBR structure will be checked. If it is abnormal, it will prompt that whether recover or not. If choose “Y”, it will search partitions. When it has found the partition, it will also prompt that whether to revise MBR or not. If choose “Y”, recovery will be finished. If the system is down now, please inactivate the anti-virus function in BIOS first and then continue.

By default, it will search all existing hard disk, and finish all mentioned operations above. If the result is not right, you may use “/Z” parameter to clear the result and restart; then it returns to the original condition.

2.Recovery of Partition

The partition recovery is generally the second step of the whole process. Because apart from some tools that directly reads and writes hard disk, most of tool software runs under operation system, working with the system calling. While operation system’s visiting disk is on the basis of MBR

and DBR; without MBR and DBR, operation system is unable to visit file system. Therefore, if the partition table is corrupted, we need rebuild partition table, which is usually fulfilled manually; in some special cases it can be done automatically by some working software.

If partition table is corrupted, there are many tools to rebuild it automatically, if only the problem is not too serious. If it is too serious, or the partition table structure is too complex, it may possibly be out of the reach of their ability to rebuild. In this case, we need do it manually. Usually we use some tool software to recover the lost partition table, such as Norton Utilities 8.0, DiskMan, KV3000/Kavfix 和 PartitionMagic etc. Here we introduce Partition Table Doctor.

3.Partition Table Doctor

Partition Table Doctor is the only real software for hard disk partitions recovery. When you come up against a drive error (not hardware failure) this versatile tool would automatically check and repair the Master Boot Record, partition table, and the boot sector of the partition with an error, to recover the FAT16/FAT32/NTFS/NTFS5/EXT2/EXT3/SWAP partition on IDE/ATA/SATA/SCSI hard disk drives. It can create an emergency floppy disk or a bootable CD to recover the bad partition even if your operation system fails to boot. Partition Table Doctor manages for MS-DOS, Freedos, Windows 95/98/Me, Windows NT 4.0, Windows 2000, Windows XP and Windows 2003. There are two modes for partition recovery: “auto mode” and “interactive mode”.

------------------------------------------------------------------------------------------------------------------------------------25 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved
Data Recovery Book V1.0  Auto mode

If you can enter operation system, you can install and run Partition Table Doctor and choose

“Rebuild Partition Table”

In the procedure of rebuilding partition table, there are two ways to recover the lost partition:

Here we mainly refer to “Automatic”, so we choose “Automatic” (after this, in the whole process the users can not operate by themselves, the software will finish the work automatically.)

------------------------------------------------------------------------------------------------------------------------------------26 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0
Automatic will automatically rebuild and recover partition according to your former partition information. Usually we suggest this mode if users do not know much about partition. Of course, if you are not satisfied with the result, you can choose “Interactive” mode.

Interactive

Run Partition Table Doctor and choose “Interactive” in “Rebuild Partition Table”.

By this mode, Partition Table Doctor will display all the partition found, you can choose the partition you want to recover.

------------------------------------------------------------------------------------------------------------------------------------27 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0
In the partition interface that Interactive mode has recovered, we can see clearly all the partition information that existed as well as information on file system, volume label, CHS, size and logics of the corresponding partition. With the information, user can locate the partition they want to recover. Also, to verify that whether the partition can be recovered normally and the recovered partition is the partition user want, the software provides a “Browse” function, with which we can choose the right partition:

Click “Browse” and we can get file information of partition under root directory after recovery.

------------------------------------------------------------------------------------------------------------------------------------28 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0
And then you can be surer about the accuracy and efficiency, thus know the final result.

If the partition where your operation system locates is damaged and you cannot enter it, you can install Partition Table Doctor in another operation system,

By “Create Emergency Disk”, we can create an application under DOS to recover your partition:

------------------------------------------------------------------------------------------------------------------------------------29 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved
Data Recovery Book V1.0

Afterwards you can set your BIOS and then start from floppy disk, thus recover MBR by operation mode of Partition Table Doctor in DOS:

DBR recovery

MBR is for the whole hard disk, while DBR is for individual partition. The first sector of each MBR is DBR. Just as MBR, DBR contains some information that the boot operation system need. If DBR is corrupted, you can neither visit the partition nor start up the operation system of the partition.

