WO2001027860A2

WO2001027860A2 - Data recovery method, said method stored on computer readable medium, and remote data control method and system

Info

Publication number: WO2001027860A2
Application number: PCT/KR2000/000976
Authority: WO
Inventors: Chae-Hong Lee
Original assignee: Finaldata Inc.
Priority date: 1999-10-12
Filing date: 2000-08-30
Publication date: 2001-04-19
Also published as: JP2001184247A; TW548542B; AU7038900A; WO2001027860A3

Abstract

Disclosed is a method for recovering damaged data from a hard disk having damaged data which comprises the steps of reading the hard disk drive and detecting sector information; analyzing information on the file allocation table (FAT), root directory, and data sectors from the detected sector information, and searching damaged directory information; using a searcher interface and recovering the found directory; displaying sector viewers of the data and directories; checking, through the displayed sector viewer, and determining whether or not the clusters are fragmented; when the clusters are found to be fragmented, manually dragging and dropping an FAT editor, and automatically editing allocation values of the respective clusters so as to recover the data, and storing the recovered FAT information in a storage device; when the clusters are found not to be fragmented and after the recovered FAT information is stored, storing the recovered data in another drive; checking whether the stored data have been recovered normally; when the stored data has been recovered normally, marking the allocated FAT as the cluster used at the time of recovering the data; and when the stored data have been abnormally recovered, manually editing the allocation values of the clusters.

Description

Data Recovery Method, Said Method Stored on Computer Readable Medium, and Remote Data Control Method and System

BACKGROUND OF THE INVENTION

(a) Field of the Invention

The present invention relates to a data recovering method, a recording media that stores the data recovering method, and a remote control data recovering method and system More specifically, the present invention relates to a method for the recovering of data from information in directories which have fragmented data and damaged data on a hard disk, recording media which are readable by the computer which stores the method for recovering the data, and a method and system for recovering the data by remote control

(b) Description of the Related Art In general, a hard disk driver stores data on a magnetic disk and is widely used as a storage device of a computer system because of its high storage capacity Recently, as personal computers have been greatly disseminated, the use of hard disks has also increased

Hard disks can be easily damaged or lose data because of physical or electrical shocks, mistakes by the users, overuse, or violations between programs

With the increasing use of personal computers, nowadays tasks require much more manipulation of computers, and the dependence on computers has increased so that many data files are stored on personal computers, and users now perform their work using the stored data files

However, as the weight of work linked to computers increases, the incurred damage becomes greater when users mistakenly delete stored files, or even entire directories, which store work related files

Also, when a user executes a vaccine program to remove computer viruses in a storage device, such as a floppy disk, that is put into a personal computer, the computer receives some degree of protection from being infected with computer viruses However, recent computer viruses frequently infect the computers via the Internet, and when this occurs, the data stored in the computer, or even the computer system, itself cannot be used because of the computer viruses

Various methods for recovering damaged data back to the original files have been provided, but fragmented data located on a damaged part of a hard disk cannot be recovered into its original form

SUMMARY OF THE INVENTION

It is an object of the present invention to provide a method for recovering fragmented data on a hard disk, and a computer readable recording media for storing the fragmented data recovering method

In one aspect of the present invention, a method for recovering damaged data from a hard disk having damaged data comprises the steps of

(a) reading the hard disk drive and detecting sector information,

(b) analyzing information on a file allocation table (FAT), a root directory, and data sectors from the detected sector information, and searching for damaged directory information,

(c) using a searcher interface and recovering the found directory,

(d) displaying sector viewers of the data and directories,

(e) checking, through the displayed sector viewer, whether clusters are fragmented, (f) when clusters are found to be fragmented in the above step (e), manually dragging and dropping an FAT editor, and automatically editing allocation values of the respective clusters so as to recover the data and storing the recovered FAT information in a storage device,

(g) when clusters are found not to be fragmented in the above step (e) and after the recovered FAT information is stored in step (f), storing the recovered data in another drive, (h) checking whether the stored data have been recovered normally,

(i) when the stored data have been determined to have been normally recovered in the above step (h), marking the allocated FAT to indicate the cluster that was used at the time of recovering the data, and

