中国DOS联盟

Data Recovery
Lei Zhenghai
Chibi Local Taxation Bureau
Abstract This article briefly explores the safe recovery of data from the physical storage level of data using earlier data operation tools.
Keywords data, security, recovery
For a long time, there seems to be a lack of comprehensive understanding of data recovery in the computer field. We should first give a broad concept of computer data. Some people think that only things like text files, records or tables in databases are data; in fact, in a broad sense, any information located on the computer storage medium is data, no matter what medium it is or what its specific function is, they are all data. Correspondingly, any change in these information that is not subjectively intended can be regarded as damage.
Data recovery is a process of restoring abnormal data to normal data.
Potential Threats to Data
1. Malicious programs: The most familiar malicious program to everyone is the virus. 2. Many people think that the impact of the virus on data is only the destructiveness of the virus. 3. This is incorrect. In fact, the infection of the virus itself is a kind of damage. No matter whether a virus modifies your boot sector, executable program or office document, it can change your normal data. Of course, you may give an extreme example of a benign accompanying virus. But there is no doubt that it also constitutes a threat to data. At least it reduces the available space of your hard disk. Malicious programs also include Trojan horses, logic bombs, etc. The damage they cause may be the most difficult to recover.
13. Other malicious damages: Even without the help of viruses or other tools, as long as you have sufficient permissions, any system has a certain "self-destruct" ability. For example, relying on normal system operations such as deletion, movement, formatting, etc. can lead to data damage. With the development of network technology, the threat is no longer limited to the local machine.
19. Mistaken operations: Many data losses originate from users' operation errors, such as mistaken deletion, mistaken formatting, etc.
22. Errors in the operating system or application software: As the code of the operating system and application programs increases exponentially, BUGs also continue to increase. The most commonly used desktop system WIN9X is a BUG king. Errors in the operating system and application software often bring some unexpected impacts to people's work. For example, a BUG in Frontpage 98 a while ago would delete all the files in your directory when triggered. In addition, for the famous game "Myth II", there are serious problems such as losing the extended partition if it is not installed in the default directory.
34. Encryption and permissions: Although encryption and permission settings are effective means to protect data, forgetting the password will also bring great problems.
36. Power failure: The consequence of the machine suddenly powering off may not only be the loss of memory data, but also the loss of disk data or the inability of the system to start normally.
40. Memory overflow: There are many reasons for causing low-level errors such as memory overflow or illegal process termination. It is like a power failure, which will make you lose the current work.
43. Upgrades: Software system upgrades sometimes bring some problems, and we will give corresponding examples later.
45. Hardware damage and theft: This may be one of the most serious threats. Sometimes it reduces the possibility of you recovering data to zero.
Various Logical Phenomena of Data Loss
The recovery of data is basically a logical processing. Only by making an accurate judgment of the situation can an accurate response be made. Generally speaking, it can be summarized into the following situations.
1. The hard disk cannot complete the correct boot: Logical damage caused by physical faults, boot sector faults, important sector crashes, etc. will all make the system unable to complete the normal boot process.
4. File loss: Intentional damage, mistaken deletion, etc. will all cause data loss. This classification not only includes the loss of one or several files, but also applies to the loss of directories, partitions or volumes.
9. Files cannot be opened normally: Due to virus infection, encryption, file header damage and other situations, files cannot be opened normally.
11. Data disorder: Due to the influence of various factors, the information in the database, text files, etc. may be completely distorted.
Brief Introduction to the System Working Mechanism
1. Composition of DOS (DOS-compatible system) hard disk data
The DOS disk system can manage the physical space according to the concept of logical partitions, and different partitions can load different OS systems.
Each partition of the FAT structure has an independent boot record, FDT table, FAT table, etc. At the same time, the system also has a most important master boot record, at cylinder 0, head 0, sector 1. In the future, we use CYL to represent cylinder, SIDE to represent head, and SEC to represent sector.
The following is a brief introduction to important parts:
