Data recovery case: ghost into a big c failure

The title is written in a popular way, but this is also the most intuitive feeling after many people have appeared this kind of ghost.

A few days ago, a friend of the CCID community was helped to recover. His situation is similar to the previous case, which is the data recovery after re-partitioning the hard disk. For details, you can read the posts posted in the forum.

Today, I met a friend from Zhoushan, Zhejiang Province, and also a friend in the Sadie community. His hard disk was misused by ghost, causing data loss. The result of the misoperation is that the entire hard disk is changed from the original 5 partitions to a c-zone of the entire hard disk size after the ghost operation.

In fact, the data caused by ghost misoperation is lost, there are many kinds of situations, we will talk slowly later. Today, let's say that ghost has become a big c problem.

As mentioned in the previous article, in order to recover data, it is necessary to analyze the data loss and determine the problem. Ghost into a big c problem, in detail, it should be a mistake to ghost a file to the hard disk. Generally we use ghost to perform system backup, backup process, we will install the system and software c area, ghost into a file, this is called partition to file. The reverse is when the file is to the partition. Since ghost also has a backup called hard disk to file, otherwise it is a file to the hard disk.

The process of misoperation is that you might think that the system is a bit problematic. If you want to recover, you should make a file to the partition, but make a file to the hard disk. In this way, the result of ghost is that your previous partitions are lost, leaving only one hard disk size c area.

In fact, the process of recovery is not difficult, and the idea is similar to re-partitioning. As long as you find the location of the previously extended partition table, and then calculate, reverse write to the current 0 fan, the data in the previous hard disk can be restored.

However, this friend is not in Beijing, in Zhoushan, Zhejiang, this is more troublesome. This involves remote recovery technology in data recovery, which is generally implemented using pcanywhere. First use msn to pass this friend a good pcanywhere client package, there is a setting description. After setting up the instructions, tell me the username, password, and ip. The client is preferably adsl, so that there is a real ip, it is best to hang the hard drive to be restored on other computers. Specifically, let's talk about it in the future remote recovery.

After the remote control, analyze the existing partitions first, mainly to determine the situation. Then use finaldata to locate the extended partition table. Note that if it can be located, the sector value is not the partition table, but the information table, so it has to be calculated. Then use diskedit to force the location of the extended partition table, and point it in the hexadecimal way in the 0 fan.

After rebooting, the data is fully restored. The entire remote recovery process is controlled within 10 minutes and the data is 100% recovered.