(j) when the stored data have been determined to have been abnormally recovered in the above step (h), manually editing the allocation values of the clusters

In another aspect of the present invention, in a method for recovering data from a hard disk having damaged data when information on the directory having the damaged data is also damaged, a data recovering method comprises the steps of

(a) detecting sector information from a first drive having the damaged data, (b) reading boot sector values from the first drive,

(c) analyzing disk information according to the detected sector information and the boot sector values,

(d) when the disk information is not file allocation table (FAT) information in the above step (c), determining if the disk information is an NT (Windows NT) file system (NTFS), and recovering the NTFS,

(e) when the disk information is determined to be FAT information in the above step (c), detecting the FAT information and storing the FAT information in a storage device,

(f) detecting a root directory information and storing the root directory information in the storage device,

(g) detecting the damaged directory and the damaged file information from data sectors,

(h) analyzing directory information to be recovered by using the detected directory information in the above step (g), and generating damaged directory information according to the analyzed directory information, and (i) recovering the damaged directory by using the damaged directory information, and recovering the damaged data by using the recovered directory and the file information, and storing the recovered data in a second drive In a further aspect of the present invention, in a data recovering system for recovering the damaged data by coupling to a client which installs a data recovering program to a server which has a damaged hard disk, a remotely controlled data recovering system comprises a network coupling the server and the client, a client connecting to the network, and inputting a Transmission

Control Protocol/Internet Protocol (TCP/IP) address and password of the server to which it will be connected, and reading information for recovering the data through the network by reading the drive through the connected path or using a sector reading function, and recovering the data, and storing the recovered data in a different undamaged drive, and a server, when a connection request is provided from a client through a network, checking a password, and when the passed found to be acceptable, allowing the connection, and when a data request is provided from the client through the allowed path, analyzing the requested data and transmitting response information to the client

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate an embodiment of the invention, and, together with the description, serve to explain the principles of the invention

FIG 1 is a flow chart of a method for recovering fragmented files in a hard disk according to a first preferred embodiment of the present invention, FIG 2 is a display screen of a sector editor according to a first preferred embodiment of the present invention,

FIG 3 is a display screen of a file allocation table (FAT) according to a first preferred embodiment of the present invention,

FIG 4 is a flow chart of a method for recovering data from information on damaged directories having damaged data according to a second preferred embodiment of the present invention, FIG 5 is a flow chart of a method for recovering data in step S240 as shown in FIG 4,

FIG 6 is a flow chart provided for a detailed explanation of a step of recovering directories and data as shown in FIG 5,

FIG 7 is a schematic diagram of a remote control data recovering system according to a third preferred embodiment of the present invention,

FIG 8 is a flow chart provided for explaining an operation of a client for carrying out a remote controlled data recovering method according to a third preferred embodiment of the present invention,

FIG 9 is a flow chart provided for explaining an operation of a server for carrying out a remote controlled data recovering method according to a third preferred embodiment of the present invention,

FIG 10 is a flow chart provided for a detailed explanation of a data recovering method by the client as shown in FIG 8, and

FIG 1 1 is a flow chart for explaining a data recovering method of an FAT file system

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

In the following detailed description, only the preferred embodiment of the invention has been shown and described, simply by way of illustration of the best mode contemplated by the ιnventor(s) of carrying out the invention As will be realized, the invention is capable of modification in various obvious respects, all without departing from the invention Accordingly, the drawings and description are to be regarded as illustrative in nature and not restrictive FIG 1 is a flow chart of a method for recovering fragmented files in a hard disk according to a first preferred embodiment of the present invention As shown in FIG 1 , sector information is read from a damaged hard disk drive in step S1 10 The sector information has partition divisional information In detail, the sector information has information needed to divide one drive into many different partitions Generally, a disk formation of a FAT file system comprises a boot sector, a first FAT, a second FAT, a root directory entry, and files A detailed description on the FAT file system can be obtained from the 'Advanced MS DOS Programming' by Duncan published by Microsoft in 1986 and 1998

For example, the FAT file system as described below comprises a partition table, a boot sector, a FAT, a root directory, and data sector information

