China DOS Union

A very good article! Friends interested in data protection and recovery technology should definitely not miss it! (The article is rather long, so it takes some patience to read through it all)

Data Protection and Recovery Technology
Original author: Scott Mueller (USA)
Translated and compiled by: Chief A-Q


Part One: Basic principles, methods, and related products for backup

Have you ever...
Watched a virus destroy the contents of a hard drive...
Used the randomly bundled system recovery CD and ended up destroying your data...
Run FDISK on a problematic hard drive and deleted a partition...
Heard a noisy hard drive die and take your data with it...
While saving, replaced a newer data file with an old, incomplete version...
Data destruction like this is disastrous, especially if you haven’t backed up recently. Today, huge hard drives (180GB and still climbing) are turning more and more users into crazy data collectors who still don’t back up their data. Unfortunately, while hard drive capacities keep getting larger, the dangers brought by viruses and user mistakes are also increasing.
I have taught data recovery techniques for many years and have written a book about data recovery, but it is still best to avoid having to rescue data from a hard drive that no longer works properly. If you know how to back up your information reliably and prevent data loss, then when a hard drive has problems, even if you can’t exactly laugh about it, you can still treat it as a minor nuisance rather than a tragedy.
So how do you eliminate these threats (after all, data is the most important thing in a computer)? In the first part of this series, you will learn how to determine which files are most important, and how to save and back them up. In the second part, you will learn how to recover data and deal with potential data loss when facing the most common system disasters.

【The key to protecting information in your system】

When deciding what information in the system needs to be backed up and how to back it up, remember the following points:
·Programs and data files coexist in a computer
·If the system crashes, programs can be reinstalled from the original storage media, but data cannot be reinstalled unless you have a backup copy
·Recovery CDs can be used to restore the system to working condition, but they may also destroy data
·The better your data is managed, the easier it is to back up
·You must choose from a large number of backup methods (many of which are already included in Windows)
·Compared with the backup tools that come with Windows, third-party software provides more recovery options
·If you know how to use a CD burner, it will be an excellent tool for backing up information
·Frequent backups make data recovery easier
Let’s discuss them one by one below

▲Programs and data files coexist in a computer

This may seem obvious enough, but until you truly understand the differences between different types of files, you may have been spending a lot of time backing up the wrong files while neglecting the irreplaceable ones. Program files are the files that make software run. From Windows to Microsoft Office, from Adobe Acrobat to CorelDraw, operating systems, Office suites, and graphics software are all collections of program files. These files have extensions such as .exe, .dll, .vba, and so on. When software is installed, program files are usually stored on the hard drive in \Program Files, the \Windows folder, or other folders created during installation.
Data, on the other hand, contains information you create, such as drawings, documents, budgets, databases, scanned photos, digital music files, and so on. Program files are installed in locations specified by the software developer (unless you choose custom installation options provided by some programs), but data files can be stored anywhere. Since some software stores data by default in the program’s own folder, while other software uses the \My Documents folder, or the \Documents and Settings folder in newer versions of Windows, choosing the software’s own default file location can make data files very scattered. Obviously, this makes backing up data difficult. But why should backup be made the top priority?

▲Only data needs to be backed up

Since program files can be recreated by reinstalling the software, and with today’s high-speed CD-ROM drives and hard drives this takes only a few minutes, backing up program files should not be the priority.
On the other hand, data in documents and spreadsheets is irreplaceable and cannot be bought again. If data is lost, the only way to replace it is by using the backup you created. Scanning and retouching a picture takes a few minutes, doing a household budget takes several hours, filing taxes takes several days, and writing a book takes several weeks. You may say you don’t mind spending time doing these things over again, but if you don’t want to spend time recreating finished work, spend a few minutes making a backup!
Even if you are willing to spend the time rebuilding it, it still won’t be the same as before. You may forget names, places, facts, and figures, and those may be exactly the important parts of the lost data. So it is best to make a backup, so that if an unforeseen disaster occurs, the data can be restored exactly as it was.