If boot sector is damaged, the possible symptoms are:

1. Invalid media type reading drive

------------------------------------------------------------------------------------------------------------------------------------30 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0  2. Abort Retry Fail?

3. File system is displayed as “RAW”

4. Windows may ask if you want to format the drive

5. File names contain “weird” characters

6.”Sector not found” messages

Etc.

Moreover, for partitions of NTFS, the functions of DBR are not all the same as that of FAT

partition. For FAT partition, DBR locates FDT and FAT (correspondingly as well as DATA), but not verifying the correctness and reasonableness of FDT and FAT. For partition of NTFS, we need more units to load the file system, which is more complex than FAT.

What if when the DBR is destroyed? Usually, there are methods as following:

Recover DBR by Format

If there is no important data in this partition, or you have backed up the data, the best way to recover DBR is direct high-level format, fast format or complete format. If there is no limitation of partition form and capacity, there would be no difference between DOS format and Windows format except speed. Format is quite thorough, it can completely rearrange the data storage, even

“reset” former file fragmentation.

Although this method is simple, it cannot recover data actually especially if you choose some different parameters. If you choose different system reserved sectors, or use clusters of different size, or change the size of FAT table etc, data recovery will be more difficult.

Data recovery by Fixboot of Partition Table Doctor

If the boot sector of a Fat16/Fat32/Ntfs partition was corrupted, it will be marked with X by Partition Table Doctor. If you cannot access a Fat16/Ntfs partition and the partition was marked with X. Right click the partition and choose Fixboot. Partition Table Doctor will automatically check and restore the boot sector of the partition.

------------------------------------------------------------------------------------------------------------------------------------31 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0

If you cannot access the Fat32 partition and the partition was marked with X Right click the partition and choose Fixboot, there will be two choices:

'Auto' mode: Partition Table Doctor will automatically check and restore the boot sector of the partition. We recommend you choose this mode. If 'Auto' mode cannot help you, you can choose

'Interactive' mode. If so, you need input the volume label or a file name (under the root directory).

------------------------------------------------------------------------------------------------------------------------------------32  If you do not know what file name to input, follow the file name that is suggested: Boot partition:

io.sys msdos.sys ntldr bootlog.txt

Other partitions: _restore recycled

Note:

For Fat16/Fat32 partition, fixboot can effectively restore damaged boot sector of partition. For NTFS partition, even if boot sector is correct but MFT (Main File Table) is corrupted, symptoms are the same. We recommend you download the demo version of Partition Table Doctor to determine whether boot sector of partition was corrupted.

Mostly, scandisk that originally in operation system will destroy more than they retrieve. Please stop scandisk after logging on.

In addition, you may use WinHex to recover DBR

WinHex is powerful in disk editor. With backup DBR in WinHex to recover the DBR sector is convenient and fast. But for its strong specialization of WinHex we recommend that you choose easy-to-use software tool for integrity and correctness of the data.

4.The FAT table recovery

CIH destroys data backwards from partitions. In this case, system data in the former part may be destroyed and lost. If FAT2 is still intact, we may make FAT2 to cover FAT1. Usually we use DiskEdit and WinHex. Regarding to other forms of destruction such as format and so on, we usually make use of tool software to scan the whole disk, seldom manual recovery; because there are even dozens of trillions sectors a partition has several trillions. Depending on the manual analysis is impossible. For some extremely important data file, we can also recover manually.

Recover FAT by DiskEdit

After recovering DBR of FAT, if part of FAT1 is damaged while FAT2 remains intact (It is the most situation when destroyed by CIH), we may use FAT2 to cover FAT1. The specific method is to find the start sector of FAT2 and then start searching the start sector of DATA (if it is FAT16, search FDT). By this way, we can figure out the length of FAT table. According to length and the start sector of FAT2, we may know the start sector of FAT1. Copy FAT2 to the damaged FAT1, we can finally recover the whole partition.

Recover FAT by WinHex

Principle of recovering FAT by WinHex is the same as that by DiskEdit. After recovering DBR, we can make FAT2 to cover FAT1. After finding FAT2, we begin searching the start sector of DATA (if it is FAT16, search FDT). The division is distinct, because the conclusion part of FAT

must be 0 regions, otherwise there is not any free space (even so, in ordinary circumstances, there is still a bit of space in FAT after scanning DATA area. So the end of the last sector must be 0 too.). While at the beginning of DATA region or FDT region it mustn’t be 0. No matter there is fixed

------------------------------------------------------------------------------------------------------------------------------------33  for more information) FDT, the system always begins from second cluster. If there is FDT, it follows closely FAT2, and its file registration must exist; if there is not, then begins from data area where some data must

exists. Thus we may figure out the length of the FAT table, and then the start sector of FAT1 according to the length and the start sector of FAT2. Copy FAT2 to the damaged FAT1 we can finally recover this partition.

