Windows
STRUCTURE of the data on the hard disk
First, we cross-referenced with information of how a file is stored on the hard disk . With FAT partitions , data stored on disk in three places , including : Directory Entry file contains additional information including name , size , create time and number of the first cluster of the file containing the data ; FAT contain the number of the cluster is used for cluster file and the file containing the data ( the Allocation ) . With NTFS , data stored in the MFT ( Master File Table ) and the Entry Allocation ( illustration ) .
Any data rescue software also trying to find information from third place to be able to recover the full contents of a file , if the lack of ( or lose ) one of this information , not data integrity or unrecoverable ( see table ) .
Thus , considering the above cases , the ability to recover data is often quite low . Where the cluster of Allocation damaged or override , you almost can not recover data deleted due and overridden by new data . In theory , you can still retrieve old data with technical MFM ( Magnetic Force Microscope ) however this technique is not widely used in practice due to time consuming and high cost .
POSSIBILITY data recovery
- File Deleted : As mentioned above, the deleted file will be marked for deletion Entry Director and the relevant information in the FAT or MFT Entry . In theory , the ability to fully restore this file is high . However, sometimes the actual results are not expected for several reasons : after deleting , the user tries to perform a number of actions to retrieve the data , the new OS overwrites data in the cluster are marked deleted ...
- The partition is deleted ( or recreate ) but not the format ( format) : Most data can be recovered in this case because the FAT and MFT not affected when users delete and create new partitions .
- Formatted partitions : With FAT partitions , formatting will erase the FAT , and root directory Boot Record ( Root Directory ) but Partition Table and data still Allocation . The file size smaller cluster size ( 32KB , default FAT32 or your options when formatting ) , files are restored completely because they do not need the information in the FAT . For files that are larger , more contiguous cluster , they will become fragmented when content changes over time . The find and assemble the relevant cluster together is hard work , especially with large files and fickle . Some data rescue software is capable of recovering without information from the FAT . however , the contents of the file after finding incomplete or can not be read. So , you will need software capable of ripping the content was read from the file (we 'll cover this in another post when conditions allow ) . With NTFS partition , the new format will create MFT , however the results will be better recovery for NTFS partition using FAT FAT table to determine the cluster containing the same data file .
- Formatted partitions and overwrite the new OS or use Ghost : This case is really difficult because the Directory Entry ( FAT ) , MFT ( NTFS ) has been deleted . Suppose you have 10GB of data storage on a 20GB partition , formatted partitions and overwrite new data 5GB . Thus, you can not restore the data that was overridden can only restore data from 5GB onwards .
DR Care with experience and expertise along with professional equipment , we guarantee to provide our customers emergency services professional data , the highest success rate of Vietnam today , with low cost and the fastest time . As a trusted partner of many companies , computer stores nationwide . We provide emergency services system data on the server ( SERVER RAID , NAS / SAN ) , Desktop , Laptop , Notebook , external hard drives , USB flash , SD memory card , CD , DVD ... with the system system camcorder, camera . Supports all operating systems such as Windows , Macintosh ( MAC ) , Linux , Unix , Android ...
This article 's compact DR Care Research Data Recovery Vietnam . Any copy must be specified source )
The other posts