▲The dangers and benefits of recovery CDs

Most computers with preinstalled systems nowadays do not come with standard Windows installation CDs, while some computers also come preinstalled with some kind of office suite and other software. But they are usually equipped with system and application recovery CDs, intended to restore the system as much as possible to its factory state. If you use a recovery CD to restore the system after a crash, usually all data will be lost. Don’t forget that when you received the computer, it contained no data at all—only program files on the hard drive.
Some recovery CDs provide an option to restore Windows without formatting the hard drive, while some do not. This “all or nothing” method makes backups especially important, because the price of recovering from a system crash may be the loss of all information. But if you have a current backup of your information, you can carry out system recovery without fear.

-----to be continued

▲Data management

Fortunately, it takes almost the simplest method imaginable to decide on a proper place to save files. I recommend the \My Documents folder in Win 9x/ME, or the \Documents and Settings folder in Win 2000/XP. At the same time, to avoid documents, graphics, and other types of files getting mixed together, you can use Explorer to create separate folders for each under the system’s default folder.
After creating folders for each program’s data files, use the program’s property settings to specify the correct folder as the default location. Depending on the software you use, you may need to open the “Tools,” “File,” or other menu to open the “Options” menu where the default file location can be set. (Some programs do not allow the save directory for data files to be changed.)
Since backup files created by application software can come in handy when disaster strikes, you can set the software’s backup directory to the data folder you created, or to a folder named “Backup,” and make this folder a subdirectory of the data folder.
If you do not want to use the system default C:\My Documents or \Documents and Settings directory, and would rather save files on a separate physical or logical drive, you can open the properties of \My Documents or \Documents and Settings and enter the location of the new drive or folder. Use the Move button to move the current folder into the new My Documents or Documents and Settings folder.
You may need to move the data files in the current folder into the newly created folder. Once this is done, you can back up and protect the files.

▲Choosing a backup method

You can use the following methods to back up your work:
·Use drag-and-drop in Windows Explorer to copy created files to removable media
·Use the command-line form of the XCOPY program to copy data files
·Use CD or DVD control software to create file copies on discs
·Use Windows or third-party backup programs to create backups to removable media
Which is the best method? If you want to use your information on any computer, regardless of which version of Windows it uses, the first two methods are the most attractive.

△Using drag-and-drop

In Explorer, you can drag and drop files or entire folders to a removable drive. If you have a CD burner, you can use packet-writing software such as Adaptec’s DirectCD to turn the drive into a “big floppy disk” drive. But remember to format the CD-R or CD-RW disc first. Formatting a CD-R can be completed in 30 seconds, but a CD-RW takes 45 minutes, which is why it can be erased and rewritten many times. Since CD-Rs are very cheap and take little time, they are the better choice for most users.
Discs made with software such as DirectCD use the UDF (Universal Disk Format) file system. Note that some versions of DirectCD do not support Windows XP, but you can upgrade Easy CD Creator 5 Platinum to make it compatible with Windows XP. The upgrade will install a version of DirectCD compatible with Windows XP, and that version can copy a Windows XP-compatible UDF reader onto the CD-R or CD-RW disc. A Windows XP system without DirectCD installed can read the disc by installing the UDF reader from the disc.

△Using XCOPY

If you only want to copy files created on or after a specific date to removable media or optical storage media, you can use the command-line form of the XCOPY program. For example, to copy files stored in the \My Documents folder that were created on or after March 15, 2002 to a specific drive, while also creating folders to keep the original directory paths unchanged, the command format is:
XCOPY "\My Documents"\*.* /s/d:03-15-02 K:\
Likewise, in Windows 2000 and XP, this command will copy all files in the \Documents and Settings folder:
XCOPY "\Documents and Settings"\*.* /s/d:03-15-02 K:\
When the removable media or optical storage media is full, Windows will prompt you to replace it. Before backing up, make sure the media has already been formatted. Note the quotation marks on both sides of the folder name—in Windows, quotation marks are required for any folder with a long name.

