Difference between revisions of "Disk Data Recovery"

Revision as of 21:30, 23 January 2010

Data on a hard disk may be (a) deleted (b) overwritten or (c) lost. It is possible to recover data on a hard disk under many circumstances. Often recovery may only be partial.

Key Terms:

• Disk Forensics
• Data Recovery
• Disk Doctor
• Disk Sector Editor
• Low Level Undelete
• Disk Analysis

A computer disk stores information in a series of chunks known as sectors, each typically 512 bytes long. Each sector has a number that serves as its address on the disk. A file on the disk is split across a number of sectors. These sectors may be located together but might be scattered across the disk if there is not enough contiguous space in one spot.

Deleted Files

When a file is deleted, the information stored in the individual sectors is not erased, because the erasure process consists of overwriting the sector and is relatively slow. It is significantly faster to overwrite the sector by rewriting it with new data only when it is needed for some other file. So when a user "deletes" a file, the directory entry for the file is either removed or marked as deleted by changing the first letter of the file name to a special character.

A deleted file can be recovered if the index information and sectors have not yet been overwritten. The chances of this are better if little computer activity has occurred since the file was deleted. Microsoft MSDOS and Windows changes the directory entries by changing the first letter of the filename. File undelete software will scan the directory for filenames that have the special character that signifies "deletion" and present a menu of files to recover. When the accidentally deleted file is chosen, the directory entry is corrected and the file reappears. The user often has to supply the first letter of the filename for restoration to occur.

Zero Byte Files

A data file might not necessarily be deleted, but might be empty suddenly due to a program crash. Programs may leave files in an open state, especially data files, and as the result of a crash the file might be emptied yet still exist. An undelete utility is of no use in this scenario.

A program called "Disk Investigator" can help you to recover lost data. Display the true drive contents by bypassing the operating system and directly reading the raw drive sectors. View and search raw directories, files, clusters, and system sectors. Verify the effectiveness of file and disk wiping programs. Undelete previously deleted files.

Over Written Data

Lost Files

When you lose data on a hard drive, a sector editor allows you to view data almost everywhere on the drive.

EXAMPLE: Data Recovery From Corrupted Registry that Prevents XP From Starting

For this example, XP Home will not boot and a XP Pro CD was used to boot off. Setup installed XP Pro so a MENU BASED INTERFACE (aka. windows graphical interface) could be used for comfort.

Files stored on XP Home folders are hidden when logged in on XP Pro so their security settings have to be changed. Hidden can be classified as LOST.

You can watch tutorial's for MBI instructions at http://www.youtube.com/almuck1

or use cmd interface:

HKEY_LOCAL_MACHINE/SOFTWARE/MICROSOFT/WINDOWS/CURRENTVERTION­/EXPLORER/ADVANCED/FOLDER/HIDDEN/SHOWALL then change 0 to 1 then restart computer

Additional Helpful Information: http://support.microsoft.com/kb/307545

or forum thread:

http://social.answers.microsoft.com/Forums/en-US/xprepair/thread/b9dc171e-2a52-4dd9-97d4-480e72f9aa10/