Hard disk data organization Book v1.0


Ⅴ.Hard disk data organization

1.Primary formatting of hard disk

Before restoring data, hard disk usually needs low-level format, partition, high-level format to be used. The function is establishing certain data logical structure on physical hard disk. Usually hard disk is divided into 5 regions: MBR, DBR, DIR, FAT and DATA (Here we do not introduce FAT

------------------------------------------------------------------------------------------------------------------------------------16 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) and NTFS file system), which altogether store and manage data.

Low level format

After setting parameter of hard disk in CMOS Setting, why the hard disk is still unusable? That’s about Cylinder, Header and Sector. When hard disk is firstly made in the factory, it usually is

“blank”. Only after partitioning tracks and sectors, we can save data on hard disk (Now, before leaving the factory, many disks have been low-level formatted. So you may need not do the operation, but it is not unnecessary.)

Main functions of low level format

Low level format can also be called physical format, whose functions are to detect the magnetic media, to partition tracks, to partition sectors for each track, and to arrange the order of partitions in track according to the interleave the customer choose. Its main functions are as following:

Test the hard disk media

Partition tracks for hard disk

Arrange sectors for each track according to the specified interleave

Set the sector ID to each track and finish setting sectors

Test the hard disk surface, mark “bad” to the damaged track and sector

Write a certain ASCⅡ to each sector of hard disk

Hard disk is an important storage resource in computer system. Do not low-level format the hard disk unless it is the only thing possible. For hard disk being used, you need back up important data before low level format; even if back up is unnecessary, it may take much time to partition, high-level format, and install system and application programs. Usually, low level format can be used in the following cases:

1

When you have bought a new hard disk or hard disk adapter, you’d better low level format it again, which is for the better matching of hard disk and hard disk adapter.

2

“Bad” sectors, which result from long-time operation, often cause “sector not found” error in DOS. This is because of the loss of sector ID. Sector ID is used to distinguish the sectors. It is marked onto disk as the magnetization map, which however, may dribble away for long-time storage or use. Low level format is the only way for computer users to refresh sector ID in disk. This assignment cannot be done by high level format.

3

Appropriate set of interleave can fasten data transfer. In most conditions, low level format is the only way to change the interleave.

4

When there are always inexplicable problems, you can take low level format into consideration.

Ways to low-level format

------------------------------------------------------------------------------------------------------------------------------------17 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) There are many ways to low-level format. In early time, it can be completed in CMOS or by some special disk tools, or by writing some short programs in Debug. Nowadays, people usually use special tools provided free by hard disk manufacturers.

2.Advanced formatting of hard disk

High-level format

After partitioning the hard disk, some “independent” logical drivers are founded. If now we start system from the floppy drive, enter DOS, then you can see the drive letters of DOS partition, which is on behalf of logical driver, for instance “C:”, “D:” and so on. The system commonly arranges letters according to alphabet. Now let’s try to enter “C:” or “D:” after that we can see the system prompt that “DISK MEDIA ERROR”. Why? These logical disks are empty; to use them, we need create file system. The whole process is high-level format of logic disk. The high-level format certainly aims at the logic disk, neither physical disk nor certain directory. For file system is corresponding to logic disk, we can say that high-level format aims at file system. In this article, logical disk means logical drive.

Format partition

High-level format of DOS logic disk can be completed by “format” command. Main functions of high-level format are as following:

Assign logical serial numbers for sectors (serial numbers in partition) from cylinder that assigned by each logical drive

Establish DBR in basic partition, and load 3 system files of DOS if there is “/S” parameter in the command.

Establish file allocation table (FAT) in each logical disk.

Establish File Directory Table (FDT) that is corresponding to root directory and data area.

If you carry out high-level format by “Format” command, please pay attention to following 4 items.

