Under Windows file deletion principle and data recovery, data recovery tool for windows 7,windows 8,windows XP,server 2003/2008,2000 and NT

Under Windows file deletion principle and data recovery. Data Recovery tool for windows 7,windows 8,windows XP etc

Not write the new file to the target partition, easy to understand from the concept, but actually do is not so easy. Because Windows will generate some temporary files in various districts more or less, plus startup automatically scans the partition function, if set incorrectly or operating slightly do not pay attention, may have been written to the new file and you do not know.

If you only use the tools provided by Windows itself, then we can be deleted after you empty the Recycle Bin, the file has been completely cleared. But the fact is not the case, as long as there is a dedicated hardware and software, even though the data has been overwritten, the drive has been re-formatted, boot sector completely damaged, or the disk drive is no longer functioning, we can still recover almost all of the files. Below we take a look at this in the end is how is it! The main content of this paper
1, disk how to save data
2, Windows can not really clear file
3, Covering seven to clear clues
4, the forgotten corners

1. Disk how to save data

To understand how to recover deleted data, the disk must first find out how to save the data. The hard disk drive which has a group of the disc, the data is saved on the disc track (Track), the tracks on the disc concentrically distribution, the read / write heads in the respective areas of the hard disk of the mobile access to the disc surface, so the file can be randomly distributed to the respective positions of the disk, the various parts of the same document is not necessarily to be sequentially stored. The data stored in the disk allocation unit clusters, cluster size is due to a different operating system and logical volume size. If a hard disk cluster size is 4 K 1 K file, then save should occupy 4 K of disk space. Large files may occupy up to thousands, tens of thousands of clusters, dispersed throughout the disk file subsystem is responsible for the organization and management of the various parts of the operating system. Windows support hard disk file system There are three. Is a FAT, called the File Allocation Table (File Allocation Table), it is the oldest of the file system from the DOS era already. Windows 95 introduced a second file system that is FAT 32, Windows NT 4.0 is the introduction of a third type of file system is NTFS. The basic principles of the three file systems are the same, with a similar directory structure to organize files, directory structure contains a pointer to the first cluster of the file pointer, the first cluster of FAT entry contains a pointer to a pointer to the address of the next cluster, according to so forth, until the emergence of the mark until the end of the file.

2. Windows is not really clear file

In Windows, if we use the conventional way to delete a file, the file itself is not really clear. For example, if we delete a file in Windows Explorer, Windows will file to the Recycle Bin, even if we emptied the Recycle Bin (or not to start the Recycle Bin function), the operating system will not really clear the file data. Windows called the delete is actually only the first letter of the file name changed to a special character, then occupied by the file cluster is marked as free state, but the file contains data still on the disk, the next new file save to disk, these clusters may be a new file, overwriting the original data - so, as long as it does not save the new file, delete the file data is actually still complete saved on disk. Therefore, we can bypass the operating system with software tools, and direct manipulation of the disk, recover deleted files. A lot of tools such as software, EasyRecovery is one of the best. If you accidentally delete an important file you want to restore, then do not cover it. Immediately disable your computer, do not further the disk to save any file recovery tool is installed to the hard disk where deleted files are likely because the content of any written to disk overwrite the deleted files released disk cluster. If you have to install the recovery tool, you can install the other hard disk partition, floppy disk, or simply remove the hard disk to another machine up recovery.

3. Covering seven to clear clues

If the data is already covered with the usual recovery tools can not do anything, but that does not mean that we absolutely can not rescue lost data. The reading on the hard disk is overwritten data are usually two ways. When the read / write head to write data to disk, it sends the signal of the magnetization of the data bits to adjust to an appropriate intensity, the stronger but the signal is not possible, should not exceed certain limits, to avoid affecting the adjacent data bit. Since the signal intensity is insufficient to enable the storage medium to reach saturation magnetization state, so the actual recording signal in the media subject to the influence of a signal previously stored in the same location, for example, if the original recorded data bit is 0, is now a 1 covering, then the signal strength of the actually recorded on the disk media certainly not as the strength of the original data bit is 1. Dedicated hardware device is capable of accurately detecting the actual value of the signal strength, and this value is subtracted the standard intensity of the current data bit, and to obtain a copy of the data to be overwritten. In theory, this process the forward recursive seven, so if you want to completely remove a file, you must repeatedly covering the data seven times over, each time with randomly generated data coverage. Second data recovery technique is based on the head each time a read / write data, it is impossible to absolutely accurately positioned at the same point, the position of writing new data will not be exactly overlaid on the original data. The original data will always leave some traces, using a dedicated device can analyze a copy of the original data - called shadow data. Of course, if we repeated execution coverage operation, the traces of the original data, will become increasingly weak.

4. The forgotten corners

Delete and overwrite files also not be able to clear all sensitive data on the hard disk, because the data may be hidden in some unexpected places, stalls occupied by each sector must be thoroughly cleaned - the so-called sector, is the size of 512 characters section of the piece of data, each cluster contains a plurality of sectors. The file is written to the disk, the last part of the file is usually not exactly fill the last sector, then the operating system will randomly extracted some memory data to fill the vacant area. The data obtained from the memory, called RAM Slack (memory scum), it may be the computer starts to create, access, and modify any data. In addition, the sector is not used in the last cluster intact, that is to retain the original data, called Drive Slack (disks dregs). The problem is that many known security delete files tool does not correctly clear memory the dross and disk scum, and these are referred to as the dregs of the places they may contain a lot of sensitive information.

You can find more information at: http://www.diskgetor.com/index.htm

Under Windows file deletion principle and data recovery. Data Recovery tool for windows 7,windows 8,windows XP etc

Data Recovery

Hard Disk Data Recovery

File Recovery

External drive Recovery

Partition Recovery