Generally, the partition table has information on a start position and size of each drive when a physical hard disk has been divided into one or more logical drives For example, in a case of dividing a 4 gigabyte hard disk into two logical drives each of 2 gigabytes in size, the partition table has information that the first logical drive occupies a position from 0 to 2 gigabytes on the hard disk and the second logical drive occupies from 2 to 4 gigabytes (refer to the below struct PARTITION_TABLE) The boot sector is positioned on a first sector of each partition and has information on the sorts of file systems, the size of the FAT, the number of the total sectors, the position of a start cluster, and the sector numbers (refer to the below struct A_BF_BPB=BIOS parameter block)

The FAT detects the position of a cluster that allocates the files and stores the links of the clusters

The root directory, the highest directory of the files or directories, stores directory structures, first name start sector, file size, sub directory information and drive label When the root directory is damaged, the files can not be found by a normal operating system When using the Norton Utility disk editor program (diskedit exe) on such an FAT file system, hexa-codes and data can be dumped in order to be stored as a file or they can also be printed out

Hereinafter, the structure of the BIOS parameter block (BPB) of the partition table will be described

When dividing a hard disk into one or more logical hard disks, the partition table has information on the allocation of each partition In more detail, the partition table has following contents struct PARTITION_TABLE {

BYTE Part_Bootlnd, //0x80 - active BYTE Part_FιrstHead, //Starting head BYTE Part_FιrstSector, //Starting sector BYTE Part_FιrstTrack, //Starting cylinder BYTE Part_FιleSystem, //What partition type BYTE Part_LastHead, //End head BYTE Part_LastSector, //End sector BYTE Part_LastTrack, //End cylinder DWORD Part_StartSector, //Starting sector counting from 0 DWORD Part NumSectors, //Number of sectors in partition

},

Here, the Part_Bootlnd is '0x80' for a bootable partition, and Part_Bootlnd is '0' for an unbootable partition

Furthermore, the values of Part_FιleSystem have the following meanings

#defιne PART_UNKNOWN 0x00 //Unknown #defιne PART_DOS2_FAT 0x01 //12-bιt FAT #defιne PART_DOS3_FAT 0x04 //16-bιt FAT Partition smaller than

32MB

#defιne PART_EXTENDED 0x05 //Extended MS-DOS Partition #defιne PART DOS4 FAT 0x06 //16-bιt FAT Partition larger than or equal to 32MB

#defιne PART DOS32 OxOB //32-bιt FAT Partition up to 2047GB #defιne PART_DOS32X OxOC //Same as PART_DOS32(0Bh), but uses Logical Block Address Int 13h extension #defιne PART_DOSX13 0x0E //Same as PART_DOS4_FAT(06h), but uses Logical Block Address Int

13h extension #defιne PART_DOSX13X OxOF //Same as PART_EXTENDED(05h), but uses Logical Block Address Int 13h extension #defιne DOS_EXTENDED_PARTITION 0x05 #defιne ^,_^,\ι ^, X_EX^{^}Ξ DΞD_PAR^{^,^}O 0x85 #defιne WIN98_EXTENDED_PARTITION OxOf #defιne LINUX_SWAP_PARTITION 0x82

The partition table is discussed in the above Referring to FIG 1 again, the FAT information is read from the hard disk drive in the previous step S110 and the root directory information is read in steps S115 and S120

The data sectors are analyzed and a search is made for the damaged directory information in step S125, and the searched directory is recovered using a searcher interface in step S130 As shown in FIG 2, the sector viewers of the data and directory are displayed on the screen in step

S135

FIG 2 shows a displayed screen of a sector editor according to a first preferred embodiment of the present invention As shown in FIG 2, the editor screens of the sector viewers of the data and directory can be made when a display mode is switched to the hexa-codes on the general disk editor screen

A user can then check whether or not the clusters are fragmented in step S140 from the data or directory sector viewers in the previous step S135 as shown in FIG 2

The user can check the fragmented data by checking the sectors of the hard disk in the sector editor screen as shown in FIG 2 For example, it is possible to determine if the fragmented data are in a block where a text file exists while the data are displayed as binary or hexa codes and when the data are displayed as text codes When it is determined that the clusters are fragmented in the sector editor screen displayed in the previous step S140, the user manually drags and drops the FAT editor to edit information on the fragmented links in step S145 At this time, the FAT editor automatically and directly edits the allocation values of the respective clusters, and can also edit the physical sectors, logical sectors, or clusters