1. To already activated basic DOS partition (generally it is disk C), you need the following command:

Format C:/s

By this command, you may install DOS system files after high-level format, to make this logical disk to become the boot disk. Certainly, you may also use “SYS” command to send system files after high-level format, that is complete the boot disk and file transmission by the following two commands:

------------------------------------------------------------------------------------------------------------------------------------18 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) Format C:

SYS C:

Continuously using these two commands equals to “Format C:/S” command.

2. For other logical disk, we only need to carry out the following commands:

Format [ d: ]

“d” is the logical disk drive.

3. Before format, on the screen it may appear the following prompt information:

WARNING: ALL DATA ON THE DISK

DRIVE C: WILL BE LOST !

Proceed with Format (Y/N) ? _

This information is warning user: The format will cause all data lose! Then, if user choose “Y”, then the high-level format officially carries on, if user choose “N”, then nothing will happened and exit.

4. For the using disk without adjusting the partition, also may carry on the fast format, the command is:

Format C: /Q

The full command of “Format” in Windows 2000 is as following shows:

Format hard disk partition in Windows

In explore of Windows, everything is displayed by graphics, and different forms (partition) are expressed by different colors. Click the right key in the corresponding partition, and choose

“format”, you may also choose fast format, complete format and so on.

Format hard disk partition by Partition Magic

In Partition Magic, everything is displayed by graphics, and different forms (partition) are expressed by different colors. Click the right key in the corresponding partition, and choose

“format”. In the dialogue box, there will be a prompt indicating this operation may destroy your own data, and in the box you may also choose different format.

Format hard disk by various hard disks special-purpose tool in hard disk factory Low level format tool provided by various hard disks factory can help hard disk breakthrough

------------------------------------------------------------------------------------------------------------------------------------19 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) hard disk capacity limit, as well as complete low level format, the high-level format and make partitions. After partitions are done, you can choose corresponding options step by step.

Attention: To partitions with data, backup the data before format.

High-level format establish the file system, after format, it may carry on write in and read out operations with file as unit.

3.Data storage region of hard disk

In command to know hard disk better, we must have a simple understanding of hard disk construction. (NTFS uses different file management technology with FAT16 and the FAT32 file system, here we only introduce FAT16 and FAT32) The hard disk data may divide into 5 parts approximately according to its different characteristics and functions: MBR area, DBR area, FAT

area, DIR area and DATA area. Among them, MBR is founded by the partition software, while DBR area, FAT area, DIR area and DATA area are founded by high-level format procedure. When file system writes in data, it just rewrites corresponding FAT area, DIR area and DATA area. Also it is the result which these 5 regions affect together. Only by this way, hard disk can be managed methodically. Here are some introductions to the 5 regions.

MBR:

The first physical sector (cylinder 0, head 0, sector 1) of the first hard drive in the system (the first hard drive with the BIOS device number 0x80); each hard drive contains an MBR, but not every BIOS can start the corresponding operation system from every hard drive. When booting from the hard drive, the BIOS or a special Firmware loads the contents of the MBR to a fixed address in the memory and allows it to take control. This code then loads either the operation system from a bootable hard drive partition, or from a complex boot loader, such as LILO.

Short for DOS Boot Record , it is the sector at cylinder 0, column 1, and sector 1 of a hard disk. DBR is the first sector that the operation system visits. It contains a boot program and a BPB (BIOS Parameter Block). The main task of the boot program is to determine whether the first two files in root directory of this partition are the boot files of operation system, when MBR hands over the system mastery to it. Take an example of DOS, i.e. IO.SYS and MSDOS.SYS. DOS of low edition requests that these two files are the first two files, and located at the section start of the root directory, covering the first two directory items (the high edition does not have this requirement.). Moreover, Windows and DOS are families; therefore, Windows follows the same management manner, except for the filenames. If it does exist, then reads IO.SYS in the memory, and hands over mastery to IO.SYS. BPB parameter block records the start sector, ending sector, file storage form, descriptor of hard disk media, size of root directory, number of FAT and size of allocated cell.

