Manual: You do not need to read the entire manual to use the program to recover your data. Read Chapter 1 (one page) to determine which function(s) of the program you need to use.
Chapter 1 What can RecoverSoft Media Tools Professional do for you? 3 1.1 Trial Version Capabilities 1.2 Registered Version Capabilities
Chapter 2 Registration and Support 4 2.1 Registration 2.2 Software Support 2.3 Program Developer
Chapter 3 Set-up Procedures 7 3.1 Items Needed to RecoverSoft Run Media Tools Professional 3.2 Desktop Set-up 3.3 Laptop Set-up 3.4 Drivers and Converters (SCSI, Iomega ZIP/J AZ, USB, SATA)
Chapter 4 Running RecoverSoft Media Tools Professional 10 4.1 Launch the Program 4.2 Select Drive 4.3 Select Operation: Cycle-Clone (including Reverse-Clone) / Cycle Image (Ch. 5) File Recovery Tree (Ch. 6) Boot Partition Repair (Ch. 7) Media Editor (Ch. 8) Secure Wipe (Ch.9)
Chapter 5 Cycle-Clone / Cycle-Image 14 5.1 Cycle-Clone Clone Drive to Drive 5.2 Reverse-Clone (mechanically failing drives) 5.3 Cycle Image Create Image File o Directions to format a Destination Drive FAT32 5.4 Span, Split or Compress Image File 5.5 Restore Image File 5.6 Restore a Portion of the Image File
Chapter 6 File Recovery Tree 27 6.1 (File) System Components Search 6.2 Select File System to Rebuild 6.3 Recover Files and Directories to a FAT32 destination drive o Directions to format a Destination Drive FAT32 6.4 Restore Files and Directories Using WinZip or PKZIP 6.5 Use the Menus to look for and filter specific files 6.6 Mount the File System into Media Editor <View>, <Look For>and <Edit>raw data Chapter 7 Boot Partition Repair 38 7.1 (File) System Components Search 7.2 Select Valid File System to Rebuild 7.3 Create a Backup File 7.4 Access Repaired File Systems 7.5 How to Make the Drive Bootable
Chapter 8 Media Editor 43
Try Before You Buy Capabilities 8.1 Select Working Area (Mounted or Unmounted File System) A. Unmounted File System B. Mounted File System 1. (How to) Mount the File System 2. Recover Files and Directories Automatically
Registered Version Capabilities 8.2 View (the Sector) As 8.3 Look For (within a Sector) 8.4 Save Sectors / Restore Sectors of data to/from a file 8.5 Fill Current Sector
Chapter 9 Secure Wipe 60 9.1 Wipe the Drive 9.2 Department of Defense, Secure Wipe
Chapter 10 Save/Load Found Components 63 10.1 Save Found Components to a Bin File 10.2 Load Found Components from the Bin File
Chapter 11 FAQ (frequently asked questions) 70 11.1 Does RecoverSoft Media Tools Professional recover from viruses? 11.2 Does RecoverSoft Media Tools Professional recognize USB? 11.3 Can RecoverSoft Media Tools Professional recover from RAID? 11.4 Does RecoverSoft Media Tools Professional recover SATA drives?
Chapter 12 Problem Solving 71 12.1 Problem Launching the Progra 12.2 Program Freezes While Using it 12.3 No Valid File System Found 12.4 File System not Displayed (in Select File System screen) 12.5 File cannot be Located 12.6 Cannot Locate the Root Directory
Chapter 13 Advanced Data Recovery and Computer Forensic Procedures 74 13.1 Advanced User Set-up Window - <Ctrl S> 13.2 RAID Recovery 13.3 Compression on the Fly 13.4 MD5 Hash Mark 13.5 File System Types
License Agreement 79
Software Warranty, Guarantee and Discount Coupon 81 Chapter 1 What can RecoverSoft Media Tools Professional do for you? 2
The following explanation will give you an overview of RecoverSoft Media Tools Professional and which functions you can run in the Trial Version and the Registered Version.
1.1 Trial Version Capabilities
The Trial Version of RecoverSoft Media Tools Professional allows you to perform the following functions on any DOS and Windows drives to view which files and folders can be recovered, before having to purchase the program:
If you are not sure whether to use File Recovery Tree or Boot Partition Repair, use File Recovery Tree.
File Recovery Tree (Chapter 6) rebuilds any FAT or NTFS (DOS and Windows) file system automatically from hard drives (IDE, SCSI, and SATA) and removable media (USB Devices), including accidental format and deletion, corrupt or missing file systems, viruses and worms, files located in slack space from previous formats, and even digital pictures, allowing you to view which files and folders can be recovered.
Boot Partition Repair (Chapter 7) - rebuilds any FAT or NTFS (DOS and Windows) boot sector and partition table automatically from hard drives (IDE, SCSI, and SATA) and removable media (USB Devices), allowing you to view which files and folders can be repaired.
Media Editor (Chapter 8) mounts and rebuilds any FAT or NTFS (DOS and Windows) file system through easy to follow screenshots and directions, allowing you to view which files and folders can be recovered. (Note: This option is used if File Recovery Tree does not produce the results you expect).
1.2 Registered Version Capabilities
The Registered Version, a purchased copy of RecoverSoft Media Tools Professional, gives you all of the trial versions capabilities. Plus, it lets you perform the following operations on any media type or operating system:
Cycle-Clone (including Reverse-Clone) /Cycle-Image (Chapter 5) - extracts raw data from mechanically failing drives on any media or operating system, keeping drives out of the clean room. It also creates an exact sector copy to another media or network for back up protection.
Media Editor (Chapter 8) - In addition to its Try Before You Buy capabilities, the Media Editor also lets you View, Look for, Edit, and Report anything within the file system on any media or operating system much easier than other editors through custom designed editing templates.
Secure Wipe (Chapter 9) quickly and permanently overwrites every bit on every sector on any media or operating system to the level the U.S. Department of Defense requires and authenticates it with MD5. The MD5 Hash Mark can be used throughout program for computer forensic cases.
The Registered Version, a purchased copy of RecoverSoft Media Tools Professional, allows you to recover files and folders to another destination to a local network, hard drives, and USB Devices. 3 Chapter 2 Registration and Support
2.1 Registration / p. 5 A. Program Registration / p.5 B. Failing Copies / Lost Copies / p.5 2.2 Software Support / p.6
2.1 Registration 4
2.1.A. Program Registration
1. Purchase the program. If you forget where you downloaded the program, press the <Software Support>button, once the program launches, for purchasing information.
2. A Program Key will be issued to you as soon as your order is verified.
3. Insert the RecoverSoft Media Tools Professional CD and turn on your computer. It is self-booting and automatically launches the program.
4. Upon entering the program, you are prompted to register the program. Press <Alt Y> or <Enter>.
5. Once the Registration Window appears, type in the Program Key sent to the email submitted during the purchasing process.
6. Enter the Program Key in the Registration Window, and press <Enter>to register the program.
2.1.B. Failing Copies / Lost Copies
Download the appropriate version at http://www.prosofteng.com.
3.1 Items needed to Run RecoverSoft Media Tools Professional / p.8 3.2 Desktop Set-up / p.8 3.3 Laptop Set-up / p.8 3.4 Drivers and Converters / p.9 A. SCSI / p.9 B. Iomega ZIP/J AZ / p.9 C. SATA / p.9
7 3.1 Items Needed to Run RecoverSoft Media Tools Professional
Personal Computer (PC) RecoverSoft Media Tools Professional CD. Destination media, if using File Recovery Tree. PKZIP 4.0 or greater (http://www.pkware.com/products/free_eval.html) or WinZip 9.0 or greater (http://www.winzip.com) to extract your recovered files and folders. Destination media, if using Cycle-Clone / Reverse-Clone (hard drive of equal size or larger); if using Cycle-Image (local network, hard drive, or removable media).
Work on your original problem media, or on a sector-by-sector clone/image of the original problem media (see Chapter 5, Cycle-Clone /Cycle-Image). Almost all software that clones/images does it file-by-file (not sector-by-sector), which means it cannot clone/image deleted files, files which have been overwritten, etc. In other words, you will not be able to recover your data from a drive that has been cloned/imaged with a file- by-file clone/ image software. Use our sector-by-sector clone (See Chapter 5, Cycle-Clone/Cycle-Image).
3.2 Desktop Set-up
Unhook any peripherals not used during the recovery process (Other hard drives attached to the system, CD-ROM drive, burner, etc.), as these could interfere with the program. Also, each hard drive must be on a separate IDE channel (not daisy-chained).
3.3 Laptop Set-up
Take the laptop drive out and connect it to a desktop system, as a Slave Drive, using a Laptop Converter. You can get this converter from http://www.cabledepot.com (1-800-343-4597 toll free or 1-770-564-2323) for approximately $15 Part Number: ADP3040IDE
8 3.4 Drivers and Converters (SCSI, Iomega ZIP/JAZ, SATA)
3.4.A. SCSI Drivers (RAID drives should not load any SCSI drivers.)
You will need to load DOS ASPI drivers if you are working with SCSI devices. DO NOT load any memory managers, as they will cause RecoverSoft Media Tools Professional to freeze.
If you have SCSI devices, the DOS ASPI device drivers should be loaded from your config.sys file. You need to modify the config.sys file to load the correct SCSI device driver. Example: Device=A:\aspi8dos.sys /D
This command assumes you are loading the device driver for an Adaptec 2940UW. You can download Adaptec SCSI Controller drivers from Adaptecs web site (http://www.adaptec.com). If there are other SCSI driver websites that should be listed, please let us know.
3.4.B. Iomega ZIP/JAZ Drivers
If you have Zip or J az drivers, the Iomega DOS Guest program must be run prior to running RecoverSoft Media Tools Professional. This is for the Parallel Port and SCSI Iomega drives. The Guest program can be found on the original floppy diskette that came with the Iomega drive, or you can download this DOS program from Iomegas web site (http://www.iomega.com).
3.4.C. SATA Converter
To recover data from a Serial ATA Drive, you will need to get the Serial ATA-IDE/ATAPI Converter from http://www.cabledepot.com (1-800-343-4597 toll free or 1-770-564-2323) for approximately $50.00 Part Number: SATA-ATAPI 9 Chapter 4 Running RecoverSoft Media Tools Professional
4.1 Launch the Program / p.11 4.2 Select Drive / p.12 4.3 Select Operation / p.13
Work on your original problem media, or on a sector-by-sector clone/image of the original problem media (see Chapter 5, Cycle-Clone /Cycle-Image). Almost all software that clones/images does it file-by-file (not sector-by-sector), which means it cannot clone/image deleted files, files which have been overwritten, etc. In other words, you will not be able to recover your data from a drive that has been cloned/imaged with a file-by-file clone/ image software. Use our sector-by-sector clone (See Chapter 5, Cycle-Clone/Cycle-Image).