△Controlling data CDs

If you do not want to spend time formatting CD-RW discs, but want the discs you create to be usable on any system, you can use CD/DVD control software to burn files to CD-R discs, such as Easy CD Creator, Nero Burning ROM, or NTI CD Maker 2000. These programs have interfaces similar to Windows Explorer and let you choose which files to move. Compared with drag-and-drop, this method involves a few more steps, but the discs you create can be read by all CD-ROM drives without requiring a compatible UDF reader to be installed.

-----to be continued

▲The need for real backup software
The drawback of these methods is that they cannot back up files larger than the capacity of the storage media, especially when using removable storage such as Zip, LS-120, and LS-240 (for backup purposes, the capacity of a standard 1.44MB floppy disk is far too small). At this point you need a backup method that allows data to be compressed. If you need to compress backup files or span files across multiple media, real backup software becomes useful.
Backup programs differ from ordinary file copy and drag-and-drop methods in the following ways:
·Backups can be compressed to save space
·Backup programs can create a specific single backup file containing multiple files
·Files in a backup archive can only be used after being restored with a compatible program
·Backups can be stored as files and then transferred to storage media, or written directly to CD-R/RW, tape, or rewritable media (depending on the backup software).
·Backups can be disk images (for disaster recovery), can consist of all files on a drive or in a folder, or can consist only of newly created or modified folders or files
Regardless of when files were created or whether they have been backed up before, a full backup backs up all files in the specified drive or folder, while a partial backup only backs up specific files. The most common type of partial backup is a differential backup, which only backs up files created or changed since the last full backup. Restoration of all these backups depends on the features of the backup software, which means the operating system and the backup software must be installed before the backup can be restored. The backup methods described above are best suited for backing up data rather than program files.
A disaster recovery backup is a special type of backup that can rebuild an entire drive or disk partition from bootable media (floppy drive or CD), a backup drive, or backup media. In essence, disaster recovery backups are similar in nature to many recovery CDs now available, except that you create them yourself after personalizing the computer.
Some rewritable media and CD-RW drives come bundled with backup software, but many do not. If you are using Win 98 or a newer version of Windows, you can use the backup software built into Windows.
△Using the built-in backup software of Windows 98/Me
The built-in backup software of Windows 98/Me (originally developed by Seagate) is relatively simple, but it works well with tape, floppy disks, and magnetic rewritable media such as Zip and SuperDisk. Since these programs are built into Windows 98/Me, they can be used as low-cost backup tools. If the amount of data backed up at one time does not exceed 500MB, they can also be used together with CD-R and CD-RW. But these backup programs were developed before CD-RW drives became widespread, so they cannot split a backup across multiple CD-R or CD-RW discs.
In Windows 98/Me, you can start the backup program by clicking “Start”-“Programs”-“Accessories”-“System Tools”-“Backup”. To back up the My Documents folder, choose Create New Backup, back up selected files, and select it from the drive and folder list.
If you have a CD-RW drive, you can first use DirectCD or compatible packet-writing software to format a CD-R (do not enable compression during formatting), then select the files to back up and specify the backup file name.
The settings in Options have a great effect on backup speed. You can specify “Never compress,” “Compress to save time,” or “Maximum compress to save space.” In the example below, I turned off the backup verification option (verification can compare the backup data with the contents of the hard drive, but this option doubles the backup time, and there is no way to test whether it improves backup safety).
I used a 74-minute CD-R, a 12X SCSI CD-RW drive, Win 98SE, and DirectCD 3.05. The results were as follows:

Task name: Que Subdir-packet writing

Backup task started: 2/16/02 7:07:06 PM
Number of files processed: 1,163
Total bytes before compression: 592,755,633
Operation completed: Yes
Backup task ended: 2/16/02 7:20:57 PM

Note: total time 13:51, selected “Never compress data”

Task name: Que Subdir-packet writing

Backup task started: 2/16/02 6:39:00 PM
Number of files processed: 1,163
Total bytes before compression: 592,755,633
Total bytes after compression: 592,755,633
Operation completed: Yes
Backup task ended: 2/16/02 6:52:52 PM

Note: total time 13:52, selected “Compress data to save time”

