Case Studies

(a)Deleted Partition

Partition refers to logical division of hard disk and mass storage space into independent parts. Partitioning hard disk drive is useful for installing more than one operating system on computer system. For example – User can reserve one partition for LINUX and other for Windows.

In Microsoft DOS (Disk Operating System) each partition of partitioned disk behaves as separate disk drive. Partitioning computer system hard disk drive can improve disk efficiency because the NTFS (New Technology File System) system used by Windows operating systems automatically assigns cluster size based on the disk size (larger the disk, larger the cluster).

The recognition of partition by system entirely depends on the partition table and boot sector of partition. If partition table or boot sector of partition is destroyed by virus or deleted accidentally, user will not see the partition.

The data recovery software provides partition recovery from NTFS and NTFS5 file systems. Files can be easily recovered from deleted partition, lost partition, missing partition.

(b)Virus Attack

A virus is a program that reproduces its own code by attaching itself to other executable files either COM or EXE in such a way that the virus code is executed when the attacked executable file is executed.

Viruses attack on files in following ways:

• Delete files and folders
• Corrupt MBR file system
• Delete partition

More recently, scripts written for Internet Web sites and/or included in E-mail can also be executed and infected.

Viruses can attach the files by adding to the end of a file, inserting to middle of file or places the pointer to distinct location on the disk where virus is found.

The working behavior of all viruses is quite similar; first they infect the file and then attack the data. Some of malicious codes are also available in Trojan Horses, worms, and logic bombs that destruct the data.

Viruses that can infect a number of different portions of OS and file system of computer include:

• File Viruses infect or attack the program (COM and EXE) files.
• Companion Viruses adds files that run first to computer’s disk.
• Batch File Viruses use text batch files to infect.
• Source Code Viruses is special type of virus that adds code to actual program source code.

Viruses’ category on the basis of how they infect are as follows:

• Polymorphic Viruses are those viruses that change their characteristics as they infect.
• Stealth Viruses try to actively hide themselves from anti-virus or system software.
• Fast and Slow Infectors viruses infect in a particular way and try to avoid specific anti-virus software.
• Sparse Infectors viruses don't infect very often.
• Armored Viruses are programmed to make disassembly difficult.
• Multipartite Viruses may fall into more than one of the top classes.

The media recovery software recovers and restores all files deleted, removed, erased and lost due to virus attack with ease.

(c)OS Installation Error

Operating system encounters an error message during installation like:

• "Failed to set data for ' '"(that will be an actual blank space) in Windows Vista
• Error loading OS
• Not enough memory available
• Not enough free disk space available

Some common error messages may be displayed on Computer startup are:

• NTLDR missing: NTLDR allows the user to choose which operating system to boot from at the menu for NT and NT-based operating systems.
• Invalid Drive specification: If user gets this DOS message on a valid drive such as C: it means that hard disk has become corrupted.
• Boot Disk Failure: This issue could be caused if Boot options are not set properly in CMOS, Non bootable CD or CD-R in computer and All boot devices set are not bootable.
• Operating System missing: The different causes of the Missing Operating System error message may be missing or corrupted command.com or other boot files, Computer Virus, Boot Record is corrupted and hard drive has failed or has been erased.
• Invalid system disk: Error message generated by invalid data, programming flaw or an input error. For example, if a computer has a floppy disk in the computer that is not bootable, when booting the computer show the error message “Invalid system disk”.

NTFS Data recovery software recovers all the lost and deleted data from hard disk drive with ease.

(d)Logical bad sector HDD

The computer’s hard disk drive bad sector can not be used due to permanent damage. Logical bad sectors can be detected by disk utility software such as CHKDSK or SCANDISK on Microsoft systems or using bad blocks in UNIX OS. Once the sector has been marked unusable it can not used by OS at later stage.

Logical bad sector hard disk drives can not be used in future and data also gets damaged and corrupted. NTFS Data Recovery Software provides solution to recover and retrieve data back from logically bad sector affected storage media with ease.