Basic principles of data storage and recovery
In reality, many people do not know that the data lost by the hard disk operation such as deletion and formatting can be recovered, so that the data does not exist after deletion and formatting. In fact, after the above simple operation, the data still exists in the hard disk. The person who knows the principle of data recovery can retrieve the disappeared data in a few times. Don’t feel incredible. Understand the data in the hard disk, USB flash drive, floppy disk and other media. After the storage principle, you can also do a magician yourself.
The first step of data storage and recovery – partition
The basic unit of data stored on a hard disk is a sector, which we can understand as a page of a book. When we install or buy a mobile hard drive, the first step is to facilitate management – partitioning. Regardless of the partitioning tool, the first sector of the hard disk is labeled with the number of partitions of the hard disk, the size of each partition, the starting position, etc. The term is called the master boot record (MBR), and some people refer to the partition information. table. When the master boot record is destroyed due to various reasons (hard disk bad sectors, viruses, misoperations, etc.), some or all of the partitions will naturally be lost. According to the data information characteristics, we can recalculate the calculation partition size and location, manually labeling Go to the partition information table and the “lost” partition is back.
Data storage and recovery second step – file allocation table
In order to manage the file storage, after the hard disk partition is completed, the next work is to format the partition. According to the partition size, the formatter divides the partition into a directory file allocation area and a data area. Just like we can see the novel, the first few pages are chapter directories, and the latter is the real content. The file allocation table records the attributes, size, and location of each file in the data area. Our operation of all files is based on the file allocation table. After the file allocation table is destroyed, the system cannot locate the file. Although the real content of each file is still stored in the data area, the system still considers that the file no longer exists. Our data is lost, just like the catalog of a novel is torn off. It is impossible to go directly to the desired chapter. To get the content you want (recover data), you can only know the approximate number of pages of the specific content by memory, or find the content you want on each page (sector). Our data can also be recovered back.
Data Storage and Recovery Step 3 – Formatting and Deleting
When we store the file in the hard disk, the system first writes the file name and size in the file allocation table, and continues to write the file content at the beginning of the data area on the file allocation table according to the free space of the data area. Then start writing the actual content of the file to the data area, and a file storage operation is completed.
The delete operation is very simple. When we need to delete a file, the system simply writes a delete flag in front of the file in the file allocation table, indicating that the file has been deleted, and the space occupied by it has been “released”. Other files can be deleted. Use the space he occupies. So, when we delete the file and want to retrieve it (data recovery), just remove the delete flag with the tool and the data is restored. Of course, the premise is that no new file is written, and the space occupied by the file is not covered by the new content.
The formatting operation is similar to the deletion, only the file allocation table is operated, but the formatting is to delete all the files, or simply clear the file allocation table, the system will think that there is no content on the hard disk partition. The formatting operation does not do anything to the data area. The directory is empty and the content is still there. With the data recovery knowledge and corresponding tools, the data can still be recovered.
Data Storage and Recovery Step 4 – Understanding Coverage
Data recovery engineers often say: “As long as the data is not overwritten, the data may be restored.”
Because of the storage characteristics of the disk, when we don’t need the data on the hard disk, the data is not taken away. When deleting, the system just writes a delete flag on the file. Formatting and low-level formatting are also overwriting the data on the disk and writing the data with the number 0. This is the overlay.
After a file is marked with a delete flag, the space occupied by the file will be overwritten with new files when new files are written. At this time, the deleted file name is still there, but the space content pointed to the data area has been overwritten and changed, and the recovered abnormal content will be recovered. The space occupied by the file information with the delete mark in the same file allocation table may also be covered by the new file name file information, and the file name will not exist.
When a partition is formatted, there is new content copied, the new data just covers the part of the space before the partition, and the space occupied by the new content is removed. The unordered content on the remaining spatial data area of ??the partition may still be reorganized, and the data is Come back.
Similarly, data loss caused by cloning, one-click recovery, system restoration, etc., as long as the new data footprint is less than the space before the destruction, the data recovery engineer may recover the partition and data you want.
Data Storage and Recovery Step 5 – Hardware Failure Data Recovery
Hardware failures account for more than half of all data accidents, such as circuit failure caused by lightning, high voltage, high temperature, mechanical failure caused by high temperature, vibration collision, high temperature, vibration collision, physical bad track sector failure caused by aging of storage medium, Of course, there are accidental loss of corrupted firmware BIOS information and so on.
The data recovery of the hardware failure is of course the first diagnosis, the right medicine, the corresponding hardware failure is repaired first, and then the data is successfully recovered according to the repair of other soft faults.
Circuit failure requires us to have a circuit foundation, and we need to have a deeper understanding of the detailed working principle of the hard disk. Mechanical head failure requires a workbench or workshop above level 100 for diagnostic repair work. In addition, some hardware and software maintenance tools are needed to repair the fault types such as the firmware area.
Data Storage and Recovery Step 6 – RAID RAID Data Recovery
The storage principle of the disk array is not explained here. Please refer to the knowledge of the array of the site. The recovery process is to eliminate hardware and soft faults first, then analyze the parameters such as array order and block size, and reorganize with array card or array software. Restore data in the usual way.