『楼 主』:
转贴：拯救硬盘十大攻略
使用 LLM 解释/回答一下
拯救硬盘十大攻略
为了有效地保存硬盘中的数据，除了经常性地进行备份工作以外，还要学会在硬盘出现故障时如何救活硬盘，或者从坏的区域中提取出有用的数据，把损失降到最小程度。
一、系统不认硬盘
系统从硬盘无法启动，从A盘启动也无法进入C盘，使用CMOS中的自动监测功能也无法发现硬盘的存在。这种故障大都出现在连接电缆或IDE端口上，硬盘本身故障的可能性不大，可通过重新插接硬盘电缆或者改换IDE口及电缆等进行替换试验，就会很快发现故障的所在。如果新接上的硬盘也不被接受，一个常见的原因就是硬盘上的主从跳线，如果一条IDE硬盘线上接两个硬盘设备，就要分清楚主从关系。
二、CMOS引起的故障
CMOS中的硬盘类型正确与否直接影响硬盘的正常使用。现在的机器都支持“IDE Auto Detect”的功能，可自动检测硬盘的类型。当硬盘类型错误时，有时干脆无法启动系统，有时能够启动，但会发生读写错误。比如CMOS中的硬盘类型小于实际的硬盘容量，则硬盘后面的扇区将无法读写，如果是多分区状态则个别分区将丢失。还有一个重要的故障原因，由于目前的IDE都支持逻辑参数类型，硬盘可采用“Normal,LBA,Large”等，如果在一般的模式下安装了数据,而又在CMOS中改为其它的模式，则会发生硬盘的读写错误故障，因为其映射关系已经改变，将无法读取原来的正确硬盘位置。
三、主引导程序引起的启动故障
主引导程序位于硬盘的主引导扇区，主要用于检测硬盘分区的正确性，并确定活动分区，负责把引导权移交给活动分区的DOS或其他操作系统。此段程序损坏将无法从硬盘引导，但从软驱或光驱启动之后可对硬盘进行读写。修复此故障的方法较为简单，使用高版本DOS的FDISK最为方便，当带参数/mbr运行时，将直接更换(重写)硬盘的主引导程序。实际上硬盘的主引导扇区正是此程序建立的，FDISK.EXE之中包含有完整的硬盘主引导程序。虽然DOS版本不断更新，但硬盘的主引导程序一直没有变化，从DOS 3.x到Windos 95的DOS，只要找到一种DOS引导盘启动系统并运行此程序即可修复。
四、分区表错误引发的启动故障
分区表错误是硬盘的严重错误，不同的错误程度会造成不同的损失。如果是没有活动分区标志，则计算机无法启动。但从软驱或光驱引导系统后可对硬盘读写，可通过FDISK重置活动分区进行修复。
如果是某一分区类型错误，可造成某一分区的丢失。分区表的第四个字节为分区类型值，正常的可引导的大于32MB的基本DOS分区值为06，而扩展的DOS分区值是05。很多人利用此类型值实现单个分区的加密技术，恢复原来的正确类型值即可使该分区恢复正常。
分区表中还有其它数据用于记录分区的起始或终止地址。这些数据的损坏将造成该分区的混乱或丢失，可用的方法是用备份的分区表数据重新写回，或者从其它的相同类型的并且分区状况相同的硬盘上获取分区表数据。
恢复的工具可采用NU等工具软件，操作非常方便。当然也可采用DEBUG进行操作，但操作繁琐并且具有一定的风险。
五、分区有效标志错误的故障
在硬盘主引导扇区中还存在一个重要的部分，那就是其最后的两个字节：“55aa”，此字节为扇区的有效标志。当从硬盘、软盘或光盘启动时，将检测这两个字节，如果存在则认为有硬盘存在，否则将不承认硬盘。此处可用于整个硬盘的加密技术，可采用DEBUG方法进行恢复处理。另外，当DOS引导扇区无引导标志时，系统启动将显示为：“Mmissing Operating System”。方便的方法是使用下面的DOS系统通用的修复方法。
六、DOS引导系统引起的启动故障
DOS引导系统主要由DOS引导扇区和DOS系统文件组成。系统文件主要包括IO.SYS、MSDOS.SYS、COMMAND.COM，其中COMMAND.COM是DOS的外壳文件，可用其它的同类文件替换，但缺省状态下是DOS启动的必备文件。在Windows 95携带的DOS系统中，MSDOS.SYS是一个文本文件，是启动Windows必须的文件，但只启动DOS时可不用此文件。DOS引导出错时，可从软盘或光盘引导系统后使用SYS C:命令传送系统，即可修复故障，包括引导扇区及系统文件都可自动修复到正常状态。
七、FAT表引起的读写故障
FAT表记录着硬盘数据的存储地址，每一个文件都有一组FAT链指定其存放的簇地址。FAT表的损坏意味着文件内容的丢失。庆幸的是DOS系统本身提供了两个FAT表，如果目前使用的FAT表损坏，可用第二个进行覆盖修复。但由于不同规格的磁盘其FAT表的长度及第二个FAT表的地址也是不固定的，所以修复时必须正确查找其正确位置，一些工具软件如NU等本身具有这样的修复功能，使用也非常的方便。采用DEBUG也可实现这种操作，即采用其m命令把第二个FAT表移到第一个表处即可。如果第二个FAT表也损坏了，则也无法把硬盘恢复到原来的状态，但文件的数据仍然存放在硬盘的数据区中，可采用CHKDSK或SCANDISK命令进行修复，最终得到*.CHK文件，这便是丢失FAT链的扇区数据。如果是文本文件则可从中提取出完整的或部分的文件内容。
八、目录表损坏引起的引导故障
目录表记录着硬盘中文件的文件名等数据，其中最重要的一项是该文件的起始簇号。目录表由于没有自动备份功能，所以如果目录损坏将丢失大量的文件。一种减少损失的方法也是采用CHKDSK或SCANDISK程序恢复的方法，从硬盘中搜索出*.CHK文件，由于目录表损坏时仅是首簇号丢失，每一个*.CHK文件即是一个完整的文件，把其改为原来的名字即可恢复大多数文件。
九、误删除分区时数据的恢复
当用FDISK删除了硬盘分区之后，表面上是硬盘中的数据已经完全消失，在未格式化时进入硬盘会显示为无效驱动器。如果了解FDISK的工作原理，就会知道FDISK只是重新改写了硬盘的主引导扇区(0面0道1扇区)中的内容，具体说就是删除了硬盘分区表信息，而硬盘中的任何分区的数据均没有改变。可仿照上述的分区表错误的修复方法，即想办法恢复分区表数据即可恢复原来的分区及数据。如果已经对分区格式化，在先恢复分区后，可按下面的方法恢复分区数据。
十、误格式化硬盘数据的恢复
在DOS高版本状态下，FORMAT格式化操作在缺省状态下都建立了用于恢复格式化的磁盘信息，实际上是把磁盘的DOS引导扇区、FAT分区表及目录表的所有内容复制到了磁盘的最后几个扇区中(因为后面的扇区很少使用)，而数据区中的内容根本没有改变。这样通过运行UNFORMAT命令即可恢复。另外DOS还提供了一个MIROR命令用于记录当前磁盘的信息，供格式化或删除之后的恢复使用，此方法也比较有效。
Ten Strategies for Saving Hard Drives
To effectively preserve data in the hard drive, in addition to regular backup work, one should also learn how to rescue the hard drive when it malfunctions or extract useful data from bad sectors to minimize losses.
