1. In the process of data recovery, the most feared thing is the secondary damage caused by misoperation, which makes it difficult to greatly improve the recovery. During data recovery, it is forbidden to write new data to the source disk.
2. Don't do a DskChk disk check. After an error occurs in the general file system, when the system is turned on and enters the startup screen, it will automatically prompt whether it is necessary to check the disk. By default, the DskChk disk check will start after 10 seconds. This operation can sometimes repair some small damaged directory files, but it usually destroys data. Because the directory structure is complex, it cannot be repaired. After the repair fails, a directory similar to FOUND.000 will be formed in the root directory, which contains a large number of files with extension. CHK。 Sometimes these files can be restored by changing their names, and sometimes they have been completed, especially for FAT32 partition or larger NTFS database files.
3. Don't format the partition again. After the user formats the partition for the first time, the partition type will change, resulting in data loss. For example, the original FAT32 partition is formatted as an NTFS partition, or the original NTFS partition is formatted as a FAT32 partition. After the data is lost, ordinary software can't scan the original directory format, so it reformats the partition into the original type, and then scans the data. We point out that formatting the original partition type of the second session is a serious wrong operation, which may destroy some large files that could have been recovered, resulting in permanent irrecoverability.
4. Do not restore data directly to the source disk. Many ordinary customers directly restore the files restored by ordinary software to the original directory after deleting the files, which is very likely to destroy the original data, so it is strictly forbidden to directly restore to the source disk.
5. Don't rebuild the partition. After the partition table is destroyed or the partition is deleted, if the partition is directly established or formatted by using the partition table reconstruction tool, it is easy to destroy important areas such as the file allocation table (FAT) or file record table (MFT) of the original partition, which greatly increases the difficulty of recovery. In the practice of recovery, we have encountered many times that after the partition table was destroyed, customers tried several partition tools themselves and could not recover the data, so they thought of asking professionals for help. Results We found that some important directory files were destroyed after various partition tools worked, which led to incomplete file directory recovery and some large files could not be recovered. Unfortunately, the loss of these files according to the initial partition described by the customer is completely recoverable. Professional data repairers will locate the specific location (logical sector number) of the partition before rebuilding the partition table, and then use the sector viewing tool to view several important parameters of the partition, such as DBR/ FAT /FDT/MFT, and then modify the partition table. Moreover, after the partition table is modified, the system will be forbidden to do dskchk to destroy the partition directory during the startup process to ensure that the data will not be destroyed.
6. Don't redo the lost array. In the practice of saving the server array, we have met some network managers who forced the array to go online even if the hard disk was disconnected after the server crashed, or they directly rebuilt it. These operations are very dangerous, and any operation written to the disk may destroy the data.
7. After data loss, it is forbidden to save new files in the partition that needs to be restored. It's best to close the download tool, don't surf the Internet, and close unnecessary applications before scanning and restoring data. If the partition to be restored is a system partition, when the data file is deleted and lost, if there is no important data such as database in this computer, we suggest that you directly turn off the computer and then hang the hard disk on another computer for recovery, because the operating system will write data into the system disk when it is turned off or turned on, which may destroy the data.