Case:After the customer’s U disk is inserted into the computer, the prompt is formatted, viewing the U disk attribute, the available space and the useful space are 0 bytes, but the customer has preserved important data in the U disk. Solution:First analyze the underlying sectors of the U disk, and find that the MBR information…
Here’s a scenario many computer users are familiar with: You’re sitting at your computer late at night (or early in the morning) trying to finish up a term paper you have submit for your Online MBA when suddenly your computer crashes. You restart your computer only to see what every college student dreads—your paper has gone missing. This is an all too common occurrence. Sometimes it’s an entire music library instead of a class paper, but the result is still the same: your data is gone. Luckily there are numerous tools to help you recover your files. Many of them cost an exorbitant amount of money, but there’s a simple, open source tool that will make short work of any missing data: PhotoRec.
Features
PhotoRec can operate under all contemporary operating systems, including all versions of Windows, Linux and BSD, Solaris and Mac OS X. Additionally, the source code for the program can be compiled on nearly all Unix systems, making it a universal file recovery tool. It ignores the file system and can recover lost files from FAT, NTFS, EXT2/EXT3 and HFS+ filesystems, even if they’re damaged. It can also recover from virtually any media, including hard disks, CD-ROMS, memory cards, portable media players and some cameras. The total list of file formats that PhotoRec can recognize and recover encompasses over 300 file extensions.
How to Use PhotoRec
When files are lost, users need to be aware that they should not save any data to the disk drive until the files are recovered. Recovering files with PhotoRec is an incredibly simple process, unless the files have been overwritten. Also, because PhotoRec recovers files as it’s scanning the disk drive, there should be a secondary drive attached to store the recovered data. There are different steps that need to be taken if data is to be recovered from an iPhone or CD/DVD, but the following steps will work for virtually all other media in a Windows environment.
1) Download and install PhotoRec
The program should be downloaded onto the secondary drive that will be used to store the recovered data. This can be a flash drive, external backup drive or a separate internal drive with enough space to store the missing files. If there is an unaffected partition on the same drive, that partition can be used instead of a secondary drive.
2) Run the PhotoRec program
In Windows Vista or 7, PhotoRec must be run by an account with Administrator access. Right-click the executable and select “Run as administrator”.
3) Select the disk and partition to recover from
Drives will be labeled according to the Linux labeling scheme (/dev/sda, /dev/sdb, etc.) and will display their total space, free space, make and model. Select the proper drive, and then select the partition table type. If using Windows or Linux, the partition table type will be Intel. After this, select the partition the missing files are located on. The PhotoRec user will need to know how the system is partitioned in order to recognize which partition to select.
4) Select options (optional)
At the bottom of the partition selection screen, the user can choose from options that will affect the recovery process. Most users should leave the settings alone and should only change them if they are fully aware of what they do.
5) Select file types to recover (optional)
Also on the bottom of the partition selection screen of the File Opt menu, which allows users to select which file types PhotoRec will attempt to recover. If only music files are missing, the user can disable all file types and only select audio file types.
6) Select Partition type
After all settings have been selected, users will be required to select the partition’s filesystem type. If the filesystem is ext2/ext3/ext4 (Linux), the user should select the ext2/ext3 option. If the filesystem is of another type, the user should select Other. After this, the user must tell PhotoRec whether to scan the entire partition or only the sections of the partition that are currently marked as empty. If no files have been written since the data was lost, scanning the free space should be enough.
7) Select the disk and partition to store recovered data
The user will be asked to select a drive (if there is more than one available), partition and directory in which to store the recovered information. By selecting a separate drive or partition, the recovered data is guaranteed not to overwrite any further missing data.
8) Wait
Depending on the size of the disk and the options selected, the recovery process can take as little as a few minutes or as long as several hours. When the recovery is finished, a summary will be displayed showing the total number of recovered files and their files types. Recovered files will be stored on the destination drive under recup_dir.1, recupt_dir.2, etc. sub-directories. The file names will not be recovered, but the full files should be available.
As USB drives and memory cards get larger and cheaper, it’s getting easier to trust much more of your data to them. It’s also much easier to mistakenly erase data or have them hiccup on you. And if you’re in the habit of holding on to that data for too long — for example, not transferring photos from your camera’s memory card — disaster is almost guaranteed to strike at some point. What happens then?
While there’s no end of data recovery tool packages out there, most of them are primarily designed to reclaim data from system drives. In this roundup, I look at the following six packages in terms of how well they recover data from mobile storage such as flash drives and memory cards: CardRecovery, PhotoRec, Recover My Files, Recuva, Remo Recover and Undelete 360.
Undelete 360 worked best when dealing with recently deleted files, but anything more ambitious than that (e.g., quick-formatted media) was beyond it. CardRecovery’s biggest limitation was the limited range of file types it handles: It’s designed mainly to recover files created by cameras and almost nothing else.
Recover My Files may be costly, but I liked its tunable scan function; its professional-level support for devices like RAID drives may come in handy. Remo Recover is functionally similar to Recover My Files, but it turned up a high number of false positives during testing.
The biggest surprise was how two of the best programs cost nothing to use. While PhotoRec was the least novice-friendly — its text-only interface could scare off the uninitiated and its documentation is spotty — it was also one of the most powerful. Recuva was likewise quite strong and wasn’t lacking any functionality in its free version.
Serdar Yegulalp has been writing about computers and information technology for a variety of publications for more than 15 years.
What is the shortest route to Device Manager? Solution: Click on the Start menu and type (or type the same in a command-line window, CMD.EXE): devmgmt.msc Or you can just type Device Manager and it should come up.
The Microsoft Windows operating system families (98SE,ME,2000,XP) do not support USB2 as a boot drive or primary system drive.