The master boot record is also called the primary partition table, MBR, etc.: MBR occupies one sector, at CYL 0, SIDE 0, SEC 1, and is composed of a code area and a data area. Among them, the code area is a section of standard program, which completes the work between BIOS boot and OS BOOT, and makes the final preparation for OS startup. The standard code area can be rebuilt by FDISK/MBR, but the non-standard MBR for multi-system boot will be damaged by this operation. The data area of MBR records the partition situation.
System sectors: CYL 0, SIDE 0, SEC 1 - CYL 0, SIDE 0, SEC 63, a total of 62 sectors.
The boot sector is also called the BOOT area: CYL 0, SIDE 1, SEC 1, which was formerly called the DOS boot sector. It also occupies one sector.
Hidden sectors: CYL 0, SIDE 0, SEC 1. If it is FAT16, it occupies one sector. If it is FAT32, it occupies 32 sectors.
The file allocation table, also called FAT, is where the situation and connection relationship of file-occupied clusters are recorded. Generally, there are two FAT tables, which play a backup role. The first FAT table of FAT12 and FAT16 is generally at 0-1-2. The first FAT table of FAT32 is at 0-1-33. Since the FAT table records the place where file-occupied sectors are connected, if both FAT tables are damaged, the consequences will be unimaginable. Since the length of the FAT table is related to the size of the current partition, the address of FAT2 needs to be calculated.
Root directory area (ROOT, FOT): Here, the directory file items of the root directory, etc. are recorded. The ROOT area follows FAT2.
Data area: Follows the ROOT area. This is the actual data content.
In fact, the reconstruction of MBR, hidden sectors, and BOOT area is relatively easy. The key to data recovery is to recover data files. Since the FAT table records the linked list of sectors occupied by files on the hard disk, if both FAT tables are completely damaged, it is quite difficult to recover files, especially files occupying multiple consecutive sectors.
2. Brief description of the master boot record
The master boot record is the starting point of hard disk boot. Not much is said about the code area. In its data area, two marks are relatively important, 80H and 55AA. 80H is generally at offset 1BE. 80 is the mark of partition activation, indicating that the system can be booted, and there can be only one 80 mark in the entire partition table. The other is the ending mark 55AA, which is used to indicate that the master boot record is a valid record. In addition, the boot records of each partition themselves also end with 55AA, which is the mark for us to find partitions. When we introduce the master boot record later, an example of a complete partition table is given, and everyone can check it against it.
In the data area, one partition is represented by 10H bytes, and up to 4 partitions can be represented, starting from 1BE, 1CE, 1DE, 1EE respectively. The meaning of the corresponding address of the partition table entry is given later. Everyone can analyze the following partition situation correspondingly.
80 01 01 00 0B FE BF FC 3F 00-00 00 7E 86 BB 00
① ② ③ ④ ⑤ ⑥
1 Activation mark, 2 80 indicates a bootable partition.
4 The starting head number of the partition is 01, the starting sector number is 01, and the starting cylinder number is 00. Since the starting sector number is 6 bits in binary, and the starting cylinder number is 10 bits in binary, the high two bits of the byte used for the sector number should be added to the high two bits of the cylinder number.
9 The system type of the partition is FAT32 (0B), 01 is FAT12, 04 is FAT16, 06 is BIGDOS, 07 is NTFS, and others refer to the partition type table.
10 The ending head number of the partition is 254, the ending sector number is 63, and the ending cylinder number is 764.
11 The relative sector number of the first sector is 63.
12 The total number of sectors is 12289622.
Prerequisites for Data Recovery
As a process of data reproduction, data recovery must solve two problems: first, where to recover, and second, how to recover. Once these two problems are solved, we actually grasp data recovery. This part is to explore the problem of where to recover.
1. Effective and timely backup is the most reliable source of data recovery: In today's era when many people advocate backing up to seconds, I am afraid no one will doubt this. And some backup mechanisms are built-in in the system, such as two FAT tables.
11. The judgment of the actual validity of data is the key: For us, phenomena such as the hard disk being unable to boot, files not being found, files not being opened, etc. do not actually equate to data loss. Because at this time, it is often only logical loss. In the physical sense, it still exists or partially exists. The most obvious example is the case of file deletion. In fact, this is just changing the first byte of the file to 0E5, and the file body still exists.
23. Reversibility analysis of the data damage process: The changes to data are nothing more than two types, replacement and transformation. The former is irreversible, and the latter is reversible. Taking virus killing as an example, for most file viruses, for file viruses that infect in an appended rather than replaced manner, the ideal virus killing process is the reverse process of infection. This analysis is also applicable to the situation where important information is hidden, moved, or encrypted, but the analysis will be more complicated.
