Third, unrecoverable case If the file is removed after deletion, its stored disk space is written, which is usually restored in the case of 0. Therefore, an important premise that misunderstand files can be recovered is to write to the partition where the file is located. Virus damage 1. Symptoms now use the computer that is basically "poison" color change, the data destruction brought by the virus is often unpredictable (including partition table destruction, data coverage, etc.), such as CIH virus damaged hard drive, its partition table It is completely rewritten, and the hard disk cannot be found with the A disk). The symptoms of the virus damage the hard disk data are not described. Basically most of the data corruption may be caused by viruses, so the most secure method is still installed. An excellent virus firewall. Second, solutions due to virus damage to hard disk data, recovered solutions need to be pressed. Here is a common CIH as an example, because it is most common, it is also easier to judge (generally on April 26).
When the user's hard disk data is broken by the CIH virus, the F10 function of KV3000 is used, and the degree of repair is as follows: 1. The C-disk capacity is 2.1G or more, the original FAT table is 32-bit, and the repair rate of the C partition is 98%. , D, E, F or other partitions have a repair rate of 99%, with partitioning of handmade C, D, E, and F is 100%. 2. The hard disk capacity is below 2.1G, the original FAT table is 16-bit, the repair rate of the C partition is 0%, D, E, and F or other partitions is 99%, with the repair of manual D, E, F disk The rate is 100%. Because the original C disk is a 16-bit short FAT table, the FAT table and root directory of the C-disk are covered by the CIH virus. Kv3000 can find C drive, although the file name of the root directory has been covered by virus garbled, but the content image of the file is also stored on some sectors in the C drive. It is recommended to use KV3000 to find the C drive, then use file repair software Tiramisu.exe to find some file images in the C drive (need to understand this software) You can visit Ontrack Home http://www.ontrack.com ... isn't the content about Tiramisu on this website? Oh, in fact, in Tiramisu has been integrated into Ontrack's flagship product - EasyRecovery. Related detailed introduction can refer to this article "Partition Table Destruction" ), If the cluster of the original storage file is connected, the file that is retrieved is completely non-destructive. But if the FAT16 C is not saved? You can still try fixmbr (ftp://www.newhua.com/fixmbr102a.zip), which can determine the hard disk partition and re-construct the main guidance sector. Since the software only modifies the main boot sector record, the other sectors do not write, so they do not generally bring an unsafe directory (if they are fixed, please fix the tool to handle). Note: Fixmbr is a more old program that is much more considered to WinNT, Linux, and FAT32. Third, unrecoverable case due to the way the virus damage the hard disk is too much, and most of the destruction cannot be easily recovered with general software (if you like disk sector editing tools such as Diskedit, there is also a first-line hope for some situations), So ... you will pray if you encounter a virus to destroy your hard drive (From this point of view, install an excellent virus firewall is absolutely necessary)! Partition table destroying "There are unexpected winds, people have a blessings", this There is no mistake in the sentence. In the case of the computer for a few years, the partition table destruction has experienced several times. I remembered that the original hand was inseparable. When I came, I dared to start. I have been going to fight now. However, the so-called "fool thousands must have a good". After so long torture, I finally gave me a piece of wire, I didn't dare to die. Enjoy, hope and encounter friends with trouble, I hope everyone will communicate with me (e-mail: clinuxer@yeah.net) ... I. Causes and recovery feasibility analysis