Unhook any peripherals not used during the recovery process (Other hard drives attached to the system, CD-ROM drive, burner, etc., as these could interfere with the program.
1. Insert the RecoverSoft Media Tools Professional CD into your CD drive, turn on your computer, and let it self-boot (Make sure the computer is set to boot from the CD drive).
Having problems launching the program? See Ch 12.1, Problem Launching the Program.
2. Press <Alt C>to continue into the program.
Shortcut: When a RED letter is highlighted within any screen, this indicates a shortcut can be used. For example, if you look at the Media Tools Professional screen above, notice that the letters A, R, S, and D are in red. Hold down your <Alt>key and press the <red letter>.
Screen Notes Continue - Transferred to Select Drive About - Copyright Information Registration - Registration Procedures Software Support - Technical Support, 1-925-426-6306
11 4.2 Select Drive
3. Using your <arrow keys >, select the drive to be recovered, and then press <Alt O>or <Enter>. Select IDE or SCSIfor hard disk drives over EBIOS, if it is recognized.
Write Protected Mode is indicated by a checkmark. To make changes or to write to disk, uncheck the appropriate drive by using the <spacebar>.
Drive Access Methods (Advanced explanation): How RecoverSoft Media Tools Professional addresses and communicates with any drive.
IDE DRIVE - communicates with any IDE drive on the system. RecoverSoft Media Tools Professional has direct access and does not rely on the system BIOS to communicate with any media. This means, you can see the entire capacity of any IDE drive, regardless of whether the system BIOS has the ability to see the entire drive. The media is displayed as IDE HDD 000, 001, 002, etc.. IDE HDD 000 always indicates your primary master.
BIOS DRIVE - communicates through the system BIOS with any media on the computer and is typically unreliable. Most new systems have the ability to handle extended int13 calls. If so, the media will be displayed as EBIOS Drive 80h, 81h, 82h, etc. and you will see the entire capacity of any drive above the 8.4GB barrier of DOS. Otherwise, it will be displayed as BIOS Drive 80h, 81h, 82h, etc and a maximum of 8.4GB will be accessible. Do not use the EBIOS Access Method when getting read errors with mechanically failing drives.
SCSI DRIVE - communicates with any SCSI devices on the system (SCSI hard drive, USB storage devices, Iomega ZIP/J AZ removable media). If you have SCSI hard drives on the system, they will appear as BIOS HDD, but will only give access to 8.4GB of the drive. In SCSI Access, you will be able to see the entire capacity of any SCSI drive that is above the 8.4GB DOS barrier. You must have the SCSI device driver loaded to be able to see any media in SCSI Access Method. This includes running the Iomega Guest program for Zip and J az drives before running RecoverSoft Media Tools Professional. The media is displayed as SCSI device 0/0, 0/1, 0/2, etc.
12 4.3 Select Operation
4. Select (the desired) Operation by using your <arrow key>. Then press <Enter> (Shortcut: Hold down your <Alt>key and press the <red letter>).
Follow the Table of Contents at the beginning of the manual for details about each operation within Media Tools Professional.
Cycle-Clone (including Reverse-Clone) /Cycle-Image (Chapter 5) - extracts raw data from mechanically failing drives on any media or operating system, keeping drives out of the clean room. It also creates an exact sector copy for back up protection.
File Recovery Tree (Chapter 6) - rebuilds any FAT or NTFS (DOS and Windows) file system automatically from hard drives and removable media, including accidental format and deletion, corrupt or missing file systems, viruses and worms, files located in slack space from previous formats, and even digital pictures, allowing you to recover data to another destination, including network drives.
Boot Partition Repair (Chapter 7) - rebuilds any FAT or NTFS (DOS and Windows) boot sector and partition table automatically from IDE or SCSI hard drives and removable media, giving you access to all files and directories.
Media Editor (Chapter 8) - mounts DOS and Windows file systems (easy step-by-step screenshots and directions). Then, once the file system is mounted, the file system can be rebuilt automatically, so that you can see which files and directories can be recovered, before purchasing the program. (Note: Use this option if File Recovery Tree does not produce the results you expect).
Media Editor also lets you View, Look for, Edit, and Report anything within the file system on any media or operating system, without knowing Hex, through custom designed editing templates.
Secure Wipe (Chapter 9) - permanently deletes data on any media or operating system to the level the US Department of Defense requires. 13 Chapter 5 Cycle-Clone (including Reverse-Clone) / Cycle-Image
5.1 Cycle-CloneClone Drive to Drive / p.15 5.2 Reverse-Clone (mechanically failing drives) / p.17 A. User Set-up Window / p.18 5.3 Cycle-ImageCreate Image File / p.20 5.4 Span, Split or Compress the Image File / p.23 A. Split or Span the Image File / p.23 B. Compress the Image File / p.23 5.5 Restore Image File / p.24 5.6 Restore a Portion of the Image File / p.26
Cycle-Clone / Cycle-Image - surpasses standard sector cloning and imaging software and devices by not only creating an exact sector back up copy of any media type to a like media; but, they also automatically Cycle into Reverse-Mode when confronted with mechanical issues to extract data from unreadable sectors keeping drives out of the clean room. Reverse-Clone - What is it?, is the never-ending question. Reverse-Clone is the process of cloning from the end of your media to the beginning of it. When your media is mechanically failing, Reverse-Clone is often your last chance to extract raw data from it, without having to take your drive into a clean room. This unique technology, coupled with Cycle-Clone / Cycle-Image, surpasses other standard sector cloning software and devices.
If you know your drive is mechanically failing use Reverse-Clone, a function within Cycle-Clone. It is also necessary to clone mechanically failing drives in IDE or SCSI Access.
14 5.1 Cycle-CloneClone Drive to Drive
NOTE: The Destination Drive must be the same size or larger when using Cycle- Clone (Reverse-Clone) / Cycle-Image. If not, only a partial clone will be made.
1. To prepare to Clone Drive to Drive, complete 4.1 4.3 in Chapter 4.
2. Press <Alt D>to select Clone Drive to Drive.
Clone Drive to Drive screen shot notes:
Start - <Alt S>, starts the Systems Components Search.
Modify - <Alt M>, allows you to modify the Cylinder, Head, and Sector of the Starting Position and Finishing Position. <Tab>or use the <Arrow Keys>on the keyboard to move between the Position fields. When you have finished making modifications press <Enter>.
Stop - <Alt S>, stops the System Components Search. <Esc>- stops the process at any time, too.
Exit - <Alt E>, exits the process and redirects you to the Selection Operation Screen.
Compare - <Alt C>, compares the source drive to the cloned destination drive.
See next page 15
3. Press <Alt N>to select the Destination Drive, or <Alt U>to change the Source Drive.
CAUTION: The problem media must be the Source Drive, and the good media must be the Destination Drive. By default, the Source Drive is the drive you have chosen in the Select Drive Screen. If the Source Drive you have chosen in the Select Drive Screen is the good media, you must change it to become the Destination Drive.
4. After selecting the Source and Destination Drive, press <Alt S>to Start.
Save the report: First, if you stop the cloning process while cloning, you can continue the cloning process where you previously finished, without loosing what you have already cloned. When continuing, <Modify>the Starting Position within the Clone Drive to Drive Screen to match the Finishing Position (where you finished beforehand) from the report to complete the cloning process; second, the report will help in case there are any technical support issues.
5. Press <Esc>to return to the Select Operation window.
Drives are designed with advanced technologies to read quicker in standard-forward-cloning mode. When a drive starts to mechanically fail, these advanced technologies cause a drive to have problems reading correctly. Because drives are not designed to utilize these advanced technologies when reading backwards, you have better control in accessing damaged sectors to extract raw data through Reverse-Clone.
NOTE: The Destination Drive must be the same size or larger when using Reverse- Clone. If not, only a partial clone will be made.
(File) System Components Search: Reverse-Clone does not simultaneously do a System Components Search during Reverse-Clone, like Cycle-Clone and Cycle- Image do. This means you must do a separate System Components Search after running Reverse-Clone.
1. To prepare Reverse-Clone, complete 4.1 4.3 in Chapter 4.
2. Press <Alt D>to select Clone Drive to Drive.
Clone Drive to Drive screen notes:
Start - <Alt S>, starts the Systems Components Search.
Modify - <Alt M>, allows you to modify the Cylinder, Head, and Sector of the Starting Position and Finishing Position. <Tab>or use the <arrow keys >on the keyboard to move between the Position fields. When you have finished making modifications press <Enter>.
Stop - <Alt S>, stops the System Components Search. <Esc>- stops the process at any time, too.
Exit - <Alt E>, exits the process and redirects you to the Selection Operation Screen.
Compare - <Alt C>, compares the source drive to the cloned destination drive.
See next page 17
3. Press <Alt N>to select the Destination Drive, or <Alt U>to change the Source Drive.
CAUTION: The problem media must be the Source Drive, and the good media must be the Destination Drive. By default, the Source Drive is the drive you have chosen in the Select Drive Screen. If the Source Drive you have chosen in the Select Drive Screen is the good media, you must change it to become the Destination Drive.
4. Press <Alt R>to check the checkbox Reverse at the bottom left corner of the Clone Drive to Drive Screen to enable the Reverse-Clone function.
5. After selecting the Source and Destination Drive, press <Alt S>to Start.
5.2.A User Setup Window
When you encounter sector read errors while using Reverse-Clone, pause the program by pressing <Ctrl S>to access the User Setup window, so that you can change the Timeouts and Read Parameters. This helps you communicate with your media to extract data from unreadable sectors, keeping drives out of the clean room (see notes below).
18 Tip: Press <Ctrl S>any time, from anywhere in the program, to access this window. This is the Control Center for working with Mechanically Failing media, meaning you will refer to it often to make changes, such as changing the Timeouts variables or the Read Parameters.
Note: Press the <tab key>to maneuver throughout the User Setup screen. Press the <space bar>to select or deselect a checkbox while maneuvering. Press <Alt O> or <Enter>, when all changes have been completed.
6. Change the Timeouts and Read Parameters
Increasing the Timeouts variable is sometimes the only change needed to communicate effectively with the drive. Increase the IDE Devices or SCSI Devices at 250,000ms. If this does not work, the next step would be to change the Process Delay within Read Parameters.
Changing the Read Parameters is another method to effectively communicate with the drive. Increase the Process Delay at 50ms. If this does not read the drive, increase the Process Delay to 100ms. If you can read the drive, every few minutes accelerate the process by decreasing the Process Delay in increments of 5ms. This gives you the greatest control combined with maximum speed in cloning your data. If you cannot read the drive, the next step would be to change the Read Retries within Read Parameters.