Task name: Que Subdir-packet writing

Backup task started: 2/16/02 7:48:28 PM
Number of files processed: 1,163
Total bytes before compression: 592,755,633
Total bytes after compression: 416,266,438
Operation completed: Yes
Backup task ended: 2/16/02 7:58:53 PM

Note: total time 10:25, selected “Maximum compress to save space”

Note that backup time was shortest when using maximum compression, while specifying “Compress data to save time” resulted in no compression at all, and backup time was not reduced either.
Windows XP uses a user interface similar to Windows 98/Me, but the backup data is not compatible with that of Windows 98/Me.
△Moving Windows 98/Me backups to XP
There are two potential drawbacks to using Windows 98/Me for backups. First, it cannot split backups across multiple discs. If you want to back up a larger folder, you must create multiple backup tasks, one disc per task, and none can exceed the disc capacity (650MB-700MB). The second problem is obvious: if you want to upgrade Windows 98/Me to XP, or move backup data to a system running XP, neither the XP Home nor Professional backup program is compatible with Windows 98/Me backup files.
But since the backup program in Windows 98/Me was developed by Seagate, you can use its Backup Exec series software to move files into an XP system. At present, the home and small office version of Backup Exec is called Back Up My PC, and it fully supports CD-R/RW drives, rewritable media, and tape drives, and also supports Win NT 4.0 (with Service Pack 4 integrated), Win 98 SE/Me/2000 Workstation/XP.

-----to be continued

▲Third-party backup programs
If you do not want to use the backup tools built into Windows, you can still find many excellent products. For example, NTI Backup NOW! Deluxe Edition (www.ntibackupnow.com ) is rigorously designed for CD-RW drives and CD-R/CD-RW media. Another example is NovaStor’s NovaBACKUP (www.novastor.com), which can be used with CD-RW/R drives and tape drives.
The software features you should consider include:
Disaster recovery. If you do not want to reinstall applications when a hard drive fails, this feature can ensure reconstruction of the hard drive. Some general backup programs require you to choose before backup between a “file backup” and a “disaster recovery image backup.” PowerQuest’s DriveImage (www.powerquest.com ) and Symantec’s Norton Ghost (www.symantec.com) are designed around disaster recovery backup and disk imaging, and with installed file extensions, selected files can be extracted from backup images for recovery.
Support for different versions of Windwos. If you plan to move files backed up under 9x/Me into XP, choose a backup program that supports both current and future Windows versions.
Choice of backup media. Although CD-R/RW is very useful and can support 3-5GB backups when maximum compression is used, for very large backup jobs the best choice is still tape storage.
Do not blindly buy backup software. Most backup software vendors, including those mentioned in this article, provide 30-day trial versions with no functional limitations. Visit their websites, download the products, and find the software that suits you best.

▲Back up early, back up often
Make a full backup of your files, then back up new and changed files every day, and when the system crashes you can avoid time-consuming or expensive data recovery work. In Part Two of this series, we will discuss other methods of preventing system crashes.

Part Two: Data protection and disaster recovery using common utilities
In Part One of this series, you learned how to protect your system by using backup programs under the guidance of a sound backup strategy. But backup alone cannot completely prevent disasters from happening. In Part Two, you will learn how to use utility software according to the characteristics of popular operating systems to carry out disaster recovery in as short a time as possible. In Part Three, you will learn how to evaluate and use professional data recovery software. In Part Four, you will learn how to manually repair drive structures and perform data recovery.

▲Understanding when data recovery is possible

Some people may not know the difference between the file system and the files themselves. Different contents are stored in different areas of the disk. The file system can be thought of as a directory; the operating system uses the file system to locate the actual files on the disk. If the file system is damaged, it may look as though the files are lost, but in fact the files are still completely there, in ideal condition.
Although things can sometimes be more complicated, as long as the files still exist and the drive can still be read and written, data recovery is possible. This means that even if the file system or FAT (file allocation table) is damaged or lost, recovery is still possible if the files themselves still exist in readable sectors on the disk. In fact, data recovery is not really recovering data at all, but simply finding data that still exists. So data recovery is nothing more than rebuilding the file system associated with the files (such as rebuilding the contents of the boot sector, directory, or FAT), or simply copying the actual sectors where the files reside to other storage media.
If the files on the disk no longer exist, then data recovery is impossible. That is to say, if the sectors containing the data have been rewritten, corrupted, or physically damaged, then the data cannot be recovered.
Assuming the file data has been damaged or overwritten, it may be possible to recover part of the sectors where the data was stored, but in most cases this is not very meaningful, because most programs can only handle complete files. Partial reconstruction of damaged files is another area of data recovery, requiring specialized knowledge of the particular file type being handled.
For ordinary data recovery operations, some utilities can help us recover lost data and rebuild the file system. Third-party software can handle most recovery work, and unless the drive is physically damaged, there is no need to spend too much money recovering data.

