Zero Assumption Recovery (ZAR) version 6.3 Boot-Based Tools (ZARBBT) USER'S MANUAL Copyright (C) Alexey V. Gubin, 1999-2002 *** CAUTION! *** ZAR Boot-Based Tools are extremelly powerful, and may cause MAJOR DAMAGE when used improperly. Please read the manual completely before doing anything. *** CONTENTS *** This manual covers the following topics: 1. ZAR Boot-Based Tools overview. 2. Installation instructions. 3. List of tools, including a description and configuration requirements. 4. "Howto" for common usage pattern - disk-to-disk copying 5. List of all boot-time messages. *** PURPOSE AND CONCEPTS *** ZAR Boot-Based Tools (BBT) are all designed to work independently of an operating system. They will still allow repairs even if MS DOS boot floppy refuses to start. You can of course use these tools as a part of a normal recovery process, with no extreme conditions. BBT allow you to wipe the data on disk (i.e. write zeros to it), perform a disk-to-disk copy in cases when the disk is physically near-to-fail, or clear the MBR if its contents are corrupt. There are some cases when corrupt MBR prevents DOS (and any other Microsoft operation system) from booting, even from the floppy disk. The only solution in such a case is to completely bypass DOS and work directly with the disk, like BBT do. *** BOOT DISKETTE CREATION TOOL *** Floppy creation tool (ZARBBT.EXE) writes the appropriate tool to the boot sector of a floppy disk you provide. The floppy must be formatted and blank (no files). The process is quite simple: just run ZARBBT.EXE, select a floppy drive from list, then select a tool from list and it is done. CAUTION: Installation of a boot-startable code modifies some system areas of a floppy disk (including but may be not limited to File Allocation Tables) in inadequate manner, so copying any file to the floppy will result in boot-startable code corruption. Additionally, resulting floppy will be considered damaged by disk checking software, such as ScanDisk or Norton Disk Doctor. You must not try to run such tools to fix the floppy, for this will lead to boot-startable code corruption. After the floppy has been written, it is ready for use. Make sure the configuration requirements for a particular tool are fullfilled, check that your BIOS is configured to first attempt to boot from floppy disk, insert the floppy in drive and reboot. *** LIST OF TOOLS *** *** ZAR Disk Eraser *** Writes zeros to all sectors on disk, DESTROYING ALL DATA previously on the disk. The intended use is a disk preparation to use as a copy target with ZAR Disk-To-Disk copier. Configuration requirements: 1. Target disk should be the ONLY device BIOS recognizes as a hard drive. 2. Partition table on the disk must be empty (deleting all partitions with FDISK is sufficient). *** ZAR Disk-To-Disk Copier *** Copies first hard disk in a system to second hard disk sector-by-sector, skipping sectors which produce an error on read. No useful data can be ever overwritten with this tool (see notes below). It can be used to create a drive copy to operate on (istead of the original damaged drive), including cases when a damaged drive has physically bad sectors. Configuration requirements: 1. There must be exactly two disks in a system. 2. Of these two, source disk must be the first BIOS device (ID 0x80) and target must be installed as the second BIOS device (ID 0x81). 3. Target disk must be completely zero-filled beforehand. Important notes: 1. Should some non-zero data be discovered on target, copy process will be immediately aborted, thus ensuring that no data will be overwritten (even in case of misplaced target and source disks) 2. Target disk can be smaller than source disk. In such a case, copy process is considered completed as soon as target disk is filled. However, you will be warned should this condition be detected. 3. If read error occurs on a source disk, zeros are written to a corresponding sector on target. Number of read errors is displayed during copy. 4. If write error occurs on a target disk, these data are merely lost, and copy process continues WITHOUT ANY NOTIFICATION. Number of write errors is not shown. So make sure your target drive works fine before you use it. (Note that Disk Eraser tool reports the number of write errors, if you had used it for target preparation). *** ZAR MBR Eraser *** Erases Master Boot Record (MBR). There are several possible reasons to do this. Most common are: 1. You need to delete all partitioning information from disk, but FDISK fails to perform this for some reason. 2. MBR is damaged, and its damage does not allow you to boot even from a DOS floppy disk (symptoms: when you insert a boot floppy and the hard disk in question is properly attached, loading stops after "Verifying DMI Pool Data..." message or after PCI devices listing, with no error messages shown. However, when you disconnect the hard disk, DOS boots normally). Two options exist (you will be prompted during boot-time operation): either wipe the MBR completely (including all partition information) or modify the MBR so it will not be recognized by BIOS/DOS as a valid boot sector, thus allowing you to boot at least with DOS and perform repairs (in this mode, only 55AAh signature is removed from MBR). Configuration requirements: 1. Target disk should be the ONLY device BIOS recognizes as a hard drive. *** COMMON USAGE PATTERNS *** Problem: Hard disk containing important data is worn out and there are bad sectors on it (including in a system areas). Hint: It would be much easier (and much safer) to work with a physically functional copy of the original disk. Proposed actions: 1. Get another disk, of equal or greater size. 2. Zero-fill it. 3. Copy faulty disk to this new disk. 4. Run data-recovery tools against the new disk, thus mitigating the risk of further damaging the original. To do this: 1. Prepare 2 empty formatted floppies and run ZARBBT in order to write two tools onto them: Disk Eraser and Disk-to-disk Copier. Mark the flopiies by writing big red labels on them, so noone uses these floppies later without reformatting. 