File Allocation Table (FAT) is a file system that was developed for MS-DOS and is the primary file system for consumer versions of Microsoft Windows up to and including Windows ME. The FAT file system is considered relatively uncomplicated, and because of that, it is a popular format for floppy disks; moreover, it is supported by virtually all existing operation systems for personal

------------------------------------------------------------------------------------------------------------------------------------20 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) computers, and because of that, it is often used to share data between several operation systems booting on the same computer (a multi-boot environment). It is also used on solid-state memory cards and other similar devices. It has a serious drawback in that when files are deleted and new files written to the media, the files can become scattered over the entire media making reading and writing a slow process. De-fragmentation is one solution to this, but is often a lengthy process in itself and has to be repeated regularly to keep the FAT file system clean. FAT is also called 12-bit FAT, the file allocation table (FAT) for a floppy disk. The location of files on a floppy disk are listed in a one-column table in the FAT. Because the width of each entry in a floppy disk column is 12 bits, the FAT is called FAT12. As a file system for floppy disks, it had a number of limitations: no support for hierarchical directories, cluster addresses were “only”

12-bits long (which made the code manipulating the FAT a bit tricky) and the disk size was stored as a 16-bit count of sectors, which limited the size to 32MB.

The FAT file system, as is the case with most file systems, does not utilize individual sectors, and there are several performance reasons for this. By using individual sectors, the process of managing disks becomes overly cumbersome since files are being broken into 512-byte pieces. If you were to take a 20 GB disk volume set up with 512 byte sectors and manage them individually, the disk would have over 40 million individual sectors. Just keeping track of this many pieces of information is both time, as well as resource, consuming. While some operation systems do allocate specific sector storage, they also require some advanced intelligence to do so. Bear in mind how old the FAT file system is, as it was designed many years ago as merely a simple file system, without the capability to managed individual sectors.

In order for FAT to manage files with some form of efficiency is to group sectors into larger blocks referred to as clusters, or allocation units. Cluster size, however, is not a predetermined size, but rather is determined by the size of the disk volume itself, with small volumes (disk sizes) resulting in smaller clusters, and larger volumes (disk sizes) using larger cluster sizes. For the most part, a cluster ranges in size from 4 sectors or 2,048 bytes to 64 sectors or 32,768 bytes. You should be aware that you may, on some occasions, find 128-sector clusters in use at 65,536 bytes per cluster, as well as some floppy disks with smaller clusters that is usual at just 1 sector per cluster. In all cases, the sectors in a cluster are continuous, therefore each cluster is a continuous block of space on the disk.

Cluster sizing, and therefore partition or volume size, as they are directly related, have an important impact on performance and disk utilization. In all cases, cluster size is determined at the time a disk volume is partitioned. Certain third-party partitioning utilities such as Partition Magic by PowerQuest can alter the cluster size of an existing partition within specific parameters. However, this aside, once the partition size is selected, so are the cluster sizes fixed. FAT 16 means that file allocation table that uses 16 bits for addressing clusters. It is commonly used with DOS and Windows 95 systems. A 16-bit DOS and Windows file system (see FAT) that varies cluster sizes based on hard drive size. Cluster sizes range from 4K (for drives up to 127MB), to 4K (255MB drives), 8K (511MB drives), 16K (1GB drives). and 32K (for drives up to 2GB). The ultimate capacity of a FAT16 partition is 2GB.

------------------------------------------------------------------------------------------------------------------------------------21 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) FAT 32 is a disk file allocation system from Microsoft that uses 32-bit values for FAT entries instead of 16-bit values used by the original FAT system, enabling partition sizes up to 2TB (terabytes). FAT32 first appeared in Windows 95B and is also found in Windows 98 and Windows NT 5.0.

In order to overcome the volume size limit of FAT16 while still allowing memory-constrained DOS real-mode code to handle the format, Microsoft decided to implement a newer generation of FAT, known as FAT32, with 32-bit cluster numbers, of which 28 bits are currently used.

In theory, this should support a total of approximately 268,435,438 (< 228) clusters, allowing for drive sizes in the range of 2 terabytes. However, due to limitations in Microsoft's scandisk utility, the FAT is not allowed to grow beyond 4,177,920 (< 224) clusters, placing the volume limit at 124.55 gigabytes, unless “scandisk” is not needed. Windows 2000 and XP placed a limit on the size of FAT32 partitions they can create at 32 GB, Microsoft says this is by design but does not explain why, and those versions of Windows are quite capable of reading and writing larger FAT32 partitions created by other means. FAT32 was introduced with Windows 95 OSR2. The many changes it incorporated made it a major improvement.