Changing the Read Retries within Read Parameters gives the program more chances to read the damaged sector before moving on to the next sector. Increase the Read Retries to 50. If you cannot read the drive, decrease the Read Retries to 0. This is called Skip Mode, meaning the program will not attempt any Read Retries.
7. After the cloning report has been generated, press <Alt S>to save it.
Save the report: first, if you stop the cloning process, you can continue the cloning process where you previously finished, without loosing what you have already cloned. When completing the cloning process, <Modify>the Starting Position within the Clone Drive to Drive Screen, so that it matches the Finishing Position (where you finished beforehand) from the report; second, the report will help in case there are any technical support issues.
8. Press <Esc>to return to the Select Operation window. 19 5.3 Cycle-ImageCreate Image File
Note: To Cycle-Image the Destination Media must be the same size or larger. If not, only a partial image will be made. It must also have a partition formatted FAT32, or be mapped network drive (See Chapter 12 Problem Solving, Quick Start Directions to create a DOS partition to format FAT32). If this sounds too difficult, Cycle-Clone because it does not require a FAT32 partition, just a drive that is the same size or larger.
Directions to format the Destination Drive FAT32: Step 1 If running RecoverSoft Media Tools Professional, press ALT + X to exit. Step 2 Press ALT + Y (Save Found Components Ch. 10, if you have not already). Step 3 Power off the computer, detach all drives, and then attach only the Destination Drive you want to format (unless you know exactly what you are doing). Step 4 Turn on the computer again with the RecoverSoft Media Tools Professional CD inserted into the CD drive. Step 5 Continue, and choose the Source Drive (the problem drive). Step 6 Select RecoverSoft Media Tools Professional. Within the System Components Search screen, press the Config button, and the Format FAT32 choice appears. Follow the directions. (The choice to Format FAT32 is also available within the Select Action window, right after you select the Source Drive). Step 7 After formatting the Destination Drive FAT 32, you are instructed to turn off the computer system. Then, attach the Source Drive (the problem drive) and the Destination Drive (the drive formatted FAT32). Step 8 Reboot the computer with the RecoverSoft Media Tools Professional CD inserted and choose to Load with or without USB Drivers (other drivers need to be loaded before running RecoverSoft Media Tools Professional. See section 3.5). Step 9 Select and run RecoverSoft Media Tools Professional to the file and folder listing. Step 10 Follow the directions below.
CAUTION: If the media worsens while using Cycle-Image, you want to stop and Reverse-Clone the media (a function within Cycle-Clone) to another Destination Media. We recommend first to Cycle-Clone the media to another like media; then to Cycle-Image it to a compressed or uncompressed file.
1. To prepare to create an Image File, complete 4.1 4.3 in Chapter 4.
20 2. Press <Alt I>to select Create Image File.
Create Image File screen shot notes:
Start - <Alt S>, starts the Systems Components Search.
Modify - <Alt M>, allows you to modify the Cylinder, Head, and Sector of the Starting Position and Finishing Position. <Tab>or use the <arrow keys >on the keyboard to move between the Position fields. When you have finished making modifications press <Enter>.
Stop - <Alt S>, stops the System Components Search. <Esc>- stops the process at any time, too.
Exit - <Alt E>, exits the process and redirects you to the Selection Operation Screen.
Compare - <Alt C>, compares the source drive to the imaged destination.
File - <Alt F>, selects the destination to write the file.
3. Press <Alt F>to select File.
CAUTION: The problem media must be the Source Drive, and the good media must be the Destination Drive. By default, the Source Drive is the drive you have chosen in the Select Drive Screen. If the Source Drive you have chosen in the Select Drive Screen is the good media, you must change it to become the Destination Drive.
NOTE: You can create a single file volume or multiple file volumes. Multiple file volumes are automatically created if there is not enough available space on whatever Destination Drive.
When the Destination Drive becomes full, the program will ask you to locate another Destination Drive or to insert new media, if you are writing to a removable drive, such as an Iomega J az drive. The program could possibly choose to create multiple file volumes on its own, even if there is plenty of space on the Destination Drive. 21
4. Press <Alt B>to Browse to your Destination Drive or Folder.
Note: Press <Alt V>to change the volume spanning sizes. For detailed information, see Chapter 5.4 Span , Split or Compress the Image File.
5. Press <Alt D>to select drives. Then, using the <arrow key >choose a Destination Drive letter.
6. Press <Alt F>to select File Name. Then, type a file name, no more than eight characters.
7. Press <Alt O>to select OK. Press <Alt O>to select OK on the next screen again.
8. After selecting your Destination Drive or Folder, press <Alt S>to Start.
NOTE: A report will be generated after Image File has been created. We suggest you save this report in case there are any technical support issues.
9. Press <Esc>to return to the Select Operation window. 22 5.4 Span , Split or Compress the Image File
5.4.A. Span or Split the Image File
Imaged files are either archived into Split files on another local or network media, or Spanned onto removable, such as a Zip, for later restoration.
For example, when writing to a media that is smaller than the Image file, the Image function automatically prompts you for additional media, breaking down the Image file into individual "Spanned" volumes. If you want to write to a Zip disk, simply change the default volume size (2GB or 2097MB) of the Image file to 100MB. At each 100MB interval, you are automatically prompted for additional media to store the Image files. In this case, you would continually swap Zip disks until the process is finished.
The main advantage of Imaging is to archive and restore media, just in case the original or cloned media fails. Another advantage is that a portion of an Image file can be easily restored, without having to wait for the entire Image to be restored. For example, if your attempt to edit the Boot Sector has dismal results, simply restore just the Boot Record to edit again.
CAUTION: To Span or Split the File Volumes size, you must change the MB size NO LARGER than the maximum media size. If the spanning size is larger than the media, the Image file will FAIL.
Spanning/Splitting the file extension begins with *.v00 and then the next file volume will be *.v01, *.v02, etc. It is important that you predetermine the size of the file volume you want to create. By default, File Volumes are a maximum of 2GB (2097MB). Change the size of the file volume in the Volume File Size field.
5.4.B. Compress the Image File
Creating Compressed file volumes will save you space on your destination media. When Compression is used on the media, the more time the process will take.
In the top field, type the path and file name that is to be written. You can record information about this Image file by pressing the Input Image File Description button. Writing a paragraph about the Image file can be very useful when restoring the Image file, because you can view it making sure it is the correct Image file. This information is imbedded into a special Header file, which records other basic information about the Image file and media.
If you are not sure of the path, press the browse button to pull up the Select File window. Use the <tab key>to jump between the fields and buttons. Press the Drive button <ALT D>to select a different logical drive letter. Press <Enter>on a directory name to enter that directory. If the directory does not exist, press<Alt M>or the <MkDir>button to enter the name of the directory you want to create. Now enter the name of the file you want to create in the File Name field and press <Alt O>or <Enter>. 23 5.5 Restore Image File
1. To prepare for creating an Image file, complete 4.1 4.3 in Chapter 4.
2. Press <Alt F>to select Restore Image File.
3. Press <Alt F>to select File.
4. Press <Alt B>to Browse to your Destination Drive or folder. 24
5. Press <Alt D>to select Drives. Then, using the <arrow key >choose a Destination Drive letter.
6. Press the <Tab>key. Then, select the file you want to restore (*.VOO) using the <arrow key >, and press <Enter>
7. Press <Alt O>to select OK, and then press <Alt O>to select OK again.
8. Press <Alt S>to select Start.
9. Press <Alt Y>to select Yes.
25 5.6 Restore a Portion of the Image File
By default, the entire Image will be restored to the original LBA that it came from. However, a portion of an Image file can be easily restored, without having to wait for the entire Image to be restored. For example, if your attempt to edit the Boot Sector has dismal results, simply restore just the Boot Record to edit again.
Example:
To restore only part of the Image file, select the Starting or Finishing CHS within the Image to restore. Then, select the Destination - where to restore the Image to the media. For example, Lets restore only the Boot Sector for the FAT file system at LBA sector 63 (CHS =0,1,1). Being unsatisfied with the results, I want to restore the original Boot Sector to the media. Press <Modify>, make the Starting and Finishing CHS 0,1,1, and the original Boot Sector will be restored.
Example:
Another example would be, restoring LBA sectors 315-566 from Image file volume, but restoring them to the media starting at LBA 64. Press <Modify>and make the Starting LBA 64 and the Finishing LBA 314. Then, press the <Starting Position in Volume>button. Notice, that it defaults to the same starting LBA 64 as on the media. Now, change the starting LBA to 315. This type of procedure is useful for working in the Media Editor and different parts of the file system.
26 Chapter 6 File Recovery Tree
6.1 (File) System Components Search / p.28 6.2 Select File System to Rebuild / p.28 6.3 Recover Files and Directories to a FAT32 destination drive / p.31 o Directions to format a Destination Drive FAT32 6.4 Restore Files and Directories using WinZip or PKZIP / p.32 6.5 Use the Menus to look for and filter specific files / p.33 A. <Utils>Menu / p.33 B. <Look for>Menu / p.35 C. <File>Menu / p.36 6.7 Mount the file system into Media Editor to <View>, <Look For>, <Report>and <Edit> raw data at the sector level / p.37
File Recovery Tree rebuilds any FAT or NTFS (DOS and Windows) file system automatically from hard drives (IDE, SCSI, and SATA) and removable media (USB Devices), including accidental format and deletion, corrupt or missing file systems, viruses and worms, files located in slack space from previous formats, and even digital pictures, allowing you to recover files and folders to another destination to a local network, hard drives, and USB Devices.
You have the ability to Look For and Filter specific files once the file system has been rebuilt (For more details, see 6.6, Use the Menus to look for and filter specific files).
You can also Mount the file system into Media Editor to help you View, Look For, Report and Edit raw data within the file system at the sector level. 27 6.1 (File) System Components Search
1. To prepare the System Components Search, complete 4.1 4.3 in Chapter 4.
Start - <Alt S>, starts the Systems Components Search.
Modify - <Alt M>, allows you to modify the Cylinder, Head, and Sector of the Starting Position and Finishing Position. <Tab>or use the <Arrow Keys>on the keyboard to move between the Position fields. When you have finished making modifications press <Enter>.
Stop - <Alt S>, stops the System Components Search. <Esc>- stops the process at any time, too.
Exit - <Alt E>, exits the process and redirects you to the Selection Operation Screen.
Config - <Alt C>, directs you to <Analyze>, <Save>, <Load>, <Show>, or <Restore>all found components during the Systems Components Search.
