Data damaged by virus recovery case

Case:
The customer’s hard disk cannot be recognized, and the MHDD scanned by itself, and the hard disk is normal.

Solution:
From the perspective of the phenomenon, it should be a firmware problem. Using 3000 to normalize the disk format, find that the hard disk has n partitions. Seeing that the size and capacity are wrong, it feels like a logical lock.Read only in 3000, and find that the system is crashing as soon as the disk is identified.Add XLY and then save the MBR partition in the sector to save 0, and then re -calculate the partition table.It should be OK at this step, but open in Winhex and see that all the directory areas are not normal (FAT32), all garbled, and after examination, it is found that it is caused by the virus.Calculate, crack, and repair the directory area where the virus destruction (the virus displays all the directory of the directory, and the normal directory is moved to the virus folder and set it to the system file after encryption).The data can be browsed normally. As a result, the machine was very sad after restarting the machine. The disk was hung directly on its own machine. The autorun inside was on the attack, and my machine was also recruited.