Pro Data Doctor™
Data Doctor

FAT Data Recovery Case Studies

(a) Deleted Files/Folders

FAT Data Recovery Software restores deleted files (Word, Excel, Access, PowerPoint, photographs, Email, database, and all office files) and directory from PC (Personal Computer).

The content of the file does not get deleted immediately after deleting any file from computer system. The file link is broken from file record information (where file information is stored) but file still exists in computer’s hard disk drive and thus data recovery software can be efficiently utilized to recover lost data files and folders back.

(b) Emptied Recycle Bin

Recycle bin contains all deleted files whether files and folders deletion has been done intentionally or unintentionally.

Any file type can be moved to the Recycle Bin in a number of ways:

  • By right-clicking on file and selecting delete from menu
  • Selecting the file and pressing delete key
  • Selecting the file and choosing delete from File menu in Windows OS
  • By dragging and dropping a file into the Recycle Bin icon

Recycle Bin lists all deleted files, folders and other data with date, time and path. Recycle Bin lets the user view the files, folders, exe and shortcuts in Windows explorer form.

Once the Recycle Bin has been emptied, user is not capable of restoring the data back. But FAT Data Recovery Software lets user to easily recover and restore all deleted files from Recycle bin or deleted using SHIFT+DELETE key.

(c) Malicious Formats

Format prepares a hard disk drive storage media for reading and writing. When hard disk drive is formatted, the OS erases all stored information from disk drive. The formatting also detect if all the sectors has not been marked bad sector and created internal address tables to locate information at later stage.

The disk drive needs to be formatted for several reasons including:

  • Eliminate OS (Operating System) corruption
  • Recover virus/worm infected data
  • System performance degraded

Formatting can be done in two different ways called High level formatting and Low level formatting. High level formatting set up an empty file system on the disk and installs a boot sector and can be performed using “Quick Format” option. Low-level formatting is usually used by hard disk drive which sets certain properties of the disk also determines what type of disk controller can access the disk (RLL or MFM).

Almost all hard disks that you purchase have already had a low-level format. Performing a low-level format erases all data on the disk. Format is a MS DOS command that can be used to remove information from computer’s disk, hard disk etc. Format is an external command that is found in many Windows OS.

FAT Data Recovery Software can be effectively used to recover deleted files after format.

(d) Power Failure

Almost all the user working on computer system comes around the problem of loosing working files and data due to power failure or power breakdown. The user can lost the complete working file if it has not been saved to the specified location in computer’s hard disk drives whether the working file is very important for user. User will not be in position to get the data back because when file is in working stage, the file contents gets stored in primary memory that lose its content once the power is down or system shutdown is done.

The reasons for power failure can be defect in power station, damage to power line or other part of distribution system, short circuit or overloading of electricity mains.

FAT Data recovery software recovers and restores all the lost data files easily to save precious data files.

(e) Recover Data from Common Error Messages

i) If FDISK or other disk utilities have been run

Fdisk command divides the logical hard disk into one or more partition before used by an operating system on a PC (Personal Computer). The partition division is described in the partition table found in the Master Boot Record (MBR) in sector 0 of the hard disk.

FDISK destroy the partition containing the system files and operating system from currently active partition. If the computer system is in use, the system will halt and come to attention as soon as user exits FDISK.

Rebooting the computer system after creating a partition, user will find that the system has assigned the new partition a drive letter. User can easily switch to that drive letter from DOS prompt, but cannot read from it or write to it because the drive not yet is being formatted.

User must use the FORMAT command from command line, Windows Explorer or the My Computer window to format the drive before using drive to store data. FAT Data Recovery Software recovers all lost and deleted files, directories and other data.

ii) If VIRUS has invaded/infection

A virus is a program that reproduces its own code by attaching itself to other executable files (COM, EXE) in such a way that the virus code is executed when the infected executable file is executed.

Hard disk drive or Floppy disk system sectors contain executable code that can be infected. More recently, scripts written for Internet Web sites and/or included in E-mail can also be executed and infected. Viruses can attach the files by adding to the end of a file, inserting to middle of file or places the pointer to distinct location on the disk where virus is found.

All viruses working behavior is quite similar, first they infect the file and then attack the data. Some viruses use variety of technique to hide themselves from user to infect the system files and do the destructive things.

Some of malicious codes are also available in Trojan Horses, worms, and logic bombs that destruct the data.

Viruses that can infect a number of different portions of operating system and file system of computer include:

  • Visual Basic Worms use the Visual Basic language to control the computer and perform tasks.
  • System Sector Viruses infect and control information on the disk itself.
  • Macro Viruses contain macro program to infect data files.
  • Cluster Virus infects through the disk directory.

Viruses are categorized by how they infect. The virus categories are:

  • Spacefiller (Cavity) Virus attempt to maintain a constant file size when infecting.
  • Tunneling Viruses try to "tunnel" under anti-virus software while infecting.
  • Camouflage Viruses attempted to appear as a kind program to scanners.
  • NTFS ADS Viruses ride on the alternate data streams in the NT File System.

FAT Data recovery software supports the recovery of all the files that has been deleted and erased due to virus infection.

iii) If FAT file system is damaged

A system used to record the location of all portions of files on a disk. Files are seldom stored in contiguous locations on a disk so the FAT keeps track of the various segments. In each disk partition there are clusters and each cluster is one or more sectors on the disk. The FAT keeps track of which clusters are assigned to files. The directory keeps track of the starting cluster for a file and clusters can be free for use or used by a file. Two copies of the FAT are kept and compared in order to detect disk errors.

The FAT file system can get damaged due to virus infection, erased, deletion, lost and formatting cause. FAT data recovery software efficiently rescues and restores all corrupted FAT files.

iv) If MBR (Master Boot Record)/ Partition Table or DBR (DOS Boot Record)/Boot Sector is destroyed

MBR infectors replace the boot strap code in the front of the MBR with their own copy and do not change the partition table. The hard disk is accessible only when booting from a diskette whenever the partition table is in place, otherwise DOS can not find the data on the drive.

The Stoned virus is a typical example of this technique that stores the original MBR on sector 7, after control is taken by virus via replaced MBR, it reads the stored MBR located on sector 7 in memory and gives it control. Some empty sectors are available after the MBR, and Stoned takes advantage of this.

Some viruses’ format set of extra diskette sector to make it more difficult for antivirus program to access the original copy during repair. This technique is used by Indonesian and Denzuko virus.

Boot viruses replace the original boot sector by overwriting and saving it at the end of the hard disk, like MBR viruses.

The infamous Form virus uses this method and saves the original boot sector at the very end of the disk. Form hopes that this sector will be used infrequently and thus the stored boot sector will stay on the disk without too much risk of being modified.

Boot viruses also save the boot sector at the end of the active partition and make the partition shorter in the partition table to be certain that this sector will not be "free" for other programs to use.

You may also like other software