2. Press <Alt S>to <Start>the System Component Search.
After the System Component Search is complete, the Select File System Screen automatically appears, showing you the file systems that can be rebuilt on this drive. If not, which one of these messages appears?
Error: No Valid File System Found? See Chapter 12.3. Warning: Cannot Locate the Root Directory? See Chapter 12.6.
File System not Displayed? See Chapter 12.3
6.2 Select File System to Rebuild 28
3. Press <Alt L>to select the file system in question. Then, press <Alt O>.
Scanning Found Components to create a file and folder listing
see next page 29
Use <Page Down>from any root directory to go to the next set of root directories. Use <Page Down>from any file to go to the next set of files. Use <Tab>and the <arrow keys >to move between the directories and files.
Use the Menus to look for and filter specific files: <File>, <Look for>, <Utils> allow you to do specific searches, filter files, recover selected files, etc. from the Directory and File Structure Tree (See Ch. 6.5, Use the Menus to look for and filter specific files). File Status Explanation (color-coding explanation): Excellent - indicates a file that should have a successful recovery. Technically, the file has valid file chains, and is part of the existing file system. Good - indicates a file that should have a successful recovery a majority of the time. Technically, the file may have valid file chains, but is either not part of the existing file system, or has corruption within the file system.
Possible - indicates a file that could have a successful recovery. Technically, "Possible" and "Good" are equal. However, a Possible file is less likely to be a valid file compared to a "Good" file, because of possible corruption to the file.
Poor - indicates a file that has a poor chance of recovery. Technically, the file has invalid file chains. WHITE - indicates a sub-directory. This does not mean the files in that directory are valid, only that it is a sub-directory.
YELLOW - indicates a file or directory that has been tagged for recovery.
Important Note: If a folder also has been renamed "Found", the original name no longer exists. To determine if a file within a folder can be recovered, refer to the color-coding of the file. Technically, if a folder has been renamed "Found", it has been found during the scan, but is not part of the existing file system. You may want to rename the folders to their original state after you have recovered them.
30 6.3 Recover Files and Directories to a FAT32 Destination Drive
Why FAT32 ? You must recover data to a destination drive with a partition formatted FAT32 (or to a mapped network drive). The reason you must recover your files to a drive formatted FAT32 is, RecoverSoft Media Tools Professional is a DOS program (that can work with multiple file systems). However, DOS can only write (recover data) to a FAT Destination. Once you recover data to a FAT32 Destination Drive, you can easily transfer it to another file system.
Directions to format the Destination Drive FAT32: Step 1 If the Destination Drive is not already attached, press ALT +X to exit and follow Steps 1-3. If it is attached, go directly to Step 6. Step 2 Press ALT +Y (Save Found Components Ch. 10, if necessary). Step 3 Power off the computer, and then attach the Destination Drive you want to format (unless it is already attached). Step 4 Turn on the computer again with the RecoverSoft Media Tools Professional CD inserted into the CD Step 5 Select Continue, and choose the Source Drive (the problem drive). Step 6 Select File Recovery Tree. Within the System Components Search screen, press the Config button. Choose Format Drive and follow the directions (The choice to Format Drive is also available within the Select Action window, right after you select the Source Drive). Step 7 After formatting the Destination Drive, you are instructed to turn off the computer system. Attach the Source Drive (the problem drive) if necessary. Step 8 Repeat Step 4, and then continue to Step 9. Step 9 Select Continue, File Recovery Tree, Config button to Load Saved Components, Analyze Found Components, and choose the appropriate File System to build a listing of your files and folders. Step 10 Follow the directions below.
4. After the Directory and File Structure Tree is generated, use <Tab>and the <arrow keys >to select the directories and files that you want to recover. Highlight <ROOT>if you want to recover all directories and the files within them. Selected files will turn Yellow. Press the <spacebar>to activate the desired files.
5. Press <Alt R>to recover selected files and directories.
6. Press <Alt B>to <Browse> to choose the Destination Drive.
31 NOTE: Press <Alt U>to activate the compression on the fly. Press <Alt L> to change the compression level and <Alt M>to activate MD5. These functions are mainly used for Computer Forensics (For details, see Chapter 13.4, MD5 Hash Mark).
7. Press <Alt D>to select <Drives>. Then, using the <arrow key >choose a Destination Drive letter (i.e. A:\ , B:\ , etc).
TIP: Use <arrow keys>to locate your Destination Drive. Use <Tab>to select a Destination folder. Press<Enter>on the folder of choice. After the Destination point has been determined, press <Alt D>again to highlight the drive location. Then, press <Enter>.
8. Press <Alt O>to transfer files from one media to another.
NOTE: A report will be generated after the files have been transferred. We suggest you save this report in case there are any technical support issues.
9. Press <Esc>to return to the Select Operation Screen.
6.4 Restore Files and Directories using WinZip 9.0 or PKZIP 4.0
To RESTORE or EXTRACT your recovered data to another destination drive (formatted FAT32), use PKZIP 4.0 or greater or WinZip 9.0 or greater. Previous versions will create errors:
Once PKZIP or WinZip has been installed, copy every file into a single directory on your hard drive. Then, unzip these files from this directory (By default, the entire contents of the zip files are extracted to your hard drive. However, you can choose to extract individual files from the list).
CAUTION: DO NOT restore your recovered data to the root directory, because you run a high probability of corrupting your hard drive. Extract the data to into the single directory on your hard drive. This will keep the original directory structure.
CAUTION: Make sure to test the validity of the Zip files from which you are recovering data, before discarding the Source Drive. 32 6.5 Use the Menus to look for and filter specific files:
6.5.A. <Utils>Menu
The <Utils>, or Utilities window provides extra searching power. The most popular functions are the <Files/Directories Display Filter>and <Recover Selected Files>.
Files / Directories Information <Alt I>- Launches a report screen detailing total files and folders. Files / Directories Display Filter <Alt D>- Allows the customer to locate specific types of files. Recover Selected Files <Alt R>- Prompts customer to locate a destination drive to save information. Expand / Contract Directories <Alt E>- Expands all directories. Create Structure Report <Alt C>- Creates a structured report of drive information. Show Directory Map <Alt M>- Creates a mapping of all files and folders including condition status. Visit Media Editor - <F10>- Opens Media Editor.
Example: <Alt D>: The File/Directories Display filter finds specific files: Good files, Found Files, Deleted Files, System Files, Invalid Files, etc.
If a file cannot be located, use the filter to show everything [---]. Once you have applied the filters, press <Alt C>to create a structure report.
Hold down your <Alt>key and press the <red letter>. Then, use the <arrow key >to open the drop. Then, use the <arrow keys >to choose Hide, Only, or [---] which shows everything.
See next page 33
Once you have applied the filters, press <Alt C>to create a structure report.
File Status Explanation (Technical explanations are given in section 6.3): Excellent - indicates a file that should have a successful recovery. Good - indicates a file that should have a successful recovery a majority of the time. Possible - indicates a file that could have a successful recovery.
Poor - indicates a file that has a poor chance of recovery. White - indicates a sub-directory. This does not mean the files in that directory are valid, only that it is a sub-directory. Yellow - indicates a file or directory that has been tagged for recovery. Important Note: If a folder also has been renamed "Found", the original name no longer exists. To determine if a file within a folder can be recovered, refer to the color-coding of the file. Technically, if a folder has been renamed "Found", it has been found during the scan, but is not part of the existing file system. You may want to rename the folders to their original state after you have recovered them.
34 6.5.B. <Look for>Menu:
The <Look For>window provides the capability to search for specific files such as Microsoft Word, Excel, Photoshop, or any other type of document.
Look For File <F7>- Searches for a file by exact name. Select By Mask <Alt S>- Searches for files by using wildcards (read below). Look For Next <Alt N>- Continues searching the previous wildcard with a similar name or extension.
Example: <F7>and <Alt N>: Look For File searches for specific files.
If you cannot find a file, search using a wildcard*. Type the name of the file, followed by an asterisk, a period and then the file extension with no spaces. For example, if I want to look for a file called health., but I cannot remember the exact name, I would type *health*.* (Another method to look for a specific file would be to include the extension as in health*.doc ) Assuming there is another related file with the title health, I would simply press <Alt N>to search for the next document that contains the above context.
Press <Alt O>or <Enter>to select OK. 35 6.5.C. <File> Menu:
The <File>menu allows you to change Timeout Settings, Read Parameters, and Additional Parameters within the <User Setup>Screen; or to open a <Report File>.
For User Setup instruction see Chapter 13.1, Advanced User Setup Window.
<File>- Accesses 3 screens:
User Setup <Ctrl S>- Launches the User Setup window Report Files <Ctrl R>- Opens reports and .txt file Close Window - Redirects to Select File System Screen
36 6.7 Mount the File System into Media Editor to <View>, <Look for>, <Report> and <Edit> raw data at the sector level
Once the Directory and File Structure Tree is generated (the screen that shows all the files and directories), press <F10>to Mount the file system into Media Editor to <View>, <Look For>, <Report>, and <Edit>raw data within the file system at the sector level (For more details, see Ch.8, Media Editor).
Select Working Area (Mounted File System)
37 Chapter 7 Boot Partition Repair
7.1 (File) System Components Search / p.39 7.2 Create a Backup Fle / p.40 7.3 Access Repaired File Systems / p.42 7.4 How to Make the Drive Bootable / p.42
Misconception
The common misconception most people have about using a boot sector and partition repair software program is, they think the purpose of the program is to make their computer bootable again. In reality, the function of Boot Partition Repair (and any other boot sector and partition table repair program) should be to give you access to your data, so that you can copy it off to another destination (See section 7.6, How to Make the Drive Bootable, for a detailed explanation as to why you should not make your drive bootable).
Boot Partition Repair rebuilds any FAT or NTFS (DOS and Windows) boot sector and partition table automatically from hard drives (IDE, SCSI, and SATA) and removable media (USB Devices), giving you access to all files and directories.
You have the ability to Create a Backup File to restore your original data in case you would like to reverse the repair process.
You can also View Components of any Partition / File System to understand more detailed information.
38 7.1 (File) System Components Search
1. To prepare for running Boot Partition Repair, complete 4.1 4.3 in Chapter 4.
Start - <Alt S>, starts the Systems Components Search.
Modify - <Alt M>, allows you to modify the Cylinder, Head, and Sector of the Starting Position and Finishing Position. <Tab>or use the <Arrow Keys>on the keyboard to move between the Position fields. When you have finished making modifications press <Enter>.
Stop - <Alt S>, stops the System Components Search. <Esc>- stops the process at any time, too.
Exit - <Alt E>, exits the process and redirects you to the Selection Operation Screen.
