China DOS Union

Surviving the Aftermath — A Data Recovery Story (A Newbie's Talk)

This is something about data recovery, a record of one stupid operation of mine and the remedial measures I took afterward. I want to thank all the experts on the Linux board and NT board who gave me advice on this, and I hope it may help others who have had a similar experience to mine.
I'm just a beginner, please give me your comments!

Machine specs
CPU TB 1G
HardDisk IBM40G
OS Chinese Win2K
The hard disk was divided into three partitions: drive C was NTFS format for the system; drives D and E were both FAT32, used for applications and data respectively.

When the disaster happened
I had wanted to install XP on the machine. After messing around for quite a while, I still failed. I was about to give up and reinstall Win2k on drive C, so I used PQMagic7 to format drive C as NTFS. In the PQMagic interface I selected NTFS, typed OK, pressed Enter, and it was done in 10 seconds. I exited PQMagic and rebooted... then suddenly I broke out in a cold sweat... was that really drive C I formatted... After the machine started, I found that drive E, my data drive, was gone.
I fainted on the spot......

Recovery process
After the cold sweat stopped and I regained feeling in my hands and feet, I started analyzing the situation and estimating the loss: because of an accidental operation, I had formatted my data drive, originally FAT32, into NTFS, and all the data on that drive was lost! The materials on it were extremely important and had to be recovered, at least partially.
So I asked for help on Shuimu's Linux board and NT board, and at the same time searched online for information about data recovery. Putting together information from all sides, in this situation the data could definitely be recovered, but how much was uncertain. There were 2 methods:
One was to go to a specialized company for data recovery. After asking around, the price for recovering a 40G hard disk ranged from 5000RMB to 500RMB;
The other was to do it myself.
Because my wallet was thin, I had no choice but to try it myself first. Since I knew very little about how data is stored on disks, I couldn't use Debug or Diskedit, so I had to look for ready-made recovery software. I downloaded Diskman, Norton Utilities, RecoveryNT, and FinalData in succession. Of these, the latter two could recover data without modifying the target disk, so I tried them. I removed the hard disk and connected it to another machine, then began the recovery. After RecoveryNT worked for 10 hours, it found some files, but strangely most of them were system files and image files (there shouldn't have been that many), and there were no Doc or Xsl files at all (there should have been many).
Moreover, the files it found could not be used. So I had to give up. Then I tried FinalData. At first it directly scanned the data area of the logical drive. After a long 9 hours, it found countless files, but there were no directories, and most of the recovered files were image files, plus a small number of office documents and some compressed files. But many important office documents still were not recovered.
Though happy, I was still unwilling to accept it. I carefully read FinalData's help document and changed it to directly scan the boot area of the physical disk, hoping to find the backup FAT table and directory area—and it actually worked! All directories and files were completely restored exactly as they had originally been, and in addition there were many files and directories that had been deleted or moved before!!!

Lessons learned
1. Back up data regularly. It may be an old cliché, but it is absolutely necessary! You have to know that natural disasters and human blunders... are hard to avoid... sigh....
2. The system, programs, and data should be stored in different partitions, to make later recovery easier (fortunately I had done this).
3. Different partitions should be given different, eye-catching, English volume labels, so that they can still be clearly identified in some partition software that does not support Chinese! (Unfortunately, some of my partitions had no labels, and some had Chinese ones.)
4. Don't mess around for no reason (practice excepted, but you must back up your data first!), especially operations like partitioning, formatting, installing different or unfamiliar systems, etc. These must be handled with extreme caution.
5. When disaster strikes and you immediately faint over.... stop operating at once and shut down the machine. The purpose is to protect the crime scene and avoid doing more write operations on the damaged disk, so as not to make a bad situation worse.
6. Plan before you act, and only act when you are confident. Either doing it yourself or finding a professional company is fine.
7. Reassuringly, most hard disk data can be recovered, at least some of the files in it. Generally speaking, various operations (deletion, partitioning, formatting, format conversion) only read and write the boot area, FAT area, and dir area, while leaving the data area unchanged. That leaves an opportunity for later data recovery. Of course, if the FAT area and Dir area are completely damaged and there is no backup, then recovering the data is extremely difficult,
or even impossible.

About FinalData
A very good data recovery software tool, seriously recommended to everyone!!! The following English sentences are quoted from FinalData's help file:
“FinalData can recover files/folders that have been lost due to virus
infection, drive formatting, and even files whose directory information have
been partially overwritten. As long as file data remains in its data sector
FinalData will recover all
lost files.”

At present there are 9x, NT, and Linux editions (I only found the 9x and NT editions online), and its website has a Demo edition available for download.

About PQMagic
A very good partitioning software tool. I believe many people who install both Linux and Windows have used it. It seems that when it formats and converts file systems, it keeps backups of the Fat and dir areas (what a great feature—otherwise I would have been done for this time).

What should I do if encrypted files in Win2k can't be opened???

Recovering Data
Recovering employee encrypted data after the employee leaves, or recovering data when a user loses the private key, is very important. Data recovery can be used through the Encrypting File System (EFS), which is part of the system-wide security policy. For example, if a file encryption certificate and its related private key are permanently lost due to disk failure, arson, or any other reason, a person designated as a recovery agent can recover the data. In a business environment, after an employee leaves the company, the company can recover the employee's encrypted data.
Recovery Policy
EFS provides built-in data recovery through a recovery policy. A “recovery policy” is a public key policy that can be used for one or more user accounts designated as recovery agents.
Recovery policy is configured locally for individual computers. For computers on a network, recovery policy can be configured at the domain, organizational unit, or individual computer level, and applied to all Windows XP-based computers to which the policy can be applied. A certification authority (CA) issues recovery certificates, and you can manage the certificates using the Certificates snap-in.
In a domain, when the first domain controller is set up, Windows XP implements the domain's default recovery policy. The domain administrator is issued a self-signed certificate, which designates the domain administrator as the recovery agent. To change the domain's default recovery policy, log on to the first domain controller as an administrator. Additional recovery agents can be added to this policy, and the original recovery agent can be removed at any time.
Because the Windows XP security subsystem handles the implementation, replication, and caching of recovery policy, users can encrypt files on systems that are temporarily offline (such as portable computers). (This process is similar to logging on to a domain account using cached credentials.) For more information, see changing the local computer's recovery policy and changing the domain's recovery policy.

Recovery Agent
A recovery agent is a person authorized to decrypt data encrypted by other users. A recovery agent does not need any other functional permissions for this role. For example, a recovery agent is very useful when an employee leaves the company and the data left behind needs to be decrypted. Before adding domain recovery agents, you must ensure that each recovery agent is issued an X.509v3 certificate.
No matter where the recovery policy is applied, each recovery agent has a special certificate and related private key that allow data recovery. If you are a recovery agent, be sure to use the “Export” command in certificate management in the Microsoft Management Console (MMC) to back up the recovery certificate and related private key to a safe location. After the backup is completed, you should use Certificates in MMC to delete the recovery certificate. Then, when you need to perform a recovery operation for a user, you should first use the “Import” command in Certificates to restore the recovery certificate and related private key. After recovering the data, the recovery certificate should be deleted again. There is no need to repeat the export process.
To add recovery agents to a domain, add their certificates to the existing recovery policy. For steps on how to add recovery agents to a domain, see adding domain recovery agents.
Information about added and removed recovery agents cannot be automatically updated on existing EFS files. The information in those files is updated the next time the file is accessed. New files always use the current recovery agent information.