Also, an option for displaying the data as a specific pattern according to formats so as to store the sectors or clusters of a predetermined area can also be added

FIG 3 shows a display screen that shows the total FATs and the FATs of the file and directory

Referring to FIG 3, when transferring sector editor messages to the user, the clusters can be directly displayed For example, clusters corresponding to files are displayed with different colors, and other clusters corresponding to the displayed files can be allocated, and the remaining ones are manually edited

After storing the files, when they are found to be normal, the values of the files are stored in either FAT1 or FAT2, or in both FAT1 and FAT2

A menu for selecting a next cluster from the present cluster by clicking a mouse can also be added At this time, the next cluster can be selected from the FAT table or the sector editor A new clipboard format is made to implement this function That is, when the user pushes a 'bool selecting next' FAT button, a function is implemented through the clipboard and window message to determine whether the mouse pointer controller will be controlled through global variables The recovered FAT information is stored in memory in step S150 and the recovered data are stored in the hard disk of other drive in step S155 At this time, obviously, the capacity of the hard disk of the other drive must be equal to or greater than the capacity that will be recovered from the damaged hard disk

As noted above, when initially recovering data with a general data recovering method, such as when using DOS or the Norton Utility undelete program, when a user deletes data, a FAT value is allocated and the FAT value is written on the hard disk, and therefore, data can be lost However, in the present invention, the FAT information is handled in memory, and after the data are recovered and checked so as to determine whether the recovered data are normal, the FAT is indicated for allocation Thereby, data are handled in a safer manner than in the prior art, and the data recovery ratio is greatly increased

To maintain the FAT information managed by the memory when the computer is rebooted, a function to store or load the FAT information as a file is added In this case, the FAT information is stored not on the damaged hard disk, but on a hard disk of another safe drive

Generally, when a user misuses a computer or when the data stored on the hard disk drive are damaged because of some fault in the hardware of the computer itself, the information recorded in the data system of the hard disk or registry is also changed Therefore, by comparing this information with the initial state of the data system and registry, the differences found can indicate that part of the hard disk drive in which the differences had occurred is damaged

FIG 4 is a flow chart of a method for recovering data from the information on damaged directories themselves containing damaged data according to a second preferred embodiment of the present invention

As shown in FIG 4, the damaged hard disk drive is read or the sector information is detected from a sector reading function in step S210

Values of the boot sector are detected in step S215 and the disk information is analyzed based on the values of the boot sector in step S220 At this time the boot sector generally contains the data system information for one drive For example, FAT16, FAT32, and NT (Windows NT) file systems (NTFS) have boot sectors with different information As one example, the structure of the BPB of the boot sector used in the FAT32 is as follows typedef struct _A_BF_BPB { //FAT BIOS parameter block

WORD A_BF_BPB_BytesPerSector, //Byte numbers per sector BYTE A_BF_BPB_SectorsPerCluster, //Sector numbers per cluster WORD A_BF_BPB_ReservedSectors, //Reserved sectors BYTE A_BF_BPB_NumberOfFATs, //FAT numbers WORD A_BF_BPB_RootEntrιes, //Maximum root directory list numbers WORD A_BF_BPB_TotalSectors, //Sector size of partitions

BYTE A_BF_BPB_MedιaDescrιptor, //Media descriptor WORD A_BF_BPB_SectorsPerFAT, //Sector numbers per FAT WORD A_BF_BPB_SectorsPerTrack, //Sector numbers per track

WORD A_BF_BPB_Heads, //Numbers of RΛ/V heads of a drive WORD A_BF_BPB_HιddenSectors, //Numbers of hidden sectors of the drive WORD A_BF_BPB_HιddenSectorsHιgh, //High words of the hidden sector values DWORD A_BF_BPB_BιgTotalSectors, //Numbers of total sectors of the FAT32 drive DWORD A_BF_BPB_BιgSectorsPerFAT,//Numbers of sectors per FAT of the FAT32 drive