Config - <Alt C>, directs you to <Analyze>, <Save>, <Load>, <Show>, or <Restore> all found components during the Systems Components Search
2. Press <Alt S>to Start the System Component Search.
After the System Component Search is complete, the Select File System Screen automatically appears, showing you the file systems that can be rebuilt on this drive. If not, which one of these messages appears?
Error: No Valid File System Found? See Chapter 12.4. Warning: Cannot Locate the Root Directory? See Chapter 12.6.
File System not Displayed? See Chapter 12.3.
39
3. Use the <spacebar>to select ALL file systems that you want to access. A checkmark will signify that the file system has been selected.
CAUTION: A common mistake is to select only the file system(s) that have not been accessible. You MUST select ALL file systems that you want to access. A <checkmark>will appear next to each file system that has been selected.
4. Press <ALT N>, for Next.
File System Components Information: At this point, the program is not actually changing or creating the Partition Table. It is showing what the Partition Table will be changed to, when you continue the repair process.
Want to review your files and directories? You can also review files and directories within all File System(s) through the RecoverSoft Media Tools Professional operation. Press <Esc>to return to the Select Operation screen. Choose File Recovery Tree. Select the File System you want to see. Press <Enter>(see Chapter 6, File Recovery Tree). 7.2 Create a Backup File
40 Creating a Backup File will allow you to have a back up copy in case you would like to reverse the repair process. The program will not continue until a backup has been completed.
5. Press <ALT N>for Next to Create a Backup File.
6. Press <Alt D>to select drives. Then, using the <arrow key >choose a Destination Drive letter.
7. Name the Backup File by pressing <Alt F>. Then, press <ALT O>, or <Tab>to OK and press <Enter>.
8. Press <Alt Y>for Yes, or <Enter>, when presented with the option to write the changes to the drive.
NOTE: A report will be generated after the repairs have been made. We suggest you save this report in case there are any technical support issues.
9. Press <Esc>to return to the Select Operation Screen.
41 7.5 Access Repaired File Systems
CAUTION: If you automatically reboot back into Windows once a program has made the necessary repairs, you risk permanently damaging your data to the point of being unrecoverable.
You should:
1. Exit and turn off the computer once the necessary repairs are accomplished.
2. Next slave the repaired drive, as a secondary drive, behind a working bootable Windows drive.
3. Reboot the working drive into Windows (not the secondary or repaired drive).
4. Finally, go into Windows Explorer and copy your data from the repaired drive to the working drive.
7.6 How to Make the Drive Bootable
CAUTION: When you do not have another drive to Slave the repaired drive to (after Boot Partition Repair makes necessary repairs have been made), then you will have to use FDISK and SYS to be able to boot back into Windows.
Proceed at your own risk!
Follow these steps exactly to make the drive bootable:
1. Use RecoverSoft Media Tools Professional to repair the boot sector and partition table.
2. After your system boot record has been repaired, locate a boot disk for the same version of your OS that is being repaired. For example, if you are using Windows 98/SE, you must find a boot disk for Windows 98/SE. If you have Windows 2000 or Windows XP, boot with the CD and use the repair console instead of following the rest of these instructions.
3. Make sure FDISK.EXE and SYS.COM are located on the boot floppy. Again, as noted, make sure you are using the exact same version as the OS being recovered.
4. Once the system has been rebooted, type <FDISK >at the DOS prompt (A:\). Then you will be presented with 4-5 options within Fdisk. Choose the option that makes a Partition Tables Active. It will usually be the first Partition Table that is set as active. Once this is done press <ESC>to exit Fdisk.
5. We will use Fdisk again, but will use a command line option this time. At the DOS prompt (A:\) type: <FDISK /MBR >. It will write information to the drive and then go back to the DOS prompt (A:\).
CAUTION: If running Windows NT/Windows 2000/Windows XP on NTFS partition DO NOT perform Step 5. This could severely damage to the OS, resulting in lost data.
6. Type <SYS C: >. It should tell you that the system was successfully transferred.
7. Remove the boot floppy and reboot the system. Pray that there is not any corruption to the FATs, MFT or Directory Structure. 42 Chapter 8 Media Editor
8.1 Select Working Area (Mounted or Unmounted File System) / p.46 A. Unmounted File System / p.46 B. Mounted File System / p.46 a. (How to) Mount the File System / p.47 b. Rebuild Files and Directories Automatically / p.50 8.2 View (the Sector) As / p.51 A. Hex / ASCII View / p.51 B. Text View / p.51 C. Partition View / p.52 D. Boot Sector View / p.53 E. File Allocation Table (FAT) View / p.54 F. Directory View / p.55 8.3 Look For (within a Sector) / p.56 A. Look for Hex / ASCII / p.56 B. Look for Boot Sectors / p.56 C. Look for Partition / p.57 D. Look for File Allocation Table (FAT) / p.57 E. Look for Directory Entries / p.58 F. Look for Files / p.58 8.4 Save Sectors / Restore Sectors of data to/from a file (i.e. instead of having to use Cycle-Clone/Cycle-Image to create an entire file volume of the media) / p.59 8.5 Fill Current Sector (i.e. when you have a virus that will not go away) / p.59
Media Editor is not like any other Hex Editor. Without knowing Hex, Media Editor can mount and rebuild any FAT and NTFS (DOS and Windows) file system automatically, and when necessary, it can help you Look For, View, Report and Edit sectors of raw data through custom-made editing templates on any operating system.
Mount the File System
First, the Media Editor can mount any FAT or NTFS (DOS and Windows) file system at the sector level. This means, without knowing Hex, the Media Editor can calculate the geometric location of each component of the file system (Partition Table, Boot Sector, File Allocation Table, Root Directory, etc.) and automatically link them together. This lets you easily navigate from sector to sector throughout the file system to edit and recover data - simply follow the links within the Mounted File System.
Select Working Area (Mounted File System)
43
Rebuild files and directories automatically
Second, if the file system is mounted, press <F10>and the Media Editor will automatically rebuild any FAT or NTFS (DOS and Windows) file system. Once rebuilt, you can Look For and Filter specific files using the menus <File>, <Look For>, and <Utils>. This option is used if the File Recovery Tree operation does not produce the results you expect.
File and Directory Tree Structure
Look For / View / Report / Edit / sectors of raw data on any media or operating system, through custom made editing templates.
Next, through custom-designed editing templates, Media Editor lets you to <Look For>, <View>, <Report>, and <Edit>anything within the file system on any media or operating system, without knowing Hex. This lets anyone, who is familiar with the file system, edit raw data much easier than ever possible.
Look For (i.e. Partition Table Search Attributes)
continued
44
View As (i.e. Partition Table View in ASCII format)
Edit any media on any operating system
Finally, Media Editor can be used independently as a Hex Editor on any media or operating system. This function allows you to bypass the mounting process to edit raw data through custom designed editing templates, or directly with the raw sectors of data.
Save Sectors / Restore Sectors
You can save a range of sectors to a file within Media Editor, instead of having to use Cycle- Clone/Cycle-Image. When making changes to any sector, you can make a quick backup of the sector to a file.
Fill Current Sector
You can fill any sector to clear out viruses and corrupted data before reconstructing any data. It defaults to writing zeros to the sector, but you have over a 100 different choices.
45 8.1 Select Working Area (Mounted or Unmounted File System)
Select Working Area Screen (Mounted or Unmounted File System) is considered the Control Center within Media Editor, meaning you will refer to it often to make changes to the Starting Position and Finishing Position (and to Jump To different components of the file system, once the file system has been mounted). Press <Alt C>anytime from a mounted or unmounted file system while in Media Editor to access the Select Working Area window.
Read-Only Mode: As you enter Media Editor, you will be in Read-Only Mode and will be asked to define the working area Starting Position (it defaults to the entire capacity of the drive until you change the values). If you know where the Boot Sector is, you can set the Starting Position to that location, and press <Enter>. Then, (go to step 5) and Mount the drive under the <Mount>menu.
8.1.A. Select Working Area (Unmounted File System)
8.1.B. Select Working Area (Mounted File System)
46 8.1.B.1. (How to) Mount the File System
1. To prepare for entering the Media Editor, complete 4.1 4.3 in Chapter 4.
2. If you do not know the Starting Position of the file system, press <Alt O>or <Enter>.
NOTE: As you enter Media Editor, you will be in Read-Only Mode and will be asked to define the Working Area Starting Position (it will be defaulted to the entire capacity of the media until you change the Working Parameters). If you know where the Boot Sector is, you can set the Starting Position to that location, and press <Enter>. Then, (go to step 5) and Mount the drive under the <Mount>menu.
3. Under the <Look For>menu at the top of the page, chose <Boot Sector>.
47
4. Press <Alt O>or <Enter>(do not change any Attributes or Values).
5. Under the <Alt M>for Mount menu at the top of the page, choose your file system.
Note: Chose from the following File Systems: FAT =Windows 95, 98, ME NTFS =Windows NT4.0, 2000, XP (2000 and XP could be FAT or NTFS, but the default is NTFS).
6. Press <Alt Y>, or <Enter>.
7. Press <Alt O>, or <Enter>(do not change any Parameters).
NOTE: What if there is not a valid Boot Sector to give these values? Press <ATL O> or <Enter>to accept these values and to return to the Select Working Area window (Unmounted File System). You will have to calculate these values manually and input them into the appropriate fields.
48
8. Press <Alt O>, or <Enter>(takes you to the Boot Sector)
(You have mounted the file system successfully. To recover files and directories automatically, see section 8.3, Recover Files and Directories Automatically.)
49 8.1.B.2. Rebuild Files and Directories Automatically
4. Once the drive has been mounted, press <F10>to rebuild the file system through File Recovery Tree.
NOTE: The Directory and File Structure Tree window appears for file systems that have been successfully mounted. Unmounted File Systems will default to the Select Working Area (Unmounted File System) window when using <Alt C>. You have to calculate these values manually and input them into the appropriate fields.
(See Chapter 6.4, Recover Files and Directories to a FAT32 destination drive)
50 8.2 View (the Sector) As
8.2.A. Hex / ASCII View
The Hex screen is laid out in three columns. The left most column is the Line Address, or offset, within the sector. The middle column is the Hex Values of the sector; the right column is the corresponding ASCII Values of the sector. Each two characters in the Hex (middle) column make one byte. In the above example (ii) the first byte is 33h. Whenever you are referring to Hex you put a lowercase h at the end of the Hex value.