34. Whether the data itself is standard information: Some information is actually general or locally general. You don't need to consider how to rescue it from the local machine. As long as there are the same or similar system versions, it is okay. For example, the BOOT area, hidden sectors, WINDOWS DLL files, etc. A typical example is the partition table code area, which is a section of standard code. In fact, it is placed in your FDISK program, and you can extract it with DEBUG.
44. Whether the data itself can be regenerated from other information statistics: Some information is lost and there is no backup. But it can actually be indirectly obtained from other data. The most typical example is the partition information in the primary partition table. Even if you clear it, you don't have to be afraid because you can calculate and regenerate it from several partitions.
50. Completion degree of damage: In fact, FDISK and FORMAT will not completely destroy data. Generally, only low-level formatting and sector overwriting operations will completely destroy data. But sometimes, the damage process or the mistaken operation process cannot be completed due to manual termination,死机, etc. The most obvious example is the case of the CIH virus. Since CIH overwrites sectors in units of 1024 bytes, this is of course an irreversible process. So we initially thought that the damage was difficult to recover, unless it was manually terminated. In fact, when the virus overwrites some sectors, it will conflict with the WIN9X system, resulting in a system crash and protecting the data.
Common Basic Operations
1. Read out the master boot record: This is one of the programs that may be involved most in system-level data recovery.
Example:
DEBUG
-a100; Start assembly from here
126C:0100 MOV ax,201; Read one sector
126C:0103 mov bx,300; Send to address 300
126c:0106 mov cx,1; Cylinder 0, head 0, sector 1
126c:0109 mov dx,80; 80H is the hard disk, head 0
126c:010c int 13
126c:010e int 3
126c:010f
-g=100; Execute
AX=0050 BX=0300 CX=0001 DX=0080 SP=FFEE
BP=0000 SI=0000 DI=0000
DS=126C ES=126C SS=126C CS-126C IP=010E
NV UP EI PL NZ NA PO NC
Here, the I/O interrupt 13 is used. The meanings of the involved registers are:
ah, operation mode, 02H is read, 03H is write
al, number of sectors to send
bx, memory offset address to load the sector
cx, from which cylinder and sector to start. We generally change cx to read and write different logical sectors of a logical disk
dx, send the drive number and head number
int 3 is a breakpoint interrupt, which stops the program from running here.
2. Display the content of the boot sector: We read the sector to a certain memory address not to see its content. The D command in DEBUG can conveniently view the content of memory units.
Continuing the previous example, if we want to see the content of the master boot sector, since it is loaded to 300.
-d300 1200 can be used to view it. An image of a boot sector can intuitively see the code area and data area mentioned earlier.
3. Disassemble the content of the master boot sector: To determine whether the code area of MBR is normal, for the basic situation of the data area, we can draw a conclusion through intuitive observation. But for boot viruses or the situation where abnormal code appears in the boot sector, we may need to analyze the instructions in the code area of MBR. This generally requires disassembling the boot sector that has been read into memory. Disassembly is done with the U instruction.
Continuing the previous example:
-u300 115D; Disassemble the content of the master boot sector code area
126C:0300 33C0 XOR AX，AX
126C:0302 8ED0 MOV SS，AX
．．．．．．．．．．．．．．．．．．
126C:045C 65 DB 65
126C:045D 6D DB 6D
4. Write to memory units: In our previous example, the primary partition type is 0B, which is FAT32. Assuming this type is actually NTFS, how should we modify it? Since the offset of the primary partition type is 4C3H, we can use the E command to write to the memory unit. From the attached table, the type of NTFS is found to be 07. Therefore, -e4c3 7
For another example, assuming we want to clear the invalid partition table, then we should use another command F, which can fill a memory address range. The operation of clearing the partition table is -f4be 4ff 00. The following two operations are also relatively common.
Reset the 80 mark, -e4be 80
Reset the 55AA mark, -f4ff 4fe 55 aa
Don't forget that at this time, only the data in memory has been modified, and it has not been written to the hard disk. Therefore, the int 13 interrupt is needed to write the modified result back to the hard disk.
Continuing the previous example,
-a100
126c:0100 mov ax, 301 ; Write one sector
-g=100; Execute
In fact, we have modified the previously input program for reading the master boot sector, making the program become.
126C:0100 mov ax ,301; Write one sector
126C:0103 mov bx ,300; From memory address 300
126C:0106 mov cx,1 ; Cylinder 0, head 0, sector 1
126C:0109 mov dx,80 ; 80H is the hard disk, head 0
126C:010C int 13
126C:010E int 3 ; Breakpoint
5. Reading and writing of absolute disk content: Similar operations are relatively common in the repair of CIH-damaged FAT32 structure hard disks. The basic idea of recovery mentioned later is to overwrite the first FAT table with the second FAT table. Then it is necessary to read the content of the second FAT table and write it back to the position of the first FAT table. Generally speaking, it is very convenient to read and write a large number of consecutive sectors with DiskEDIT. If done with DEBUG, a subroutine needs to be written. However, the main skill of the program is to use the int 25 absolute disk read interrupt to read the content and the int 26 absolute disk write interrupt to write the content.