DWORD A_BF_BPB_BιgSectorsPerFATHι, WORD A_BF_BPB_ExtFlags, WORD A_BF_BPB_FS_Versιon,

DWORD A_BF_BPB_RootDιrStrtClus //Position of the cluster where the root directory of the

FAT32 drive starts WORD A_BF_BPB_RootDιrStrtClusHι, WORD A_BF_BPB_FSInfoSec, //Numbers of sectors of the file system information WORD A_BF_BPB_BkUpBootSec, //Numbers of sectors of a backup boot

WORD A_BF_BPB_Reserved[6], //Reserved fields

} A_BF_BPB, *PA_BF_BPB,

A check is performed in step S225 to determine whether or not the disk information analyzed in the previous step S220 is a FAT file system, and when it is not a FAT file system, it is determined to be a NTFS file system and the data is recovered by the NTFS method in step S230 When it is a FAT file system, the data is recovered by the FAT file system method in step S240

FIG 5 is a flow chart of a method for recovering data in step S240 as shown in FIG 4

Referring to FIG 5, the FAT information of the hard disk is detected and then stored in memory in step S610, and the root directory information is detected and then stored in memory in step S620

In the event that the data sectors do not have directory information and only have data, the data sectors are analyzed according to data types, and damaged directory is detected in step S630

By using the information obtained in the previous steps S610 through S630, the directory information to be recovered is analyzed, and the directory is generated using the analyzed directory information in step S640 The damaged directory is recovered, and the damaged data stored in the recovered directory are recovered in step S650

FIG 6 is a flow chart providing a detailed explanation of the step of recovering the directories and data represented in FIG 5

Referring to FIG 6, the initial size of the data manually found in a setup environment is changed to a random size in step S6510

The data which were found according to extension names of the files are registered on a directory recovering screen in step S6520, and information on the data names and the sizes are analyzed and generated in step S6530

When necessary, the user manually and randomly modifies the data names and their sizes in the list on the directory recovering screen in step S6540

Necessary data are stored in a second drive differing from the first drive in step S6550 At this time, the second drive must have a storage capacity equal to or greater than that of the hard disk of first drive The size of the recovered data initially stored in the previous step

S6550 is compared with that of the damaged data in step S6560, and if the size of the damaged data is greater than that of the recovered data, the process returns to the previous step S6540 so as to reallocate the names and sizes of the data If the size of the damaged data is smaller than that of the recovered data, a program for reading the recovered data is used to read the recovered data in a normal manner

In the above, the present invention recovers the damaged data so that when a user deletes a directory and information on the deleted directory is lost, the data stored in the hard disk can be recovered

FIG 7 is a schematic diagram of a remote control data recovering system according to a third preferred embodiment of the present invention

As shown in FIG 7, the remote control data recoveπng system comprises a client 100 which provides a data recovering program, a client internet service provider (ISP) 200, an internet 300, a server ISP 400, and a server 500 which installs a hard disk having damaged data

When the server 500 receives a connection request from the client

100 via the internet 300 the server 500 checks its password, and when the password is found to be acceptable the server 500 provides permission for connection, and when the server 500 receives a data request from the client

100 via the permitted path the server 500 analyzes the requested data and transmits the corresponding information to the client 100

In detail, when the server 500 receives a password login message from the client 100, the server 500 monitors whether or not a TCP/IP protocol connection request has been provided from the client 100, and when the request is provided, the server 500 checks the password to determine if it is acceptable, and when the password is found to be acceptable, the server 500 checks whether a data request has been provided from the client 100

When the requested data is for disk information, the server 500 reads the disk information from the damaged hard disk and transmits the disk information to the client 100, and when the requested data is for sector information, the server reads the sector information from the damaged hard disk and transmits the sector to the client 100, and when the requested data is for connection termination information, the server 500 disconnects the connected state and terminates the connection to the network

A data recovering method using the remote control data recovering system according to the preferred embodiment of the present invention will now be described

FIG 8 is a flow chart for explaining an operation of a client for recovering a remote control data recovering method according to a third preferred embodiment of the present invention