Notice at the bottom left corner in the above image (ii) you see (0;0;1;LBA=0). This will always tell the exact CHS/LBA location you currently are on. As you search for file system components, often refer to the LBA. Use the <Page Up/Down keys>on the keyboard to move up or down the sector to move to the next sector or previous sector. Use the combination <CTRL-Page Up>or <CTRL-Page Down>to move to the Starting or Finishing sector of the Working Area.
Press the <ESC>key to leave Media Editor and to return to the Select Operation window at anytime.
8.2.B. Text View
Using Text View is good for reading text within a sector. After searching for a keyword, phrase or a string of text, put the sector into text view to be able to read it easier. When viewing a sector that has no visible text, it will look like nothing more than a screen full of garbage. 51 8.2.C. Partition View
You will typically find a Partition Table at 0;0;1;LBA=0. The Partition Table defines the area on the drive that will make up the File System. View this sector as a Partition Table with the menu item or <Alt P>. You can repair the Partition Values, without having to translate Hex. You will need to change from <Read Only Mode>to <Edit Mode>. Use the shortcut CTRL-S to get to the User Setup window and to check Edit Mode at the bottom of the window <Ctrl F1>. The top right corner will change from <Read Mode>to <Edit Mode>. Then you can press the <numbers 1-4> to modify each Partition line. The Partition Table has a distinct signature aa55h. This value must be here or your system will not recognize the Partition Table.
Partition View continued
When you have chosen 1-4 as in the previous screen, the Edit Partition Table Entry window will appear. This is where you will actually enter the values for each line of the Partition Table. Check the Sync CHS and LBA field before entering any values. The program will then do calculations for you. You are able to enter certain values without knowing other values. Lets say in the above entry that we know the Starting Position of the Partition Table is at CHS (0;1;1;LBA=63). We also know the total sectors for the Partition Table, but we do not know the Finishing Position. You can enter LBA63 into the Starting Position and the total sectors into the Sectors field. The program will calculate the Finishing Position for you. You will also need to choose the File System Code and whether the Partition Table is a Boot Partition Table. There can only be one Boot Partition in a Partition Table. 52 8.2.B. Boot Sector View
View a sector as a Boot Sector with the View As menu item or the shortcut keys <Alt 1><Alt 3>, or <Alt-B>, depending if you will be looking at a FAT16, FAT32 or NTFS Boot Sector. You will be able to enter the appropriate values without having to translate Hex. The Boot Sector is the next critical component, following the Partition Table.
1. J ump Code You will be safe if entering ebh 3eh 90h as the default value. These values are the first three bytes of the boot sector. 2. OEM Name the name of the file system. 3. Bytes per Sector this will usually be 512 for the FAT file system. It can be different for other file systems. 4. Sectors per Cluster How many sectors make up a cluster? 5. Reserved Sectors FAT16=1, FAT32=32. There are some Partition resizing utilities that can alter this standard. 6. Number of FATs always 2 for FAT File System. 7. Root Entries Using the Microsoft standard, the value is 512 for Fat16. The value is 0 for Fat32. There are some Partition resizing utilities that can alter this standard. 8. Total Sectors (16) 16 bit. For DOS6.X/Win9.X this will be 0. 9. Media Descriptor default f8h 10. Sectors per FAT (16) How many sectors are in the FAT table? Count the number of sectors between the first FAT and the second FAT to determine this number. 11. Sector per Track the number of sectors. Look at the drives CHS 12. Number of Heads - the number of heads. Look at the drives CHS in BIOS Access. 13. Hidden Sectors This is typically the same as the sectors per track. 14. Total Sectors (32) 32 bit. This value will be the same as in the partition table. 15. Drive Number Default 80h 16. Extended Signature Default 29h 17. Volume Serial Number It is not necessary to have anymore than 0 in this field. This is not critical to gain access. 18. Volume Label Give it any name you want. The volume label is created when you format the drive. 19. File System ID What type of file system? FAT16, FAT32 20. Sector Signature as the partition table, the boot sector also requires the signature aa55h as the ending value to the sector.
There are other variables in the FAT32 and NTFS Boot Sectors. Also there is another part to the FAT32 Boot Sector called the Info Sector. The Info Sector is the next sector following the FAT32 53 Boot Sector. So if the FAT32 Boot Sector is located at CHS 0,1,1;LBA=63, then the FAT32 Info Sector would be located at CHS 0,1,2;LBA=64. You can view this sector as an Info Sector with the menu item under the View As Boot Sector FAT32 FS Info Sector.
8.2.E. File Allocation Table (FAT) View
The File Allocation Tables give the address to all Directories and Files within a particular Partition Table. When you find a FAT table, use ALT-C to make the Starting Position of the working area at the beginning of the FAT table. In the above example the Starting Position would be set to (0;1;33;LBA=95). A FAT16 Fat Table is usually the first sector following the Boot Sector. Locating file system components will allow you to find where other File System Components should be. If the FAT16 Fat Table starts at (0,1,2;LBA=64) then the Boot Sector would be located at (0,1,1;LBA=63). A FAT32 fat table will start 32 sectors after the FAT32 Boot Sector, as in the above screen. This is where the Reserved Sector in the Boot Sector comes from. In FAT16 the reserved sectors will be 1 and for FAT32 it will usually be 32.
In <Edit mode>you are able to change these values.
Follow the FAT chain by placing the cursor on one of the entries. The bottom left corner of the screen will tell you what cluster you are on in the FAT table. The entry on the screen will tell you where the next chain points. If you are on cluster 48, the value says that the next entry is 49. Keep following this chain until you hit an EOF (End of File) entry.
54 8.2.F. Directory View
When you locate a Directory, change the view with the shortcut <Alt D>. You will see individual File entries, one per line. Place the cursor on one of the entries and press enter. This will bring up the above window with more detailed information on the File or Directory entry. In <Edit Mode>, you can make changes directly to the Directory View screen or press <Enter>on a File/Directory to edit in the more detailed window.
55 8.3. Look For (within a Sector)
8.3.A. Look For Hex / ASCII
Use the HEX/ASCII <Look for>option to search the entire media for any Hex or ASCII pattern. You will be able to investigate the media looking for a phrase or text string as an example. For example, <Look For>any patterns that have the words bank account. This will find any entries from any sector with this phrase. The search will stop every time a match is found unless you run the search in <Report Mode>. This will find all matches and write it to a report. When searching in <non-report mode>, use the Find Next shortcut <Alt N>to continue searching the media for other matches.
8.3.B. Look For Boot Sector
There is some flexibility when searching for Boot Sectors. All Boot Sectors have the signature aa55h. As you search and are not finding what you are looking for, start by eliminating the attributes from the bottom up. Take off the media descriptor first etc. Try different variations. You can even change the values.
56 8.3.C. Look For Partitions
Search for many different Partition Table types at the same time or narrow down to just one type. Use the <check boxes>on the left to eliminate search choices. Press the <numbers 1-6>to bring up the file system type window and choose a different file system that is not on the default list. Search for a Linux or Netware partition. Refer to Advanced Data Recovery and Computer Forensic Procedures for a list of different File System types.
8.3.D. Look For File Allocation Table (FAT)
Depending on the type of FAT you are searching for will depend on what variants will be used in the search. It is usually the first 4 bytes of the sector that make the distinction that it is a FAT table. By default, the FAT search attributes are only for the first 2 bytes. There are different variations to the first 4 bytes, depending on what specific flavor of the operating system it is. A few variations are: (f8h ffh ffh ffh), (f8h ffh ffh 0h), (F8h ffh ffh 7h). We give 6 bytes to search for even though all of them will usually never be used. To search for more than the default values, change the Number of bytes. to 3, 4, etc. Then change the byte values. If you only change the 0h byte values without changing the number of bytes to search for, it will still only search for the default values. You will notice that the fewer bytes used in the search will also cause more false matches to be found.
57 8.3.E. Look For Directory Entries
Looking for Directories is very simple with no variations. When the search finds a Directory, make sure you are in Directory View <ALT D>.
8.3.F. Look For Files
RecoverSoft Media Tools Professional will search for File names. When it finds a file match, make sure you are in Directory View <ALT-D>to be able to view the File Entry. You can search for exact names or use the asterisk (*) to add a wildcard in the search. The more wildcard asterisks that are used in the search will cause more garbage to show up in the search results. An extreme example would to use (* . *) in the search. This would cause every single line item to show up in the results. Lets say you want to locate all MS-Word documents. Enter the wildcard asterisk (*) into the first field and doc into the extension field, (*. doc). Another example would be where you are not sure of the exact file name but know part of it. Lets say the part you know is bank. So put (*bank*) in the first field and (doc) in the extension field. This means the program will look for files that have the extension of doc and have the word bank somewhere in the first part of the file name. 58 8.4 Save Sectors / Restore Sectors of data to/from a file (i.e. instead of having to use Cycle-Clone / Cycle-Image to create an entire file volume of the media)
There is the ability to save a range of sectors to a file within Media Editor, instead of having to use Cycle-Clone/Cycle-Image. When you make changes to any sector, you can make a quick backup of the sector to a file (We recommend creating an Image File Volume of the entire media before making any changes). Save Sectors will default to backup whatever sector you are currently on or you can select a range. If you save a range of sectors, make sure there is enough space on the destination. Restoring the file works in reverse. It will restore whatever sector file you choose to whatever sector you are currently on.
8.5 Fill Current Sector (i.e. when you have a virus that will not go away)
The <Fill Current Sector>option fills whatever sector you currently are on. If the Boot Sector is corrupt and full of garbage, use the <Fill Current Sector>option to clear it out before reconstructing. It defaults to writing zeros to the sector. You can choose a different symbol to be written to the sector. Make sure you have a backup of the sector first, whether it is an image file volume or a sector save from the Utils menu. Clearing the sector eliminates every byte in the sector. As an example, if you have a virus that just wont go away, clearing the sector and then rebuilding the Partition Table or Boot Sector is very helpful.
59 Chapter 9 Secure Wipe
Department of Defense security level
If you think formatting your hard drive or removing the MBR is good enough, think again. Secure Wipe quickly and permanently overwrites every bit on every sector on any media or operating system to the level the U.S. Department of Defense requires and authenticates it with MD5. This means every physical sector, chain and cluster, will be overwritten, so that it can NEVER be recovered. Better yet, this process takes just minutes to complete.
CAUTION: Running Secure Wipe will completely destroy all data on your hard drive. Once run, data will be lost forever. Please be sure you wish to destroy all data before running the program.
Wipe the Drive / p.61 Department of Defense, Secure Wipe / p.62
60 9.1 Wipe the Drive
1. To prepare to wipe the drive, complete 4.1 4.3 in Chapter 4.
Secure Wipe screen notes:
Start - <Alt S>, starts the Systems Components Search.
