Research on Recovery of Computer Data based on Windows System.doc

1、1Research on Recovery of Computer Data based on Windows SystemAbstract： This paper researches the computer data recovery in FAT Windows file system， analyzed the storage format and file data operations （such as formatting， partition and delete） ， specific to the data processing and the data recovery

2、， summarizes the method of data recovery and commonly used software tools， and gives the specific data recovery examples. Keywords： Hard disk； data recovery； FAT； 0 Introductions With the rapid development of computers， peoples work and life more and more cannot do without a computer， it brings conv

3、enience to people， but also may be due to various reasons， causing the computer data loss， damage， may make the years of painstaking efforts to the flowing water， the so-called. A hard disk has a price， data is priceless. Data loss make people vexed extremely， but in fact， in most cases， computer da

4、ta is not lost， it may be hidden in a corner， waiting for people to carefully explore， that is to say， the 2data can be recovered in most cases. Data recovery is to suffer damage， or due to hardware defects in inaccessible or unavailable， or because the virus， misuse and other various reasons lead t

5、o loss of data into normal data. Data recovery artificially recover data that disappeared or are not readable data extracted from the storage medium through some equipment and software， and changes into a process can read data. Methods usually data recovery from means divided into two types， one is

6、the recovery storage medium physical level is based on operation， we call it. Hard recovery： This data needs to be opened the hard disk data recovery equipment， through the specialized analysis of magnetic signal on the disc， and then through a special software for recovery. Storage medium is the fi

7、le system format， delete operation after recovery， generally need to use some software， we call it Soft recovery. In general we call data recovery means that Soft recovery. 1 Cause of damage data Computer data lost is various； it usually divided into two types： hard fault and soft fault. Among them，

8、 the hard disk failure is due to a natural disaster or man-made factors are causing data cannot be read normally physical injury. Such as 3hard disk read / write head due to severe vibration damage does not recognize the hard disk interface， power supply， fault of hard disk； disk motherboard circuit

9、 board burned fault； the hard disk motor drive chip damage caused spindle motor does not rotate； the hard disk has physical bad sectors hard disk firmware is lost or damaged. In addition， the cache hard drive failures lead to hard not to be identified， garbled， hard on the motherboard BIOS abnormal

10、result in misidentification， does not recognize the hard disk. Soft fault refers to the hard disk physical performance intact， just because the data user error operation or due to a virus and human operation error loss， common are： mistakenly formatted partition or error， error cloning， mistakenly d

11、elete or overwrite accidentally， electromagnetic interference， hacker intrusion， network user environment vulnerability virus infection， zero track damaged， damaged， the master boot program FAT damage， DBR fault and hard logic lock etc. Can cause data loss and damage， the operating system cannot sta

12、rt， cannot find the required files， file not open or open the document， the hard disk partition， not garbled or suggesting a hard disk partition is not formatted a system error or paralysis and other specific characteristics. 42 Analysis of the data storage structure The data recovery， first of all，

13、 we must understand the structure of data storage. Unused disk can use through low-level formatting， partition， format. Low level format is on the hard disk partition tracks and sectors， as shown in Figure 1， and therefore it is also called the physical format； the physical hard disk partition is lo

14、gically divided into multiple regions to achieve multiple operating system management to manage hard disk， hard disk data. Advanced format is the role of the partition space into the data storage according to certain rules， for the FAT file system， is divided into system boot sector， FAT， file alloc

15、ation table file directory table FDT and the data area. This logic in the hard disk has been established in the master boot sector， operating system guide the five sector， FAT， file allocation table file directory table FDT and the data area， as shown in Figure 2. The first sector of the hard disk （

16、0 trace 0 head of sector 1） was retained as the boot sector. It includes： the master boot record of hard disk partition table MBR and DPT. The master boot record is a section of program code， its main function is to the operating system on a hard disk installation guide； the hard disk partition tabl

17、e is stored in the hard 5disk partition information， using 80H or 00H marked at the beginning， to mark 55AAH to end， a total of 64 bytes， the most at the end of this sector. Operating system boot sector usually occupy the first sector of partition of a total of 512 bytes， which mainly includes the o

18、perating system boot record DBR and the partition parameter block （BPB ）. DBRs main task is to judge the root directory of the two documents if or not right when the MBR control system to it. Operating system boot file， if it is loaded into memory. BPB records the starting sector， the ending sector

19、of the partition， file storage format， hard disk media descriptor， the size of the root directory， the FAT number， the allocation unit size and other important parameters. When the system starts， MBR is the first to be from the hard disk loading program segment， then directed to the DBR implementati

20、on of the program， the system file is loaded into memory. The first cluster storage in FDT and file stored file directory names and cluster number and other information in the data area， file allocation table FAT is a linked list， other storage cluster number given file. The system is based on the i