Referring to FIG 8, the client reads a network drive, such as from the internet, so as to recover the data in step S310, and connects with an TCP/IP protocol and inputs a password so as to access the server address and corresponding server in step S320

This process checks whether the client is connected to the server 500 in step S330, and when the client is connected it checks whether the input password is acceptable in step S340

If the password is not acceptable, the connection to the server is terminated in step S350

When the password is acceptable the drive is read or information or remotely recovering the data on the network from the sector read function is detected, and the damaged data are recovered based on the detected information in step S360

FIG 9 is a flow chart explaining an operation of a server for recovering a remote control data recovering method according to a third preferred embodiment of the present invention

Referring to FIG 9, the server checks whether the password is provided from the client in step S410, and when the password is provided, the server monitors whether a request for connecting with a TCP/IP protocol is provided from the client in step S420

The server checks whether the request for the connection is provided in step S430, and when the request for a connection is not provided, it returns to the previous step S420 However, when a request for the connection is provided, server checks whether the password is acceptable in step S440 If the password is found not to acceptable, the process for recovering the data is terminated in step S450

When server determines that the password is acceptable, it then checks as to whether or not a data request has been provided from the client in step S460 When a data request is provided, the server checks whether the requested data is for disk information in step S470, and if it is found that the requested data is for disk information, the server transmits the disk information to the client in step S475

When the requested data is not for disk information, server checks whether the requested data is for disk sector information in step S480, and if it is found that the requested data is for disk sector information, the server reads the sectors from the disk and transmits the sectors to the client in step

S485

If the server finds that the requested data is not for disk sector information, it then checks whether the requested data is a connection termination request information in step S490 If the requested data is not a connection termination request information, the server returns to the previous step S460 However, when the requested data is a connection termination request information, the connection is terminated and the thread is finished in step S495 FIG 10 is a flow chart providing a detailed explanation of the data recovering method by the client as shown in FIG 8

Referring to FIG 10, the client reads the damaged first drive or remotely detects the sector information from the sector read function via a network, such as the Internet, in step S1610 Values of the boot sector are detected in step S1620, and the disk information is analyzed based on the boot sector values in step S1630

This process then checks whether the disk uses a FAT in step

S1640, and if the disk is not a FAT, it is determined to be an NTFS so that the file data are recovered using the NTFS method in step S1650 When the disk is found to use a FAT, then it is determined to be a FAT file system and the data are recovered in step S1660

FIG 11 is a flow chart for explaining a data recovering method of a FAT file system

Referring to FIG 11 , the client detects FAT information and stores the FAT information in memory in step S1710, and detects the root directory information from the stored FAT information and stores the root directory information in memory in step S1720

The client detects the damaged data from the data sectors in step S1730, and recovers the detected damaged data based on the detected FAT information and the root directory information in step S1740

The client stores the recovered file not in the first drive, which has the damaged files, but in the second drive in step S1750 At this time, the storage capacity of the second drive must be greater than the capacity to be recovered from the damaged hard disk In the above, even when the hard disk has damaged files, the damaged files can be recovered by using a server program that transmits the damaged hard disk information via the internet and using a client program that remotely recovers the server data via the network

In the first preferred embodiment of the present invention, when fragmentations occur in the data stored on a hard disk, FAT information is read into memory and the data are recovered, and after the data are recovered, there is checked as to whether the file is normal Following this check, the FAT is then indicated as allocated, and therefore, the data are safely recovered, and the data recovery ratio is increased

In the second preferred embodiment of the present invention, even when a directory that has damaged data has been deleted from the hard disk which has the damaged data, and even when the deleted directory information is also damaged, the damaged data can be restored to its original state

In the third preferred embodiment of the present invention, damaged data can be remotely recovered by using client and server programs

By connecting the data recovery program to the network, the inconvenience of removing the damaged hard disk from the computer body so as to recover the damaged data can be eliminated

While this invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims

Claims

WHAT IS CLAIMED IS:

1 A method for recovering damaged data from a hard disk having the damaged data, comprising steps of

(a) reading the hard disk drive and detecting sector information, (b) analyzing information on a file allocation table (FAT) root directory, and data sectors from the detected sector information and searching for damaged directory information,