Modify - <Alt M>, modifies the Cylinder, Head, and Sector of the Starting Position and Finishing Position. <Tab>or use the <Arrow Keys>on the keyboard to move between the Position fields. When you have finished making modifications press <Enter>.
Stop - <Alt S>, stops the System Components Search. <Esc>- stops the process at any time, too.
Exit - <Alt E>, exits the process and redirects you to the Selection Operation Screen.
Verify - <Alt V>, verifies that all sectors have been wiped with the symbol you have selected.
Options - <Alt O>, gives options to choose what character you want to write to all sectors of the media and how many times that this character is written to each sector (even to the level the Department of Defense requires).
2. By default, the drive is Wiped with 0000000. If this is suitable for your needs, press <Alt S>to select Start.
To select one of the other 256 Hex characters To change the number of times the drive is Wiped To choose The Department of Defense Security Wipe
Press <Alt O>to select Option. Then, go to 9.2, The Department of Defense Wipe.
61 9.2 Department of Defense, Secure Wipe
To prepare for the Department of Defense, Secure Wipe, begin at 9.1, Wipe the Drive.
3. To select the DOD Security Wipe, press <Alt D>. Then, press <Alt O>. To change the number of times the drive is Wiped, press <Alt N>and chose a number. To change the Hex character, press <Alt G>and chose a character. Then, press <Alt O>.
The DOD Security Wipe is in progress
4. Press <Alt S>to select Save As File, if necessary. Choose your destination.
5. Press <Esc>to return to the Select Operation window. 62 Chapter 10 Save / Load Found Components
10.1 Save Found Components to a Bin File / p.63 A. Save Found Components while exiting the program / p.63 B. Save Found Components while working within the program / p.65 10.2 Load Found Components from the Bin File / p.67 A. Load Found Components while entering the program / p.67 B. Load Found Components while working within the program / p.68
63 10.1 Save Found Components to a BIN FILE
There are 2 ways to Save Found Components to the Bin File: While exiting the program or while working within the program. If you are trying to Save the Bin File while working within the program go to 10.1.B., Save Found Components while working within the program.
10.1.A. Save Found Components while exiting the program
1. Exit the program <Alt X>.
2. A Question Box will be invoked: Do you want to quit the program? Press <Enter>or <Alt Y> for <Yes>.
3. Another Question Box will be invoked: Would you like to save all found components to a file for future use? Press <Alt Y>, so that you do not have to scan the drive again.
4. Name the Bin File. The Bin File naming convention is (FileName.bin).
5. Press <Alt F>to enter a file name. Then, press <Alt O>. (The program will exit).
6. Press <Alt Y>for Yes to write to floppy. 64 10.1.B. Save Found Components while working within the program
1. Press <Esc>, and the Systems Components Screen will appear.
2. Press <Alt C>to select Config.
3. Press <Alt S>to select Save Found Components. 65
4. Name the Bin File. The Bin File naming convention is (FileName.bin).
5. Press <Alt F>to enter a file name. Then, press <Alt O>.
6. Press <Alt Y>for Yes to write to floppy.
7. Press <Alt A>to select Analyze Found Components.
(Continue working within File Recovery Tree, Chapter 6; or Boot Partition Repair, Chapter 7.) 66 10.2 Load Found Components from the BIN File
There are 2 ways to Load Found Components to the Bin File: While entering the program or while working within the program. If you are trying to Reload the Bin File while working within the program go to 10.2.B. Load Found Components while working within the program.
10.2.A. Load Found Components while entering the program
1. Press <Alt C>to continue into the program.
4. Using your <arrow keys >, select the drive to be recovered. Then, press <Alt O>or <Enter>.
4. Select File Recovery Tree or Boot Partition Repair by using your <arrow key >. Then, press <Enter>(Shortcut: Hold down your <Alt>key and press the <red letter>). 67 Once the System Components Search screen has appeared continue by starting at Step 2, 5.2.B., Load Found Components while working within the program (Ignore Step 1 if you have started from 5.2.A. Load Found Components while entering the program).
10.2.B. Load Found Components while working within the program
1. Press <Esc>to access the System Components Search screen.
5. Press <Alt C>to select Config.
3. Press <Alt L>to select Load Found Components.
68
4. <Tab>to highlight the Saved BIN File, and then press <Enter>.
5. Press <Alt A>to select Analyze Found Components, and then press <Enter>.
(Continue working within File Recovery Tree, Chapter 6; or Boot Partition Repair, Chapter 7.) 69 Chapter 11 FAQ (frequently asked questions)
11.1 Does RecoverSoft Media Tools Professional recover from viruses? / p.70 11.2 Does RecoverSoft Media Tools Professional recognize USB? / p.70 11.3 Does RecoverSoft Media Tools Professional recover from RAID? / p.70 11.4 Does RecoverSoft Media Tools Professional recover from SATA drives? / p.70
11.1 Does RecoverSoft Media Tools Professional recover from viruses?
INVALID DRIVE SPECIFICATION or MISSING OPERATING SYSTEM
YES. If you have one of these error messages when booting your system, a virus has probably infected the Boot Sector and Partition Table, while leaving the rest of your file system intact. Power up Boot Partition Repair or File Recovery Tree, let it make the necessary repairs, and then go get your directories and files.
11.2 Does RecoverSoft Media Tools Professional recognize USB?
YES. When booting the software you can choose to load USB drivers.
11.3 Does RecoverSoft Media Tools Professional recover from RAID?
YES. If the full capacity of the RAID appears within the Drive Geometry box below RecoverSoft Media Tools Professional can work. The drive will always appear as BIOS HDD. If the RAID appears as a 8.2GB it will not work. Refer to the Data Recovery Services button at the beginning of the program to call us for further solutions.
11.4 Does RecoverSoft Media Tools Professional recover from SATA drives?
YES. To recover data from a Serial ATA Drive, you will need to get the Serial ATA-IDE/ATAPI Converter from http://www.cabledepot.com (1-800-343-4597 toll free or 1-770-564-2323) for approximately $50.00 Part Number: SATA-ATAPI 70 Chapter 12 Problem Solving
12.1 Problem Launching the Program / p.71 12.2 Program Freezes while using it / p.72 12.3 File System not Displayed (in Select File System screen) / p.72 12.4 No Valid File System Found / p.72 12.5 File cannot be Located / p.73 12.6 Cannot Locate the Root Directory / p.73
12.1 Problem Launching the Program?
If your desktop or laptop computer system hangs while booting, follow the directions below:
1. Try using a Windows 95/98 boot diskette instead of letting the program boot automatically. At the DOS prompt (A:\), type: MTL(space)-F.
12.2 Program Freezes while using it?
If the computer freezes while using one of the functions within the program, reboot the system. You will automatically be taken back into the program. Then, press <ALT-X>to exit the program to the DOS prompt (A:\). At the DOS prompt, type: MTL(space)-F. This will restart the program in a more conservative manner, which should keep the program from freezing in the future.
12.3 File System not Displayed (in Select File System screen)?
1. At any point within the program, press <Alt X>to Exit. Then, press <Alt Y>to select Yes.
Make sure you save the found components from the scan to a file on the Media Tools Professional floppy diskette, if you have not already done so. Refer to: Chapter 10, Save/Load Found Components.
2. You should be at a DOS prompt (A:\). At the DOS prompt, type: MTL(space)-P and press <Enter>.
3. Upon entering the program, Load Found Components from the Bin File (See Chapter 10.2.A, Load Found Components while entering the program).
4. At the Select File System screen, you should see all possible file systems found during the System Component Search, even the invalid file systems. Choose a file system and then press <Alt O>to select OK.
The color coding system to verify if your files and directories are valid is not applicable for file systems that previously did not appear in the Select File System Screen, which now do because of using MTL(space)P.
12.4 No Valid File System Found?
71
No Valid System Found?: If NO Valid File System was found, exit File Recovery Tree or Boot Partition Repair. Then, enter the Media Editor and do the following: Chapter 8.2, Mount the File System within the Media Editor; and Chapter 8.3, Recover Files and Directories Automatically.
If TREEing the file system through the Media Editor does not work, this indicates severe damage to the file system.
1. Press <Alt O>for <OK>, and then <Esc>.
2. Press <Alt E>for <Media Editor>.
3. Follow the step-by-step directions in Ch.8, Media Editor, for:
Mounting the file system (step-by-step directions, Ch 8.2) Automatically Recovering Files and Directories, Ch 8.3)
12.5 File cannot be Located?
Use the Menus to look for and filter specific files within the File Recovery Tree operation (See Chapter 6.5, Use the Menus to look for and filter specific files). Pay close attention to the examples given.
12.6 Cannot locate the Root Directory?
72 Scenario 1: If you know that your Root Directory does not exist, then press <No>. The program will automatically create a Root Directory with the information available. The results will appear as Found within the File and Directory Structure Tree (now, return to File Recovery Tree or Boot Partition Repair section within the manual).
Scenario 2: If you are not sure if the Root Directory is intact, then press <Yes>.
Then, use the <arrow keys>to move up and down until you find what looks like the Root Directory. The Root Directory typically contains folders such as Windows, My Documents and files such as IO.SYS or MSDOS.SYS. Once you have located the Root Directory, press <Alt S> for <Select>and the program will redirect you to the Select File System window.
Scenario 3: If you could not locate the Root Directory in Scenario 2, then press <Cancel>. The program will automatically create a Root Directory. The results will appear as Found within the File and Directory Structure Tree (now, return to File Recovery Tree or Boot Partition Repair section within the manual). 73 Chapter 13 Advanced Data Recovery and Computer Forensic Procedures
13.1 Advanced User Set-up Screen - <Ctrl S>/ p.74 13.2 RAID Recovery / p.75 13.3 MD5 Hash Mark / p.75 13.4 Compression on the Fly / p.76 13.5 File System Types / p.77
13.1 Advanced User Setup Screen - <Ctrl S>
Mechanically Failing Drives need Reverse-Clone, a function from within RecoverSoft Media Tools Professional, to extract raw data before the drive totally fails. It is necessary to Reverse-Clone mechanically failing drives in IDE or SCSI Access (see Chapter 5.2 Reverse Clone (mechanically failing drives).
When you are encounter sector read errors, you need to Reverse-Clone your drive. If you encounter sector read errors while using Reverse-Clone, you need to pause the program by pressing <Ctrl S>to change the Timeouts and Read Parameters within the User Setup window. This helps you to communicate with the drive to extract data in bad sectors (see notes below).
Tip: Press <Ctrl S>: at any time, from anywhere in the program, to access this window. This is the Control Center for working with Mechanically Failing media, meaning you will refer to it often to make changes (such as changing the Timeouts variables or the Read Parameters).