21、nformation of the file access. 3 The principle of data recovery 6Data recovery， the premise condition is that data is actually not removed or covered file data in hard disk. In fact we partition， format， accidentally deleted lost data， and not really clear all data， just by the operating system to h

22、ide it， so long as we understand and analyze these really hard to deal with， through some methods and tools can restore most of the data. 3.1 initialization processing analysis Initialization is low-level formatting. To use disk initialization， most software will reset all sectors， and even re parti

23、tion sector number sequence， so the original data is unrecoverable. But in the use of fast low， only to the 0 road 0 heads and 1 sector （i.e. the MBR sector） write code， while the partition table data region cleared the last two bytes written sign 55AA. This also means that the file still exists， da

24、ta recovery may. So hard disk display is not initialized， if the storage medium partition table is normal， but the boot code is destroyed， or. 55AA. Signs of damage caused， is not low， you can restore all data on the hard disk. 3.2 Analysis of the partition operation treatment The partition is to ma

25、ster boot sector partition table area 7write the partition data information. At the same time allocated to the first sector of the partition of reset all data. The first sector of the partition is boot record sector （DBR sector） in partition. At this time， only one sector data are destroyed， the ori

26、ginal file allocation table and file directory table is still hidden in the hard disk， so as to find the original partition information， can restore most of data partition. 3.3 formatting process analysis Format refers to the establishment of file storage format in the partition， namely establish sy

27、stem file. Different file system to store the data format is not the same， Windows system is used in FAT16， FAT32 and NTFS file system. （1） FAT32 format FAT32 partition structure is as shown in figure 3. Root directory to the root directory file， its size is not fixed， the location is not fixed， it

28、is no longer the same number FAT16 512 file limit. The FAT32 format will be used for the following data processing on the partition. （1） No. 0 sector write boot code， 1 sector write Fs info information， 2 sector write “55AA” Mark. （2） The 3-5 sectors cleared， 6-8 sectors for the 0-2 8sector for back

29、up. （3） Reserve other position clear. （4） FAT reset， FAT1 and FAT2 starting sector write marker （F8FFFF0F） ， the end of the 2 FAT table position settings file Mark. （6） Assigned to the cluster space clear root directory， such as setting the volume label， catalogue No. 0 position to build volume dire

30、ctory entry. 3.4 The analysis of deletion file Delete the file processing system is very simple， the FAT file system rewrite the files directory entry the first byte by E5 tag， the NTFS file system is two bytes in the MFT file recording head start from offset 0x16 to 00H （Delete file） or 02H （remove

31、 directory） mark， mark after that the file or folder has been deleted. At the same time will describe the distribution space of the corresponding FAT （FAT file system） or bitmap （NTFS file system） rewriting is not allocated， so that the space allocated to other files or directories to use. The delet

32、e operation， the real cluster space allocated to the file has not been any rewriting operation， may lose folder or attribute， the contents of the documents can be completely 9restored. 4 Data recovery methods and tools Data recovery methods can be divided into recovery mode for hardware and software

33、 recovery mode. Hardware recovery can be divided into alternative hardware， firmware， and repair disk reading three recovery modes. Alternative is replace the bad data recovery purposes to use new hardware， such as alternative， hard circuit board flash drive control chip replacement. The firmware is

34、 written on a hard disk drive program in the initialization program. Firmware restoration， is the use of hard disk special repair tools， such as PC3000， to repair the hard disk firmware， and hard drive data recovery. Disc read is on a hard disk in a super clean working class 100 room opened， remove

35、the disk， and then use the special data recovery equipment for the scanning， read the data on the disk. Software recovery can be divided into system level recovery and file level. System level recovery is the operating system can not start， use file repair system repair software， and make the system

36、 work normally. The file level recovery is to restore the user data files on a disk is damaged or lost； the file level recovery generally available tools software or manual recovery data. 10Currently used for data recovery software tools are EasyRecovery， FinalData， Winhex， DiskGenius， RecoverNT， Re

37、-cover My Files， Norton， R-Studio， FinalRecovery， Disk， Recover etc. Each tool has its advantages and disadvantages， recovery will also have certain difference. FinalData has the characteristics of simple operation， rapid and wide coverage， in addition to the Windows operating system Microsoft outsi

38、de， FinalData also supports the common UNIX system platform. EasyRecovery is a powerful， in addition to the data recovery， but also can repair damaged Excel， Word， Access， PowerPoint， Zip and other types of documents， is by far the most popular data recovery tool. Winhex a perfect partition manageme

39、nt function and file management function， can automatically analyze partition chain and document cluster chain， be backed up in different ways to different degrees on the hard disk， or even clone entire hard disk， and can complete display and edit any file type binary content， any sector of the disk editor to edit the physical disk and the logical disk， memory editor to edit the memory directly， can be said to be the preferred tool to manually restore data.