(c) using a searcher interface and recovering a found directory,

(d) displaying sector viewers of data and directories, (e) checking, through a displayed sector viewer, whether clusters are fragmented,

(f) when the clusters are found to be fragmented in step (e), manually dragging and dropping an FAT editor, and automatically editing allocation values of the respective clusters so as to recover the data, and storing the recovered FAT information in a storage device,

(g) when the clusters are found not to be fragmented in step (e) and after the recovered FAT information is stored in step (f), storing the recovered data in another drive,

(h) checking whether stored data have been recovered normally, (i) when the stored data have been recovered normally in step (h), marking an allocated FAT as the cluster used at the time of recovering the data, and

(j) when the stored data have been abnormally recovered in step

(h), manually editing allocation values of the clusters 2 The method of claim 1 , wherein in step (e), blocks which are output on the displayed sector viewer screen after the blocks are converted from binary codes to hexa codes or from hexa codes to binary codes are determined to be fragmented data

3 The method of claim 1 , wherein the FAT information is managed by a storage device

4 The method of claim 1 , wherein the data are recovered and checked as to whether the data are normal and the FAT corresponding to the data is allocated and displayed

5 The method of claim 3, wherein the FAT information managed by the storage device is stored and loaded in another drive differing from the damaged drive

6 In a method for recovering damaged data from a hard disk having the damaged data, a method for recovering damaged data installed on a recording media which is readable by a computer comprising steps of

(a) reading the hard disk drive and detecting sector information, (b) analyzing information on a file allocation table (FAT), root directory, and data sectors from the detected sector information and searching for damaged directory information,

(c) using a searcher interface and recovering a found directory,

(j) when the stored data have been abnormally recovered in step (h), manually editing allocation values of the clusters 7 A data recovery method for recovering data when directory information having damaged data is damaged in a hard disk having the damaged data comprising steps of

(a) detecting sector information from a first drive having the damaged data,

(b) reading boot sector values from the first drive, (c) analyzing disk information according to detected sector information and boot sector values,

(d) when the disk information is not file allocation table (FAT) information in step (c), determining that the disk information is an NT file system (NTFS), and recovering the NTFS, (e) when the disk information is FAT information in step (c), detecting the FAT information and storing the FAT information in a storage device,

(f) detecting root directory information and storing the root directory information in the storage device, (g) detecting damaged directory and damaged file information from data sectors,

(h) analyzing directory information to be recovered by using the detected directory information in step (g), and generating damaged directory information according to analyzed directory information, and (i) recovering the damaged directory by using damaged directory information, and recovering damaged data by using the recovered directory and file information, and storing the recovered data in a second drive

8 The method of claim 7, wherein the step (i) comprises steps of (ι-1 ) changing initial sizes of data to a random sizes in a setup environment,

(ι-2) registering data found by extension names on a directory recovering screen,

(ι-3) analyzing and generating information on names and sizes of data by the program itself, (ι-4) randomly changing names and sizes of data in a list on the directory recovering screen, (ι-5) storing changed names and sizes of the data of the step (1-4), and

(ι-6) checking sizes of stored data of step (1-5), and when the size is small, returning to the step (1-4) 9 In a method for recovering data stored on a computer readable recording media when directory information having damaged data is damaged in a hard disk having the damaged data, a method for recovering damaged data installed on a computer readable recording media comprising the steps of (a) detecting sector information from a first drive having the damaged data,

(b) reading boot sector values from the first drive,

(c) analyzing disk information according to detected sector information and boot sector values, (d) when the disk information is not file allocation table (FAT) information in step (c), determining that the disk information is an NT file system (NTFS), and recovering the NTFS,

(e) when the disk information is FAT information in step (c), detecting the FAT information and storing the FAT information in a storage device,

(f) detecting root directory information and storing the root directory information in the storage device,

(g) detecting damaged directory and damaged file information from data sectors, (h) analyzing directory information to be recovered by using the detected directory information in step (g), and generating damaged directory information according to analyzed directory information, and

(i) recovering the damaged directory by using the damaged directory information, and recovering damaged data by using recovered directory and file information, and storing the recovered data in a second drive