Shortcut: When a RED letter is highlighted within any screen, this indicates a shortcut can be used. For example, if you look at the File Recovery Tree screen above, notice that the letters A, R, S, and D are in red. Hold down your <Alt>key and press the <red letter>.
Drive Access Methods (Advanced explanation): How RecoverSoft Media Tools Professional addresses and communicates with any drive (see Ch.4.2, Select Drive for details).
Timeouts and Read Parameters
Increasing the Timeouts variable is sometimes the only change needed to communicate with the 74 drive effectively. Increase the IDE Devices or SCSI Devices at 250,000ms. If this does not work, the next step would be to change the Process Delay within Read Parameters. Changing the Read Parameters is another method to effectively communicate with the drive. Increase the Process Delay at 50ms. If this does not read the drive, increase the Process Delay to 100ms. If you can read the drive, every few minutes accelerate the process by decreasing the Process Delay in increments of 5ms. This gives you the greatest control combined with maximum speed in cloning your data. If you cannot read the drive, the next step would be to change the Read Retries within Read Parameters.
Changing the Read Retries within Read Parameters gives the program more chances to read the damaged sector before moving on to the next sector. Increase the Read Retries to 50. If you cannot be read the drive, decrease the Read Retries to 0. This is called Skip Mode, meaning the program will not attempt any Read Retries.
13.2 RAID Recovery
If the full capacity of the RAID appears within the Drive Geometry box below RecoverSoft Media Tools Professional can work. The drive will always appear as BIOS HDD. If the RAID appears as a 8.2GB it will not work. Refer to the Data Recovery Services button at the beginning of the program call us for further options.
13.3 MD5 Hash Mark (Message Digest 5)
Most all processes that are performed in the program create a report automatically. Each report records a MD5 fingerprint.
Developed in 1994 by Professor Ronald L. Rivest of MIT, MD5 (Message Digest 5) is a one-way hash algorithm that takes any length of binary data and produces a 128 bit "fingerprint" or "message digest". This fingerprint is "non-reversible". In other words, it is impossible to compute the binary data based on the fingerprint. This means someone cannot figure out your data based on its MD5 fingerprint. Every time you run the MD5 hash algorithm on the binary data, you should get the exact same fingerprint. If you get a different fingerprint, then the binary data has been changed.
75 MD5 is an industry standard in the world of forensics. As an example, it is imperative that any copy (Clone) of the media is identical to the original media. The program records the MD5 fingerprint in a report, and enables you to compare the fingerprint against any copy of the original media to show that it is an exact copy. To date, the MD5 standard has not been cracked and is accepted in our legal system as a valid authentication process.
13.4 Compression on the Fly
Compression on the Fly is used in two different formats within RecoverSoft Media Tools Professional:
1. To compress files to be recovered in ZIP format.
2. To compress an Image when using the Cycle-Image operation. Computer Forensics requires no Compression on the Fly.
76
13.5 File System Types
Hex Value Type Description 00h Unused Empty 01h FAT 12 DOS 12-bit FAT 02h XenixR XENIX / 03h XenixU XENIX /usr 04h FAT 16 DOS 16-bit FAT <32M 05h Extend DOS Extended 06h BigDOS DOS 16-bit FAT >=32M 07h NTFS HPFS / NTFS 08h AIXbt AIX boot or SplitDrive 09h AIXdt AIX data or Coherent 0ah OS/2BM OS/2 Boot Manager 0bh FAT32 Win95 FAT32 0ch FAT32X Win95 FAT32 (LBA) 0eh FAT16X Win95 FAT16 (LBA) 0fh Win95X Win95 Extended (LBA) 10h OPUS OPUS 11h FAT12h Hidden DOS FAT12 12h Compaq Compaq diagnostics 14h FAT16h Hidden DOS FAT16 16h FAT16h Hidden DOS FAT16 (big) 17h NTFSh Hidden HPFS/NTFS 18h AstWin AST Windows swapfile 24h NecDOS NEC DOS 3ch PQrcv PartitionMagic recovery 40h Venix Venix 80286 41h DR_Mnx Linux/MINIX (sharing disk with DRDOS) 42h DR_SFS SFS or Linux swap (sharing disk with DRDOS) 43h DR_Lin Linux native (sharing disk with DRDOS) 50h DskMng DM (disk manager) 51h Nvl1 DM6 Aux1 (or Novell) 52h CP/M CP/M or Microport SysV/AT 53h DMAux3 DM6 Aux3 54h DM6 DM6 55h EzDrv EZ-Drive (disk manager) 56h GldnBw Golden Bow (disk manager) 5ch Priam Priam Edisk (disk manager) 61h SpdStr SpeedStor 61h HURD GNU HURD or Mach or Sys V/386 (such as ISC UNIX) 61h DSKSec DiskSecure Multi-Boot 64h Nvl286 Novell Netware 286 65h Nvl386 Novell Netware 386 75h PC/IX PC/IX 77h QNX4.x QNX4.x 78h QNX4x2 QNX4.x 2nd part 79h QNX4x3 QNX4.x 3rd part 80h Mnx14a MINIX until 1.4a 81h MnxOld MINIX / old Linux 82h LinSwp Linux swap 83h Linux Linux native 84h OS/2h OS/2 hidden C: drive 85h LinExt Linux extended 77 86h NTFSv NTFS volume set 87h NTFSV NTFS volume set Hex Value Type Description (Continued)
93h Ameoba Amoeba 94h AmbBBT Amoeba BBT a0h IBMPad IBM Thinkpad hibernation a5h BSD386 BSD/386 a6h OpnBSD OpenBSD a7h NeXT NeXTSTEP 486 b7h BSDI BSDI fs b8h BSDIsw BSDI swap c1h DRDOS1 DRDOS/sec (FAT-12) c4h DRDOS2 DRDOS/sec (FAT-16, <32M) c6h DRDOS3 DRDOS/sec (FAT-16, >=32M) c7h Syrinx Syrinx dbh CP/M CP/M or Concurrent CP/M or Concurrent DOS or CTOS e1h SpdStr DOS access or SpeedStor 12-bit FAT extended partition e3h DOS RO DOS R/O or SpeedStor e4h SpdS16 SpeedStor 16-bit FAT extended partition <1024 cyl. Ebh BeOS BeOS fs f1h SpdStr SpeedStor f2h DOS3.3 DOS 3.3+secondary f4h SpdStr SpeedStor large partition feh SpdStr SpeedStor >1024 cyl. or LANstep ffh XnxBBT Xenix Bad Block Table 78 RecoverSoft Media Tools Professional License Agreement
READ THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT CAREFULLY BEFORE RUNNING THE COMPUTER SOFTWARE HEREIN, AND THE ACCOMPANYING USER DOCUMENTATION (THE "PROGRAM"). THE PROGRAM IS COPYRIGHTED AND LICENSED (NOT SOLD). BY RUNNING THE PROGRAM, YOU ARE ACCEPTING AND AGREEING TO THE TERMS OF THIS LICENSE AGREEMENT. IF YOU ARE NOT WILLING TO BE BOUND BY THE TERMS OF THIS LICENSE AGREEMENT, YOU SHOULD PROMPTLY DELETE THE SOFTWARE AND ACCOMPANYING FILES. THIS LICENSE AGREEMENT REPRESENTS THE ENTIRE AGREEMENT CONCERNING THE PROGRAM BETWEEN YOU AND PROSOFT ENGINEERING, INC. (REFERRED TO AS "LICENSOR"), AND IT SUPERSEDES ANY PRIOR PROPOSAL, REPRESENTATION, OR UNDERSTANDING BETWEEN THE PARTIES.
1. License Grant. Licensor hereby grants to you, and you accept, a nonexclusive license to use the Program Diskettes and the computer programs contained therein in machine-readable, object code form only (collectively referred to as the "Software"), and the accompanying User Documentation, only as authorized in this License Agreement. You agree that you may not reverse assemble, reverse compile, or otherwise translate the Software.
2. Licensor's Rights. You acknowledge and agree that the Software and the User's Manual are proprietary products of Licensor protected under U.S. and International copyright law. You further acknowledge and agree that all right, title, and interest in and to the Program, including associated intellectual property rights, are and shall remain with Licensor. This License Agreement does not convey to you an interest in or to the Program, but only a limited right of use revocable in accordance with the terms of this License Agreement.
3. License Fees. The license fees paid by you are paid in consideration of the licenses granted under this License Agreement. If you received the software for demonstration purposes and/or no fee was charged, this in no way effects the terms of this agreement.
4. Term. This License Agreement is effective upon your receiving the software, either on disk or by electronic transfer of any type and shall continue until all copies of the software have been returned to Licensor. You may terminate this License Agreement at any time by returning the Program and all copies thereof and extracts therefrom. Licensor may terminate this License Agreement upon the breach by you of any term hereof. Upon such termination by Licensor, you agree to return to Licensor the Program and all copies and portions thereof.
5. No Warranty. The software is supplied without any warranty. THE PROGRAM, AND THE SOFTWARE CONTAINED THEREIN, ARE LICENSED "AS IS," AND LICENSOR DISCLAIMS ANY AND ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
6. Limitation of Liability. Licensor's cumulative liability to you or any other party for any loss or damages resulting from any claims, demands, or actions arising out of or relating to this Agreement shall not exceed the license fee paid to Licensor for the use of the Program. In no event shall Licensor be liable for any indirect, incidental, consequential, special, or exemplary damages or lost profits, even if Licensor has been advised of the possibility of such damages. SOME STATES DO NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU.
7. Trademark. Media Tools and RecoverSoft Media Tools Professional are registered trademarks of Licensor. No right, license, or interest to such trademark is granted 79 hereunder, and you agree that no such right, license, or interest shall be asserted by you with respect to such trademark.
8. Governing Law. This License Agreement shall be construed and governed in accordance with the laws of the State of CALIFORNIA USA.
9. Costs of Litigation. If any action is brought by either party to this License Agreement against the other party regarding the subject matter hereof, the prevailing party shall be entitled to recover, in addition to any other relief granted, reasonable attorney fees and expenses of litigation.
10. Severability. Should any term of this License Agreement be declared void or unenforceable by any court of competent jurisdiction, such declaration shall have no effect on the remaining terms hereof.
11. No Waiver. The failure of either party to enforce any rights granted hereunder or to take action against the other party in the event of any breach hereunder shall not be deemed a waiver by that party as to subsequent enforcement of rights or subsequent actions in the event of future breaches.
2005 Prosoft Engineering, Inc. 2002 2005 ACR Data Recovery, Inc. 2000 2001 ACR Data Recovery Software, Inc. 1994 1999 Atlanta Computer Resources, Inc. All rights reserved.