The maximum possible file size for a FAT32 volume is 4 GB minus 1 byte (232-1 bytes). For most users, this has become the most nagging limit of FAT32 as of 2005, since video capture and editing applications can easily exceed this limit, as can the system swap file.

32-bit File Allocation Table File System Not the same as VFAT or FAT, which are both 16-bit file systems.

DIR

Means Directory, also called FDT,File Directory Table. DIR is the root sector, following after the second FAT (backup FAT). It records each start cell, files. Operation system can locate files according to the outset of FAT and FAT.

DATA

DATA area is the real place where data is stored. It is after DIR, covering the most space of hard disk.

The location of the 5 areas is as following:
Usually, MBR covers 63 sectors (actually it covers only one); DBR covers 32 sectors (actually it covers the first and the sixth sectors. The first sector works while the sixth is backup of the first); FAT1=FAT2. The length of FAT will change according to the size of partition and the number of sectors. DIR changes the most. In early time system, DIR has fixed length of 32 sectors while each file directory covers 32 bytes. As a result, there are at most 512 items under root directory. Floppy disk can only contain 112 items, or there would be no file or directory created under root directory.

------------------------------------------------------------------------------------------------------------------------------------22

Elementary knowledge of hard disk Book v1.0


Ⅳ.Elementary knowledge of hard disk

------------------------------------------------------------------------------------------------------------------------------------ 7

The hard disk drive has short and fascinating history. In 24 years it evolved from a monstrosity with fifty two-foot diameter disks holding five MBytes (5,000,000 bytes) of data to today's drives measuring 3 /12 inches wide and an inch high (and smaller) holding 400 GBytes (400,000,000,000 bytes/characters). Here, then, is the short history of this marvelous device.

Before the disk drive there were drums... In 1950 Engineering Research Associates of Minneapolis built the first commercial magnetic drum storage unit for the U.S. Navy, the ERA 110. It could store one million bits of data and retrieve a word in 5 thousandths of a second..

In 1956 IBM invented the first computer disk storage system, the 305 RAMAC (Random Access Method of Accounting and Control). This system could store five MBytes. It had fifty, 24-inch diameter disks!

By 1961 IBM had invented the first disk drive with air bearing heads and in 1963 they introduced the removable disk pack drive.

In 1970 the eight inch floppy disk drive was introduced by IBM. My first floppy drives were made by Shugart who was one of the "dirty dozen" who left IBM to start their own companies. In 1981 two Shugart 8 inch floppy drives with enclosure and power supply cost me about

$350.00. They were for my second computer. My first computer had no drives at all.

In 1973 IBM shipped the model 3340 Winchester sealed hard disk drive, the predecessor of all current hard disk drives. The 3340 had two spindles each with a capacity of 30 MBytes, and the term "30/30 Winchester" was thus coined.

In 1980, Seagate Technology introduced the first hard disk drive for microcomputers, the ST506. It was a full height (twice as high as most current 5 1/4" drives) 5 1/4" drive, with a stepper motor, and held 5 Mbytes. My first hard disk drive was an ST506. I cannot remember exactly how much it cost, but it plus its enclosure, etc. was well over a thousand dollars. It took me three years to fill the drive. Also, in 1980 Phillips introduced the first optical laser drive. In the early 80's, the first 5 1/4" hard disks with voice coil actuators (more on this later) started shipping in volume, but stepper motor drives continued in production into the early 1990's. In 1981, Sony shipped the first 3 1/2" floppy drives.

In 1983 Rodime made the first 3.5 inch rigid disk drive. The first CD-ROM drives were shipped in 1984, and "Grolier's Electronic Encyclopedia," followed in 1985. The 3 1/2" IDE drive started its existence as a drive on a plug-in expansion board, or "hard card." The hard card included the drive on the controller which, in turn, evolved into Integrated Device Electronics (IDE) hard disk drive, where the controller became incorporated into the printed circuit on the bottom of the hard disk drive. Quantum made the first hard card in 1985.

In 1986 the first 3 /12" hard disks with voice coil actuators were introduced by Conner in volume,

Data loss-Book v1.0

Ⅱ.Data loss

Actually, there are various reasons that cause data loss; software, hardware, factitious, natural, intended, unintended, all may cause data loss or damage on storage devices.

Generally, There are two main reasons for data problem: software and hardware whose corresponding reasons are software reason and hardware reason.

