Shulou(Shulou.com)06/02 Report--

NTFS file system is a widely used file system format in the market at present. It provides data protection and recovery functions, has stronger security, and basically replaces the old FAT file system. Because the security of the NTFS file system is more like, many companies use this file system on their servers. Friends who know about the NTFS file system know that reformatting under the file system theoretically will not have much impact on the data, but it is also possible to lose some file directory structure. The following editor will introduce to you how to reverse the server data recovery when the partitions in the array are formatted due to misoperation of the server devices under the NTFS file system.

The first step is to back up data

In the process of data backup, we need to use a software called winhex, which many friends have used, and other data recovery software with the same function can also be used. When backing up, connect the failed server to a normal server for backup, set all the hard drives of the failed server offline, and then use Winhex for disk backup.

Step 2, analyze the partition size

Look at the 0-2 sectors of the backed-up data to get the partition size of the server, and then divide the number of sectors by the actual number of hard disks except the check disk in the server according to the calculation mode of RAID5 to get a sector number. So we jump directly to the sector of the backup file on disk, and we can find another GPT partition table near this sector, so we can check the size of the partition. For example, for a 6-disk raid5 array, if the partition size is 1048309759 sectors, the calculation should be divided by 5 equals 209661951 sectors. The working interface is shown in the following figure (the underlying performance of the GPT partition table entry, the first 8 bytes of the tag entry is the partition start sector, and the next 8 bytes is the partition end sector, in 512 bytes / sector, 64bit):

The third step is to reorganize the raid array

Because raid5 has a higher security level and data storage is relatively more secure than other arrays, most companies configure their servers with raid5 disk arrays. Under raid5 arrays, as long as the number of raid member disks and the direction of raid are analyzed, they can be reorganized.

Since we are talking about data recovery under the NTFS file system, we only need to find the file record entries for the partition and view the stripe size and raid direction of the raid5 according to the MFT order in the NTFS file system. The following is a screenshot of a similar case.

According to the analyzed RAID structure to reorganize RAID, if you are lucky, you can retain the directory structure, but if you are unlucky, you may encounter the loss of file directory structure. However, data recovery is the best result. File directory loss is shown in the following figure:

The format of the NTFS partition does not have a great impact on the data, the data retention is generally more complete, the recovery probability is greater, but part of the file directory structure may be lost. However, we should remind the majority of users not to rely too much on the server data recovery technology. Although the lost server data can be recovered with the help of data recovery technology, it also increases certain risks and losses of manpower and material resources. Backup should be strengthened when using the server and storing data, so as to avoid the loss of server data as much as possible.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.