Recovery Example
The recovery process can show a certain idea, not just pure technical means. It is not particularly complicated. It can generally be understood without the appearance of assembly programs. But the recovery itself is not perfect. Some mistakes may be made in the middle, and some may even fail locally.
Example of CIH-damaged hard disk recovery
Hard disk situation: CIH occurs, the screen turns blue and the system crashes. The repair with KV300 F10 is not successful, and the saved MBR is restored.
Repair tools: Prepare 3 floppy disks DISK1 - WIN98 boot disk (with DEBUG); DISK2 - DiskEDIT and other tools; DISK3 - DOS-based CIH-killing tool
Basic idea:
1. If FAT2 is not damaged, use FAT2 to overwrite FAT1.
3. If FAT2 is also damaged, generally only expect to retrieve some key files.
What we most expect is that these files are continuous. If they are not continuous, it is not impossible, but this often also requires knowing some details of the files, including understanding the connection structure of some files themselves. If FAT2 is not completely damaged, it is of certain use. In addition, generally speaking, for FAT16 hard disks, because the FAT table is damaged more seriously at the front, if both FAT tables are damaged, it is difficult to recover even for small hard disks.
Repair process:
Power on, enter SETUP, detect the hard disk, and record the parameters - CLY 620 HEAD 128 PRECOMP 0 LANDZ 4959 SECTOR 63 MODE LAB.
Boot with the prepared floppy disk:
A:>C:
Display Invalid drive specification
Rebuild the master boot record with FDISK/MBR (this is a habit). Boot with the new floppy disk (may not be necessary). At this time, the C: hard disk can be seen. Start DiskEdit. During the startup process, Invalid media type reading DRIVER C is displayed. First, use DEBUG to clear the partition table and set the 80 and 55AA marks. Restart, then run DISKEDIT. It is displayed as SET READ ONLY. Remove the read-only option in TOOLS/CONFIGURATION, save the settings, and now it can be edited.
Since there were multiple hard disks connected at that time, I regarded this one as having only the C partition, so I didn't look at other things. We expect that FAT2 is not damaged, so as to use FAT2 to overwrite FAT1. At this time, DiskEDIT is much easier than DEBUG. In FIND OBJECT, select FAT, check the starting sector. Okay, at CYL 0 SIDE68 SEC 14, 0000H, F8 FF FF 0F (FAT32). Okay, FAT2 is not damaged. In fact, if DiskEDIT is not used, a small program can be used to check. The offset 0000 is F8 FF FF.
Since it was thought that there was only the C partition, I directly searched for IO SYS (there should be six spaces between IO and SYS) in FIND to find the ROOT area. After finding it, observe whether there are common files under C:\. Okay, the ROOT area is not damaged. Record the CYL 0, SIDE 68, SEC 14 of this sector for later use.
FAT1 is generally damaged in the front, but the latter should still be there, which can be used as a check. Because it is 32-bit, FAT1 is generally at CYL 0 SIDE1 SEC 33. Since there is the ROOT area, then the length of the FAT table should be calculated. Because FAT2 ends at the previous sector of the ROOT area, it is very simple. Then FAT2 can be used to overwrite FAT1. Here, either DEBUG or DiskEDIT can be used. If using DEBUG, generally use the INT 25 absolute sector read, and then use INT 26 to write. If using DiskEDIT, it is relatively simple.
Then the master boot record, hidden sectors, and BOOT area can be recovered. NDD can be used to repair the partition table first. Other things can be considered to be covered with the standard method. If you hope that NORTON UTILITIES will take over the next step, these can not be done. I took the corresponding parts from another FAT32 machine and wrote them in. At this time, a D drive was found. First, take a look. Power off and connect the hard disk in series. Use NORTONUTILITIES 4 to scan the C drive. The files are basically recovered. Kill the virus on the C drive. WHY, no virus is found. Change to 2 kinds of antivirus software, still no virus. Now it is displayed that the C drive is 948M, and there is a D drive, but it cannot be browsed under 95, and there are garbled characters under DOS. Then repair the D drive. Then return to DOS. Use DEBUG to find the sector with the ending mark 55AA, and then determine whether it is an extended partition according to whether there is FAT behind it. At this time, the size can be calculated to revise the primary partition table. Of course, many tools can also complete this work very well. If you are not sure, just let them complete it. In fact, I did it with RE. Otherwise, it is really too troublesome to do manually.

Okay, this kind of thing is definitely needed in large quantities.

Good article~~ Study study~~~

Not yet at that level... Watching from the sidelines

Oh, why are there so many numbers in the middle of the text? It gives me a headache.

I can 't understand what it means

Good stuff, thanks! Received it.

Well, not bad, learned it!!
Top