1.Software reason

Virus, format, mis-partition, mis-clone, mis-operation, network deletion, power-cut during operation all may be the software reasons. The symptoms are usually mis-operation, read error, can not find or open file, report no partition, not formatted, password lost and troubled characters.

A: Computer Viruses: some malicious virus programs will destroy data, overwrite, or erase the data contents.

------------------------------------------------------------------------------------------------------------------------------------ 4

Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0 (Visit http://www.easeus.com for more information)

B: Mis-format: fast or completely format partition, thus changing the file system form (NTFS, FAT32) of partition.

C: Mis-Clone: when backing up the hard disk, mis-clone or overlay the original data on hard disk.

For these, we can use software tools to recover it. So called soft recovery means data can be recovered by software, not referring to hardware fixing operation for its fault is not because of hardware failure.

The following are prompts that system can not start up normally:

Invalid Partition Table: Invalid partition table information.

Missing Operating System: “55AA” mark in DOS boot sector lost or DBR corrupted. Disk Boot Failure: System file read failure.

Bad or missing command interpreter: Can not find command.com file or ‘COMMAND.COM’ file corrupted.

Invalid system disk: DOS boot record corrupted.

Type the name of the command, Interpreter: DOS partition mark in partition table error or

‘COMMAND.COM’ file lost, corrupted.

Error Loading Operating System: Main boot startup program read boot sector unsuccessfully. Not found any active partition in HDD: Active partition mark in partition table changed as inactive partition mark.

2.Hardware reason

Sometimes data loss is because of hardware, such as bad sector in hard disk, power cut, head damage, circuit panel problem, etc.

When your hardware has some problems, you probably will find: the speed of hardware become slow, you cannot operate successfully; you cannot read data, etc, which are most often physical bad track failures.

Correspondingly, data recovery in hardware fix is considered as hard recovery, such as memory medium damage, track damage, hard disk scrape, head damage, electric machinery damage, chip burnout and so on..

The most distinct feature or difference between soft recovery and hard recovery is whether the memory medium itself can be normally accessed by fixing or replacing parts.

------------------------------------------------------------------------------------------------------------------------------------ 5

Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) Ⅲ.Data Protecting Technologies

Data security and fault freedom of storage are paid more and more attention. People are attaching more and more importance to developing new technologies to protect data. 1.SMART Technology

SMART, also called Self-Monitoring Analysis and Report Technology, mainly protects HD from losing data when there is some problems on the HD. SMART drive can reduce the risk of data loss, it alarms to predict and remind thus enhancing the data security. 2.SPS

Shake Protecting System, can prevent the head from shaking thus enhancing the anti-knock characteristics of HD, avoiding damages caused by shake.

3.DFT

DFT, a kind of IBM data protecting technology, can check hard disk via using DFT program to access the DFT micro codes in hard disk. By DFT, users can conveniently check the HD operation.

4.Floppy disk array technology

Originally ‘Redundant Arrays of Inexpensive Disks’. A project at the computer science department of the University of California at Berkeley, under the direction of Professor Katz, in conjunction with Professor John Ousterhout and Professor David Patterson.

The project is reaching its culmination with the implementation of a prototype disk array file server with a capacity of 40 GBytes and a sustained bandwidth of 80 MBytes/second. The server is being interfaced to a 1 Gb/s local area network. A new initiative, which is part of the Sequoia 2000 Project, seeks to construct a geographically distributed storage system spanning disk arrays and automated libraries of optical disks and tapes. The project will extend the interleaved storage techniques so successfully applied to disks to tertiary storage devices. A key element of the research will be to develop techniques for managing latency in the I/O and network paths.

The original (‘Inexpensive’) term referred to the 3.5 and 5.25 inch disks used for the first RAID system but no longer applies.

