Recommended To Read:

What data recovery tools to buy if you want to start a data recovery business?

Free video data recovery training on how to recover lost data from different hard drives?

Where to buy head and platter replacement tools at good prices?

Data recover case studies step by step guide

I want to attend professional data recovery training courses

CIH destroys data backwards from partitions. In this case, system data in the former part may be destroyed and lost. If FAT2 is still intact, we may make FAT2 to cover FAT1. Usually we use DiskEdit and WinHex. Regarding to other forms of destruction such as format and so on, we usually make use of tool software to scan the whole disk, seldom manual recovery; because there are even dozens of trillions sectors a partition has several trillions. Depending on the manual analysis is impossible. For some extremely important data file, we can also recover manually.

Recover FAT by DiskEdit
After recovering DBR of FAT, if part of FAT1 is damaged while FAT2 remains intact (It is the most situation when destroyed by CIH), we may use FAT2 to cover FAT1. The specific method is to find the start sector of FAT2 and then start searching the start sector of DATA (if it is FAT16, search FDT). By this way, we can figure out the length of FAT table. According to length and the start sector of FAT2, we may know the start sector of FAT1. Copy FAT2 to the damaged FAT1, we can finally recover the whole partition.

Recover FAT by WinHex
Principle of recovering FAT by WinHex is the same as that by DiskEdit. After recovering DBR, we can make FAT2 to cover FAT1. After finding FAT2, we begin searching the start sector of DATA (if it is FAT16, search FDT). The division is distinct, because the conclusion part of FAT must be 0 regions, otherwise there is not any free space (even so, in ordinary circumstances, there is still a bit of space in FAT after scanning DATA area. So the end of the last sector must be 0 too.). While at the beginning of DATA region or FDT region it mustn’t be 0. No matter there is fixed FDT, the system always begins from second cluster. If there is FDT, it follows closely FAT2, and its file registration must exist; if there is not, then begins from data area where some data must  exist. Thus we may figure out the length of the FAT table, and then the start sector of FAT1 according to the length and the start sector of FAT2. Copy FAT2 to the damaged FAT1 we can finally recover this partition.

Data recovery Salon welcomes your comments and share with us your ideas, suggestions and experience. Data recovery salon is dedicated in sharing the most useful data recovery information with our users and only if you are good at data recovery or related knowledge, please kindly drop us an email and we will publish your article here. We need to make data recovery Salon to be the most professional and free data recovery E-book online.