10 The method of claim 9, wherein the step (i) comprises steps of (ι-1 ) changing initial sizes of the data to a random sizes in a setup environment,

(ι-2) registering data found by extension names on a directory recovering screen, (ι-3) analyzing and generating information on names and sizes of the data by the program itself,

(ι-4) randomly changing names and sizes of data in a list on the directory recovering screen,

(ι-5) storing the changed names and sizes of the data of the step (I- 4), and

(ι-6) checking the sizes of stored data of the step (1-5), and when the size is small, returning to the step (1-4)

11 In a method for recovering data through a server that includes a hard disk including damaged data, a network, a client coupled to the server via the network, a remotely controlled data recovery method comprising steps of

(a) coupling the server and the client via a TCP/IP protocol through a network,

(b) when a data request is provided to the server from the client via a coupled network, the server detecting the corresponding data information from a first drive of the client and transmitting the data information to the client, and

(c) the client receiving the detected data information from the server and storing data information in a storage device, and recovering damaged data by using stored information, and storing recovered data in a second drive different from the damaged drive

12 The method of claim 11 , wherein step (b) comprises steps of (b-1 ) checking an acceptability of a password provided through the coupled network, and when the password is determined to be not acceptable, terminating access to the client,

(b-2) when the password is determined to be acceptable, checking whether a data request is provided from the client, and when no data request is provided from the client, waiting until the data request is generated, and when the data request is provided from the client, checking whether a disk information request is provided from the client, (b-3) when a disk information request is provided from the client, transmitting disk information to the client, and when no disk information request is provided from the client, checking whether a disk sector data request is provided from the client, and

(b-4) when a disk sector data request is provided from the client, reading sectors from the disk and transmitting the sectors to the client, and when no disk sector data request is provided from the client, checking whether a connection termination request is provided, and when a connection termination request is provided, terminating the connection, and when no connection termination request is provided, returning to step (b-2) 13 The method of claim 1 1 , wherein step (c) comprises steps of

(c-1 ) reading sector information of the damaged first drive from the server, and storing sector information in a storage device,

(c-2) detecting boot sector values from the sector information,

(c-3) analyzing disk information from the sector information, and checking whether the disk information is a file allocation table (FAT),

(c-4) when the disk information is a FAT in step (c-3), determining that the damaged hard disk is a FAT file system, and recovering the FAT file system, and

(c-5) when the disk information is not a FAT in step (c-3), determining that the damaged hard disk is an NT (Windows NT) file system (NTFS), and recovering the NTFS file system

14 The method of claim 13, wherein sector information comprises information on a partition table, boot sector, FAT, root directory, and data

15 The method of claim 13, wherein step (c-4) comprises steps of (c-4a) storing FAT information of the damaged hard disk in the storage device, (c-4b) detecting the root directory information from FAT information and storing root directory information in the storage device,

(c-4c) recovering the damaged data, based on root directory information, and (c-4d) storing recovered data in the second drive

16 In a data recovering system for recovering damaged data by coupling a client which installs a data recovering program to a server which has a damaged hard disk, a remotely controlled data recovery system comprising a network coupling a server and a client, a client connecting to the network, and inputting a TCP/IP address and password of a server to be connected to the server, and reading information for recovering data through the network by reading the drive through the connected path or using a sector reading function, and recovering the data, and storing recovered data in a different undamaged drive, and a server, when a connection request is provided from the client through the network, checking a password, and when the pass word is found to be acceptable, allowing the connection, and when a data request is provided from the client through the allowed path, analyzing requested data and transmitting response information to the client

17 The system of claim 16, wherein when a password log-in is provided from the client, the server monitors whether a TCP/IP protocol connection request is provided from the client, and when a connection request is provided, the server checks an acceptability of the password, and when the password is found to be acceptable, the server checks whether a data request is provided from the client, and when the requested data is for disk information, the server reads disk information from the damaged hard disk and transmits the disk information to the client, and when the requested data is for sector information, the server reads the sector information from the damaged hard disk and transmits the sector information to the client, and when the requested data is connection termination information, the server terminates a connection to the network. 18. The system of claim 17, wherein sector information comprises information on a partition table, boot sector, FAT, root directory, and data.