The following standard RAID specifications exist:

RAID 0 Non-redundant striped array

RAID 1 Mirrored arrays

RAID 2 Parallel array with ECC

RAID 3 Parallel array with parity

------------------------------------------------------------------------------------------------------------------------------------ 6


RAID 5 Striped array with rotating parity

The basic idea of RAID (Redundant Array of Independent Disks) is to combine multiple inexpensive disk drives into an array of disk drives to obtain performance, capacity and reliability that exceeds that of a single large drive. The array of drives appears to the host computer as a single logical drive. The Mean Time Between Failure (MTBF) of the array is equal to the MTBF of an individual drive, divided by the number of drives in the array. Because of this, the MTBF of a non-redundant array (RAID 0) is too low for mission-critical systems. However, disk arrays can be made fault-tolerant by redundantly storing information in various ways. 5.SAN

SAN, called Storage Area Network or Network behind servers, is specialized, high speed network attaching servers and storage devices. A SAN allows "any to any" connection across the network, using interconnect elements such as routers, gateways, hubs and swithes. It eliminates the traditional dedicated connection between a server and storage, and concept that the server effectively "owns and manages" the storage devices. It also eliminates any restriction to amount of data that a server can access, currently limited by the number of storage devices, which can be attached to the individual server. Instead, a SAN introduces the flexibility of networking to enable one server or many heterogeneous servers to share a common storage "utility", which may comprise many storage devices, including disk, tape, and optical storage. And, the storage utility may be located far from the servers which use it.

6.NAS

NAS is Network Attached Storage. It can store the quick-increased information

.Backup means to prepare a spare copy of a file, file system, or other resource for use in the event of failure or loss of the original. This essential precaution is neglected by most new computer users until the first time they experience a disk crash or accidentally delete the only copy of the file they have been working on for the last six months. Ideally the backup copies should be kept at a different site or in a fire safe since, though your hardware may be insured against fire, the data on it is almost certainly neither insured nor easily replaced.

7.Backup

Backup in time may reduce the danger and disaster to the lowest, thus data security can be most ensured. In different situations, there are different ways. Both backing up important data of system with hardware and backing up key information with cloning mirror data to different storage device can work well.

Elementary knowledge of data recovery

Elementary knowledge of data recovery

1.Connotation of data

Connotation of data is comprehensive, it includes not only multi-media files such as data documents, images, voices that stored in file system or data base, but also hardware information, network addresses and network services, which are used to deposit and manage those information. 2.The essence of data recovery

Data recovery means retrieving lost, deleted, unusable or inaccessible data that lost for various reasons.

Data recovery not only restores lost files but also recovers corrupted data. On the basis of different lost reason, we can adopt different data recovery methods. There are software and hardware reasons that cause data loss, while we can recover data by software and hardware ways.

Being different from prevention and backup, data recovery is the remedial measure. The best way to insure the security of your data is prevention and backup regularly. To operate and use your data according to the normative steps, you can reduce the danger of data loss to the lowest. 3.The scope of data recovery

There are so many forms and phenomenon on data problem, we can divide the objects or scope of data recovery according to different symptoms.

System problem

The main symptom is that you cannot enter the system or the system is abnormal or computer closes down. There are complex reasons for this, thus we need adopt different processing methods. Reasons for this symptom may be the key file of system is lost or corrupted, there is some bad track on hard disk, the hard disk is damaged, MBR or DBR is lost, or the CMOS setting is incorrect and so on.

Bad track of hard disk

There are logic and physical bad track. Logic bad track is mainly caused by incorrect operation, and it can be restored by software. While physical bad track is caused by physical damage, which is real damage, we can restore it by changing the partition or sector. When there is physical bad track, you’d better backup your data for fear that the data can not be used any more because of the bad track.

------------------------------------------------------------------------------------------------------------------------------------ 3

Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0 (Visit http://www.easeus.com for more information) Partition problem

If partition can not be identified and accessed, or partition is identified as unformatted, partition recovery tools such as Partition Table Doctor can be used to recover data.

Files loss

If files are lost because of deletion, format or Ghost clone error, files restoring tools such as Data Recovery Wizard can be used to recover data.

Password loss

If files, system password, database or account is lost, some special decryption tools that correspond to certain data form such as Word, Winzip can be used.

Files repair

For some reasons, some files can not be accessed or used, or the contents are full of troubled characters, the contents are changed so as they can not be read. In this condition, some special files restoring tools can be tried to restore the files.

4.The principle of data recovery

Data recovery is a process of finding and recovering data, in which there may be some risk, for no all situations can be anticipated or prearranged. It means maybe there will be some unexpected things happen. So you need reduce the danger in data recovery to the lowest:

Backup all the data in your hard disk

Prevent the equipment from being damaged again

Don’t write anything to the device on which you want to recover data

Try to get detailed information on how the data lost and the losing process Backup the data recovered in time.