▲How to safely install software to help you recover lost data

If important files are lost and there was no backup beforehand, the worst thing you can do is save other files or install software on that drive. The reason is this: every time information is stored on the drive with the lost files, the area where the lost files were stored may be overwritten by the new files. If that happens, it will be impossible to recover the data.
If you need to install software to recover lost data, install the software on another drive (note: if a file was deleted by mistake, shut down immediately, connect the hard drive as a slave in another machine, and perform data recovery there).
Professional data recovery work is never carried out on the drive where the data was lost. The method is to make an image copy (sector by sector) of the drive with the lost data, and all work is done on the replacement drive. If conditions permit and the lost data is important, you may want to consider doing this.
If the computer with the lost data does not work properly, it is best to use a computer with the same BIOS and hard drive controller, otherwise the data may not be readable (A-Q: I personally think using a different BIOS is not necessarily impossible; the basic principle is that the BIOS must be able to identify the capacity of the hard drive with lost data accurately and access it normally. If it cannot be accessed, then I’m afraid professional recovery software will be needed). Generally speaking, newer BIOS and operating systems can read older drives.

▲Data recovery—recovering deleted files

The simplest form of data recovery is recovering “deleted” files. You can use Windows-based programs such as Norton Unerase. This works because when the system “deletes” a file, it does two things:
It changes the first letter of the file in the directory listing into a “sigma” (the lowercase form of the 18th letter of the Greek alphabet)
It writes 0 into the related cluster chain in the FAT, indicating that those clusters were once occupied by the file but may now be used by other files
If you use physical-level software such as NDD (Norton Disk Doctor), you can view the directory listing, and the first letter of a deleted file will be a lowercase “sigma.” Norton Unerase and other similar software can also view the directory listing in the FAT and correct the filename of the lost file, unlike Explorer, which ignores the names of deleted files. You can replace the “sigma” with whatever letter is needed, while also rebuilding the cluster chain in the FAT. If you are using Norton Enhanced Recycle Bin, you do not even need to provide the first letter of the filename during recovery, because Enhanced Recycle Bin stores the complete filename.

-----to be continued

▲Recovering data from crashed programs

What if the data was not saved on the drive? Users of Win 9x/Me in particular feel this keenly. After long periods of use or after opening many programs, the system often crashes. If the mouse pointer cannot move or the keyboard does not respond, then even if the file has not yet been saved, there is no choice but to shut down the system

and restart.
You may think there is no hope, but some applications temporarily save the data they use, mainly in the following two ways:
Most Windows applications create temporary files (with the file extension .tmp) in Windows’s default temporary folder (the standard location is C:\Windows\Temp)
Some programs can be configured to save data at regular intervals while you work
So how do you recover lost data? First, before restarting the program (new temporary files created by the program may overwrite the data you want to recover), open the system’s default temporary folder. Generally speaking, you can see the following contents:
·Folders created by program installation files
·Files created by Windows or upgrade software (.EXE, .CAB, .ZIP, .DLL)
·Files beginning with “~” and having the extension .tmp. If you cannot see the extension, right-click the file, choose Properties, and check the file type. If the file type is TMP file, then it is a temporary file.
Among the third kind of files above, if the file length is not 0, it may contain the information you are looking for. If you have a file viewing tool, such as Jasc QuickView Plus, you can right-click the file and choose the option to view it. If the viewing tool can display the contents of the file, note whether it contains the information you are looking for. Although Uncle Gates no longer integrates QuickView into Windows (because it cannot support many newer file formats), many desktop utilities include a file viewer as part of the package.
If you do not have a file viewer, there are other ways. If what you want to recover is a Word document, you can check the file’s properties. If the properties list Summary, Statistics, Contents, and Custom tabs, then the file was very likely created by Word.
Next you can try opening the file with Word
1.Use Explorer to copy the file
2.Change the extension of the copied file to .doc
3.Run Microsoft Word to open the file
If you have already configured the program to save files while you work, you can check the folder where saved files are stored. For example, Word calls this option AutoRecover files, and the default storage location is:
C:\WINDOWS\Application Data\Microsoft\Word
Word’s automatic backup files have names similar to ~WRA3610.wbk
In addition, some programs such as Microsoft Word and Corel WordPerfect can automatically load the backed-up files.

