Data recovery exploring Part 1 - Understand the basic principle of data recovery

In order to deepen the understanding of everyone to the data recovery, we need to simple about the basic principle of data storage. Here to hard disk as an example do simple explanation (floppy disk, compact disc and ShanPan data storage principle and hard disk very much the same). Let's look at hard disk data structure. When we get a new hard drive, must first division and format of the operation to use. For most current friends use Windows operating system, it was hard disk operating system is divided into the boot sector, operating system boot sector, file distribution table, area and the data area this directory five parts. Among them main boot sector on each of the hard drive is the only, a piece of hard disk can only have a master boot sector, and the other part of the hard drive each partition will exist.

Floppy disks, CD, flash disk and hard disk data storage principle in fact is rather different. Floppy disk storage principle more like tapes, directly through the electromagnetic induction principle to become magnetic field changes current changes, to the head and magnetic medium materials and no special requirements. It also said the CD, as for ShanPan, is directly in semiconductor storage high potential and low potential signal to represent 0 and 1 data information. At the same time, various storage medium of the file format also have very big distinction.

The Boot sector of the hard drive in the whole 0 track 0 cylinder 1 sector, it including hard drive the Lord direct program MBR (Main Boot Record) and Partition Table DPT (Disk Partition Table) two parts. The Lord direct program is by the partition program (such as everybody's most commonly used Fdisk) of generation, so in different operating systems, the Lord direct program might be different. Its role is check partition table is correct and determine which one division division for guide, and then at the end of the program the category of start programs (that is, the operating system) a memory execution. And to partition table, everybody should be familiar with, it to a 80 H or 00 H for began to sign to 55 AAH over mark, a total of 64 bytes, located in 0 track 0 cylinder 1 the end of the sector. It has several partitions the regulations system, each partition the starting and the ending of the sector, size and whether such important information for active partition.

The operating system Boot sector namely OBR (OS Boot Record), are usually located in hard disk of 0 track 1 cylinder 1 sector (if hard disk is set for multiple guide way, is located in the each guidance system of division or expand in the division of the first sector). It is the operating system can be directly accessed by the first sector, including a boot and a known as BPB (BIOS Parameter Block) partition Parameter form. Boot is the main task of the judgment the root directory division before two documents are for operating system guidance documents. Such as check through, it will guide input file into memory, and the control to the document. BPB partition table parameters block is a record of the duty, ending sectors starting sector, file storage formats, hard disk medium descriptors, root directory size, FAT number, distribution Unit (Allocation Unit, also known as before of) the size of the important parameters.

Do not know everybody noticed no, the same hard disk, and use of the manufacturer of the original tools to the zoning and Partition Magic with Fdisk or such third party tools to Partition is distinguishing. We can try, use first original tools to Partition, then start Partition Magic view, find out what the problem have no? Usually use original tools division of the beginning or the end of hard disk, could still leave 4 to 8 MB or so not use the space, and with Fdisk Partition Magic division is not or produce this kind of situation. This is the hard drive manufacturer to prevent hard drive because the guide information go wrong, or the physical damage sector and causing a trouble and take a small but they are the practical value of the measures. So, generally with the original tools division, work hard drive up will be stable, in the illegal when shutdown is not easy to fall chain; Even the appearance of so-called zero track damage (logical zero track), guide area to system error denies plate and problems, the user is not need to use Disk Editor, PCTools software such as repair (or even find JS maintenance), just a tool to original low fast, and then just business as usual zoning.

File distribution Table namely FAT (File Allocation Table), is the system files addressing system, in order to data safety, FAT generally do two, second FAT for the first FAT backup. FAT area follows the OBR after, the size of the file size by duty and the size of the allocation unit decision. The format of the FAT has a lot of kinds, people familiar with the FAT12 have FAT16 and FAT32 etc, format. FAT12 at present only in the floppy disk drive in use, FAT16 can only be used for 2 GB the following partition; And FAT32 is most widely used, can the biggest management division for 32 GB.

In the hard disk cloning, scanning, formatting and copy large files process suddenly loses power of words, basic can sure will appear the damage situation of partition table. But now you know that partition table has two, at the same time, if use original tools division, illegal shutdown is not easy when lost partition table information. The file system format in addition to FAT16 and FAT32 outside, still have a NTFS, ReiserFS, ext, ext2, ext3, ISO9660, XFS, Minx, VFAT, HPFS, NFS, SMB, SysV, PROC, JFS, etc. In fact, we are in contact with the daily DOS and Windows of the file system, and the rest of the file system is with us live at a distance, there is not much to do is introduced.

Directory area namely DIR (Directory), it follows the table after the second FAT. Only the FAT can't positioning files in the position of the disk, FAT must also and the only accurate positioning document with DIR position. DIR recording each file (directory) starting unit (for file is, this is the crucial), the document attributes, etc. The operating system in the positioning document position, according to the first unit DIR, combining FAT table it files in the location of the disk and size. DATA area DATA that is, when will the DATA to the hard disk copy, DATA is stored in the DATA area. For a piece of the hard disk to store DATA, it accounted for most of the hard drive space, but if not previously mentioned in 4 parts, DATA area is only just a piece of filled with 0 and 1 area, have no meaning.

Also cannot say that doesn't make any sense, especially in SCSI hard drives this to have integrity checksum security mechanism hard disk, the information data also still has a lot of additional information and verify identification information, and can be used for data recovery means. IDE hard drive is really a trouble, have to spend a lot of time. But at present a lot of data recovery software company released is in constant study the problem, the hope can through the optimized algorithm, try to improve the success rate of data recovery and regeneration rate.

When the operating system to on hard disk written to the file, the first in the DIR area of written to the file information (including name, suffix name, file size and modification date), and then in the DATA area space will find idle file save, and will store in the file DATA area of cluster number write DIR area, so as to complete the whole write DATA work. Delete the file system of operation is simple many, it needs the files in the area of the first character DIR E5 into, in the file distribution list the file takes up the table of the cluster clear 0, it means the document will be deleted, but it is not actually to DATA area to any rewrite. Usually the senior to format programs, just rewrite the FAT table just, does not the DATA DATA cleared; And for hard drive partition, also just modify the MBR and OBR, and no DATA to rewrite the DATA in the area. Because the DATA area not easily by rewriting the DATA, and also bring an opportunity to recover the DATA. In fact all kinds of DATA recovery software, it is also using DATA area of the residual various trace, to recover the DATA, this is the basic principle of the whole DATA recovery.