The Maxtor Personal Storage 160GB and above models are not supported as a boot drive for Macintosh operating systems because of Apple file system limitations. Some Macintosh platforms allow USB2 hard drives to function as the primary or boot drive. Check with Apple to see if your computer system supports booting to USB2 storage devices.
Case:Customer Customer Customer Customer Customers said that the mobile hard disk accidentally fell during the process of using it, and once again, it was used to use the sound of “Da Da Da”” and could not find the hard disk. Solution:The engineer was detected by the engineer to damage the magnetic head.Therefore
Case:When power -on, the hard disk made a nourishing sound and did not recognize the disk. Solution:After the relevant test, the preliminary judgment was the damage to the hard disk motor. After the opening of the professional opening cleaning room, the motor found that the motor was damaged. After the data recovery engineer, replaced the…
Case:Mr. Xing Xing’s IBM server data is lost. The situation is: IBM stores 10 SAS 2TB hard disks as RAID5. After the machine is restarted, the disk data cannot be accessed. After the user unit is checked, the two hard disks are found. Solution:Hangzhou Data Recovery Center engineers have learned that there are three hard…
How to protect from getting a virus?
In today’s world having anti-virus software is not optional. A good anti-virus program will perform real-time and on-demand virus checks on your system, and warn you if it detects a virus. The program should also provide a way for you to update its virus definitions, or signatures; so that your virus protection will be current (new viruses are discovered all the time). It is important that you keep your virus definitions as current as possible.
Once you have purchased an anti-virus program, use it to scan new programs before you execute or install them and new diskettes (even if you think they are blank) before you use them.
You can also take the following precautions to protect your computer from getting a virus:
What types of files that can scan and set for auto-protection?
Here’s a list of file extensions that you should make sure your anti-virus software scans and auto protects:
386, ADT, BIN, CBT, CLA, COM, CPL, CSC, DLL, DOC, DOT, DRV, EXE, HTM, HTT, JS, MDB, MSO, OV?, POT, PPT, RTF, SCR, SHS, SYS, VBS, XL?
What are some good indications that the computer has a virus?
A very good indicator is having anti-virus software tell you that it found several files on a disk infected with the same virus (sometimes if the software reports just one file is infected, or if the file is not a program file — an EXE or COM file — it is a false report).
Another good indicator is if the reported virus was found in an EXE or COM file or in a boot sector on the disk.
If Windows can not start in 32-bit disk or file access mode your computer may have a virus.
If several executable files (EXE and COM) on your system are suddenly and mysteriously larger than they were previously, you may have a virus.
If you get a warning that a Microsoft Word document or Excel spreadsheet contains a macro but you know that it should not have a macro (you must first have the auto-warn feature activated in Word/Excel).
What are the most common ways to get a virus?
One of the most common ways to get a computer virus is by booting from an infected diskette. Another way is to receive an infected file (such as an EXE or COM file, or a Microsoft Word document or Excel spreadsheet) through file sharing, by downloading it off the Internet, or as an attachment in an email message.
What should do when get a virus?
First, don’t panic! Resist the urge to reformat or erase everything in sight. Write down everything you do in the order that you do it. This will help you to be thorough and not duplicate your efforts. Your main actions will be to contain the virus, so it does not spread elsewhere, and then to eradicate it.
If you work in a networked environment, where you share information and resources with others, do not be silent. If you have a system administrator, tell her what has happened. It is possible that the virus has infected more than one machine in your workgroup or organization. If you are on a local area network, remove yourself physically from it immediately.
Once you have contained the virus, you will need to disinfect your system, and then work carefully outwards to deal with any problems beyond your system itself (for example, you should meticulously and methodically look at your system backups and any removable media that you use). If you are on a network, any networked computers and servers will also need to be checked.
Any good anti-virus software will help you to identify the virus and then remove it from your system. Viruses are designed to spread, so don’t stop at the first one you find, continue looking until you are sure you’ve checked every possible source. It is entirely possible that you could find several hundred copies of the virus throughout your system and media!
To disinfect your system, shut down all applications and shut down your computer right away. Then, if you have Fix-It Utilities 99, boot off your System Rescue Disk. Use the virus scanner on this rescue disk to scan your system for viruses. Because the virus definitions on your Rescue Disk may be out of date and is not as comprehensive as the full Virus Scanner in Fix-It, once you have used it and it has cleared your system of known viruses, boot into Windows and use the full Virus Scanner to do an “On Demand” scan set to scan all files. If you haven’t run Easy Update recently to get the most current virus definition files, do so now.
If the virus scanner can remove the virus from an infected file, go ahead and clean the file. If the cleaning operation fails, or the virus software cannot remove it, either delete the file or isolate it. The best way to isolate such a file is to put it on a clearly marked floppy disk and then delete it from your system.
Once you have dealt with your system, you will need to look beyond it at things like floppy disks, backups and removable media. This way you can make sure that you won’t accidentally re-infect your computer. Check all of the diskettes, zip disks, and CD-ROMs that may have been used on the system.
Finally, ask yourself who has used the computer in the last few weeks. If there are others, they may have inadvertently carried the infection to their computer, and be in need of help. Viruses can also infect other computers through files you may have shared with other people. Ask yourself if you have sent any files as email attachments, or copied any files from your machine to a server, web site or FTP site recently. If so, scan them to see if they are infected, and if they are, inform other people who may now have a copy of the infected file on their machine.
Case:Customer Dell MD3000 server, using RAID5 made by 15*1T, storage suddenly storage, so the hard disk was bright yellow light. Then the server could not be accessed. After testing by the engineer, it was found that the No. 4 hard disk was severely damaged. The No. 3 hard disk had a small amount of bad…