▲Recovering a mistakenly formatted drive

As can be seen above, in Windows it is relatively easy to recover mistakenly deleted files or locate lost data in the temporary folder. But if a drive has been formatted, then the root directory and FAT that Windows or Windows-based utilities use to locate files no longer exist. During formatting, the root directory and FAT are cleared, and the records that indicate where files are located on the drive are lost along with them. However, as long as you did not perform a full format with a floppy disk (rewriting the entire disk surface), the data can still be recovered. When a format command is executed on a hard drive, although the root directory and FAT are lost, the data itself is still completely stored on the hard drive. Since subdirectories are stored as files in the data area, the subdirectories still exist, and they contain records of all files stored in them. Therefore, if the subdirectory data can be found, it may be possible to recover the data.
Since Explorer and undelete tools use the root directory and FAT to locate files, they cannot be used to recover data in this case. Instead, programs must be used that create files without using directories, file locations, or file sizes.
The earliest such programs were unformat tools, which could rebuild the directory and FAT by searching the data area of a formatted drive for subdirectories (folders). Each directory entry lists the file’s name, size, and starting sector location. The unformat tool can use this information to rebuild and rewrite the file’s sector-chain entries in the FAT.
If there are no file fragments, this method is very effective, because the unformat tool must assume that all files are stored contiguously. Therefore, after this kind of unformat, fragmented files will be lost.
Since recovering contiguous files is easier and more likely to succeed than recovering fragmented files, it is strongly recommended that you defragment the disk at least once a week. The defragmenter built into Windows works acceptably, but it is very slow. Golden Bow’s Vopt is recommended here.
In addition, the unformat program used must correspond to your file system. For example, most functions in Norton Utilities 2002 support both Win98 & Me and 2000/XP, but the DOS-based Norton Unformat still cannot run on disks using the NTFS file system, and can only run on FAT16 and FAT32.

-----to be continued

▲The uses and limitations of Norton images

If you use Norton Utilities or Norton System Works, note that a typical installation will create an image.dat file. This file stores the locations of files and folders and the date and time the image file was created. This is different from the real backup files created on a drive by DriveImage or Norton Ghost.
By default, Norton creates the image file when the system starts up, and by the time you finish your work it is already outdated. Therefore, you need to create a new image file before shutting down the system.

▲Practice! Practice! Practice again!

Since Norton Unformat and the more powerful Norton Disk Editor (disk editor, which will be discussed in later sections) make changes to the disk, do not use them first on a disk containing important data. You can use a floppy disk or an old hard drive, copy data to the old drive, format it, then try different recovery procedures and see what results you get. This will help you find out which options can be trusted and prepare you for handling a real data emergency.

▲The limitations of in-place data recovery

There is one very important problem with programs like Norton Unformat: the data will be recovered to its original drive, so if an error occurs during the recovery process, you may lose the chance to recover the data, because at least part of the data area has already been overwritten.
For this reason, in-place formatted recovery is being replaced by programs that can recover data and transfer it to another drive.
The Ontrack system package, Fix-It, and Hard Disk Mechanic all have this function to some extent, but you may also need more powerful programs. In Part Three, there will be discussion of data recovery tools that can rebuild data and directory structures on other drives.


-----Over

anyhow, nice!!