1. The system does not recognize the hard drive
The system cannot boot from the hard drive, and cannot enter drive C from drive A. The automatic detection function in CMOS cannot find the hard drive. This kind of failure mostly occurs on the connection cable or IDE port. The possibility of the hard drive itself being faulty is small. By reinserting the hard drive cable or replacing the IDE port and cable for replacement tests, the location of the failure will be quickly found. If the newly connected hard drive is not recognized, a common reason is the master-slave jumper on the hard drive. If two hard drive devices are connected on one IDE cable, the master-slave relationship should be distinguished.
2. Failures caused by CMOS
The correctness of the hard drive type in CMOS directly affects the normal use of the hard drive. Now the machine supports the "IDE Auto Detect" function, which can automatically detect the type of the hard drive. When the hard drive type is incorrect, sometimes the system cannot boot at all, and sometimes it can boot but there will be read-write errors. For example, if the hard drive type in CMOS is smaller than the actual hard drive capacity, the sectors behind the hard drive cannot be read and written. If it is in a multi-partition state, some partitions will be lost. Another important failure reason is that since current IDE supports logical parameter types, the hard drive can use "Normal, LBA, Large", etc. If data is installed in a general mode and then changed to other modes in CMOS, a hard drive read-write error failure will occur because its mapping relationship has changed and the original correct hard drive position cannot be read.
3. Boot failure caused by the master boot program
The master boot program is located in the master boot sector of the hard drive, mainly used to detect the correctness of the hard drive partition and determine the active partition, and is responsible for handing over the boot right to the DOS or other operating system of the active partition. If this program is damaged, it cannot boot from the hard drive, but after booting from a floppy disk or CD-ROM, the hard drive can be read and written. The method to repair this failure is relatively simple. Using FDISK of a high-version DOS is the most convenient. When running with the parameter /mbr, it will directly replace (rewrite) the master boot program of the hard drive. In fact, the master boot sector of the hard drive is established by this program, and FDISK.EXE contains the complete master boot program of the hard drive. Although the DOS version is continuously updated, the master boot program of the hard drive has not changed. From DOS 3.x to the DOS of Windows 95, as long as a DOS boot disk is found to boot the system and run this program, it can be repaired.
