Fat System Recovery
Hard Disks store data using their own format .There are many different systems how data are arranged on the hard disk. Every operating system has its own, exp: Linyx, UNIX, Windows, OS, etc... In this issue we shall take a closer look at the Windows Fat systems and their data recovery
Windows File Systems (FAT-File Allocation Table)
FAT Systems
When MS-DOS was first being developed by Bill Gates, FAT system was very suitable for that operating system. It took up very little space for itself and was a jewel at that time. The file system was also not extensible, because at that time there was no concept of changing or extending the data that the file systems supported.
FAT12
The oldest version of FAT is FAT12, which stores a maximum of 4077 files and supports up to a 32MB disk. FAT12 is still in use as the preferred format for floppy disks
FAT16
FAT16 is nearly identical to FAT12 except for its use of 16 bits in its addressing scheme. But this minor architectural change allows FAT16 to address hard drives up to 2GB and store up to 65517 files.
FAT32
Hard drives were growing with the time passing and in 1996 and new file system was created called FAT32. FAT 16 had an up to 2GB address limit and FAT32 allows that data can be managed at hard drives of up to 2TB and store more than 200 million files. FAT32 is still in widespread use because it can manage current disk needs.
NTFS
When Microsoft was developing Windows NT, they recognized that FAT was not capable of much future growth, so they developed the NTFS which was an enormous step forward. It had a number of integrated features, including: Security descriptors, Metadata support, Support for volume sizes up to 16 exabytes, etc...
Formatting Hard Disks
Low level formatting
Formatting is the first step in making the drive ready for data storage and retrieval. The low-level formatting stays unchanged for the entire life of the drive unless the drive is re-formatted.
High-level formatting
High-level formatting prepares the drive partitions for the operating system by creating a root directory, from which all other subdirectories can be created, and creating a File Allocation Table (FAT), which keeps track of all information on the disks and all the relationships between different pieces of information.
Partitioning
Partitioning divides the drive into logical drives (C; D; E; etc…). Every drive has at least one "primary partition" (C :) and may have many extended partitions. The primary partition contains drive booting information in the Master Boot Record (MBR) and also keeps a record of all other partitions.
The Master Boot Record (MBR)
The Master Boot Record is created when you create the first partition on the hard disk. It is the first sector on every disk and it is the most important data structure on the disk.The Master Boot Record contains the Partition Table for the disk.
Partition Table
The information about primary partitions and an extended partition is contained in the Partition Table, located in the same sector as the Master Boot Record.The Partition Table conforms to a standard layout that is independent of the operating system.
Logical Drives and Extended Partitions
When more than four logical disks are required on a single physical disk, the first partition should be a primary partition. The second partition can be created as an extended partition, which can contain all the remaining unpartitioned space on the disk.
The Fat Recovery
There are many Programs which are made for FAT recovery for the Windows operating Systems. They have different approaches in “HOW TO” recover data from a hard disk, but they always try doing the same thing: recover your FAT files. All of them must follow the basics in the FAT System to recover all Files from the hard disk.
1. MBR Recovery
MBR recovery is simple because it concisists of system data. Although they can be created by different softwares and the codes might be different, the method is the same even with multilateral boot systems. You can backup the recovered data after the system boot turns to be normal, and then restore the multi system boot.
Recover MBR by fdisk
The simplest way to recover a MBR is Fdisk, whose command is simple too; you can use “Fdisk/MBR”. Please note that, the hard disk to be operated should be connected to a master IDE interface as the master hard disk. As to other connection ways, we need appoint the interface location of IDE device in form of “Fdisk/CMBR”.
Uses Fixmbr to restore MBR
Fixmbr is a MBR recovery tool (Provided by Microsoft) which determines hard disk partition and re-construct MBR through overall search.
2. Recovery of Partition
The partition recovery is generally the second step of the whole process. When the partition table is corrupted, we need rebuild the partition table, which is usually filled manually; in some special cases it can be done automatically by some working software.
If the partition table is corrupted, there are many tools to rebuild it automatically, only if the problem is not too serious. If it is too serious, or the partition table structure is too complex, it may possibly be out of the reach of their ability to rebuild. In this case, we need do it manually. Usually we use some tool software to recover the lost partition table, such as Norton Utilities 8.0, Disk Man, and Partition Magic etc.
DBR recovery
MBR covers the whole hard disk, while the DBR covers individual partition.
The first sector of each MBR is the DBR. Just as the MBR, the DBR contains some information needed by the boot operation system. If the DBR is corrupted, you can neither visit the partition nor start up the operation system of the partition.
The functions of the DBR are not all the same as that of the FAT partition. The DBR locates the FDT and FAT for the FAT partition, but does not not verify the correctness and reasonableness of the FDT and FAT. For partition of NTFS, we need more units to load the file system, which is more complex than FAT.
What if the DBR is destroyed? Usually, there arethe following methods:
Recover DBR by Format
If there is no important data in this partition, or you have backed up the data, the best way to recover the DBR is direct high-level format, fast format or complete format. If there is no limitation of partition form and capacity, there would be no difference between DOS format and Windows format except speed. Format is quite thorough, it can completely rearrange the data storage, even “reset” former file fragmentation.
Recover FAT by DiskEdit
After recovering DBR of the FAT, if part of the FAT1 is damaged while FAT2 remains intact (usually when destroyed by CIH), we may use FAT2 to cover FAT1. The specific method is to find the start sector of FAT2 and then start searching the start sector of DATA (if it is FAT16, search FDT). By this way, we can figure out the length of FAT table. According to length and the start sector of FAT2, we may know the start sector of FAT1. Copy FAT2 to the damaged FAT1, we can finally recover the whole partition.