4. Boot failure caused by partition table error
Partition table error is a serious error of the hard drive. Different degrees of errors will cause different losses. If there is no active partition flag, the computer cannot boot. But after booting the system from a floppy disk or CD-ROM, the hard drive can be read and written, and the active partition can be reset through FDISK for repair.
If a certain partition type is incorrect, a certain partition will be lost. The fourth byte of the partition table is the partition type value. The normal bootable basic DOS partition greater than 32MB has a value of 06, and the extended DOS partition has a value of 05. Many people use this type value to realize the encryption technology of a single partition. Restoring the original correct type value can make the partition return to normal.
There are other data in the partition table for recording the start or end address of the partition. The damage of these data will cause confusion or loss of the partition. The available method is to write back the backed-up partition table data, or obtain the partition table data from other hard drives of the same type and with the same partition status.
The recovery tool can use tools such as NU, which is very convenient to operate. Of course, DEBUG can also be used for operation, but the operation is cumbersome and has certain risks.
5. Failure of partition valid flag error
There is also an important part in the master boot sector of the hard drive, that is, its last two bytes: "55aa", this byte is the valid flag of the sector. When booting from the hard drive, floppy disk or CD-ROM, these two bytes will be detected. If they exist, it is considered that there is a hard drive; otherwise, the hard drive will not be recognized. Here can be used for the encryption technology of the entire hard drive, and can be restored by the DEBUG method. In addition, when the DOS boot sector has no boot flag, the system boot will display: "Mmissing Operating System". The convenient method is to use the following general repair method of the DOS system.
6. Boot failure caused by the DOS boot system
The DOS boot system is mainly composed of the DOS boot sector and the DOS system file. The system file mainly includes IO.SYS, MSDOS.SYS, COMMAND.COM, where COMMAND.COM is the shell file of DOS, and can be replaced by other similar files, but in the default state, it is a necessary file for DOS boot. In the DOS system carried by Windows 95, MSDOS.SYS is a text file, which is a necessary file for booting Windows, but when only booting DOS, this file can be not used. When the DOS boot is wrong, after booting the system from a floppy disk or CD-ROM, use the SYS C: command to transfer the system, and the failure can be repaired, including the boot sector and the system file can be automatically repaired to the normal state.
7. Read-write failure caused by the FAT table
The FAT table records the storage address of the hard drive data. Each file has a group of FAT chains to specify its cluster address. The damage of the FAT table means the loss of the file content. Fortunately, the DOS system itself provides two FAT tables. If the current FAT table is damaged, the second one can be used for coverage repair. But because the length of the FAT table and the address of the second FAT table of different specifications of the disk are not fixed, so when repairing, the correct position must be correctly found. Some tools such as NU itself have such a repair function, and it is very convenient to use. DEBUG can also realize this operation, that is, use its m command to move the second FAT table to the first table. If the second FAT table is also damaged, the hard drive cannot be restored to the original state, but the file data is still stored in the data area of the hard drive, and can be repaired by the CHKDSK or SCANDISK command, and finally get the *.CHK file, which is the sector data of the lost FAT chain. If it is a text file, the complete or part of the file content can be extracted from it.
8. Boot failure caused by directory table damage
The directory table records the file name and other data of the hard drive. The most important item is the starting cluster number of the file. The directory table has no automatic backup function, so if the directory is damaged, a large number of files will be lost. A method to reduce the loss is also to use the repair method of the CHKDSK or SCANDISK program, search for the *.CHK file from the hard drive. Because when the directory table is damaged, only the first cluster number is lost, each *.CHK file is a complete file, and changing it to the original name can restore most files.
9. Data recovery when the partition is deleted by mistake
After deleting the hard drive partition with FDISK, the data in the hard drive seems to have completely disappeared. When entering the hard drive without formatting, it will display as an invalid drive. If you understand the working principle of FDISK, you will know that FDISK only rewrites the content in the master boot sector (0 surface 0 track 1 sector) of the hard drive, specifically, it deletes the partition table information of the hard drive, and the data of any partition in the hard drive has not changed. You can imitate the repair method of the partition table error mentioned above, that is, find a way to restore the partition table data to restore the original partition and data. If the partition has been formatted, after restoring the partition first, you can restore the partition data by the following method.
10. Data recovery when the hard drive is formatted by mistake
In the high-version state of DOS, the FORMAT formatting operation establishes the disk information for restoring formatting by default, in fact, it copies all the content of the DOS boot sector, FAT partition table and directory table to the last few sectors of the disk (because the latter sectors are rarely used), and the content in the data area has not changed. Thus, by running the UNFORMAT command, it can be restored. In addition, DOS also provides a MIROR command for recording the current disk information for use in formatting or deletion recovery, and this method is also more effective.
|