2. Make sure you have correct boot order set in BIOS setup, allowing you to boot from floppies first. 3. Get another hard disk (borrow from someone if you have no spare disk readily available). Mark it clearly as a "TARGET" disk (I myself do this by writing on a disk itself with a red marker). Having disks marked distinctly is important, as it reduces a risk of messing everything up. Backup all data from it (it will be completely overwritten in process). Delete all partitions on it using FDISK. 4. Turn off the system. Don't forget to turn off 5V standby power as well. If you are unsure about this, simply pull the power cord out of the outlet or UPS - this will do. Disconnect the faulty drive and remove it from the system. Mark it clearly as a "FAULTY" disk (I do it with a marker again). Put the "FAULTY" disk away. 5. Disconnect all IDE cables in a system. Insert "TARGET" disk into the system and plug it in with a cable to a Secondary IDE channel. Check that "FAULTY" disk still lies away where you put it. 6. Insert ZAR Disk Eraser floppy and turn on the power. Enter BIOS setup and perform a disk autodetection. It should detect target disk as either Secondary Master or Secondary Slave. Then, proceed with zero-filling the "TARGET" disk. Note number of errors reported during process - normally, it must be zero. 10 errors or so are still tolerable. When drive is erased (SYSTEM HALTED message appears), wait ten seconds, then turn off the power. 7. Connect the "FAULTY" disk to a Primary IDE channel. Insert ZAR Disk-to-Disk Copier floppy and turn on the power. Enter BIOS and repeat autodetection. A new drive ("FAULTY" one) should appear on Primary IDE channel. Exit BIOS Setup (don't forget to save the changes), and proceed to boot off the floppy disk. 8. If you have everything set up correctly, the copy will start (as soon as you confirm it). When it is done, note the number of read errors reported by a copier. Write it down for further reference. Then, power down the system, then remove "FAULTY" HDD and put it away. You can now run data recovery tools on a copy of a disk. *** LIST OF ALL POSSIBLE BOOT-TIME PROCESSING MESSAGES *** Message list is in the following format: -------------------------------------------------------------------------------- Message -------------------------------------------------------------------------------- Tool: [name of a tool producing this message] Type: [message class] Explanation. Proposed action(s). -------------------------------------------------------------------------------- SYSTEM HALTED. Please wait at least 10 seconds for the disk to flush caches... -------------------------------------------------------------------------------- Tool: Multiple tools Type: Informative Menas just what it says. The processing is either completed or aborted due to an error. The error message, if any, is shown just above the "System Halted" message. On most modern disks you should wait some time for a disk to flush its onboard write-back cache. System restart must be performed with a Reset button or power cycle (Ctrl+Alt+Del will not work). Wait 10 seconds, then press Reset button. -------------------------------------------------------------------------------- Disk 0x8X - number of sectors YYYYYYYY -------------------------------------------------------------------------------- Tool: Multiple tools Type: Informative Indicates a disk size. 0x8X is a disk BIOS ID (with 0x80 being first HDD, 0x81 - second HDD), and YYYYYYYY is a total number of sectors on disk, hexadecimal. No action required. -------------------------------------------------------------------------------- Processing sector XXXXXXXX, YYYYYYYY error(s) -------------------------------------------------------------------------------- Tool: Multiple tools Type: Informative Indicates a progress of current operation. XXXXXXXX is a hexadecimal number of sector currently being processed, and YYYYYYYY is a hexadecimal number of errors encountered so far. No action required. -------------------------------------------------------------------------------- Must be exactly X drive(s) in system, actually found Y drive(s) -------------------------------------------------------------------------------- Tool: Multiple tools Type: Error Actual disk configuration violates the configuration requirements for the particular tool. Review the requirements and physically reconfigure hardware to match them. Basically, remove all unnecessary storage devices from the system. -------------------------------------------------------------------------------- If you want to continue please type: "I confirm this" (case matters): -------------------------------------------------------------------------------- Tool: Multiple tools Type: Confirmation request Program is requesting a confirmation before proceeding with some (not necessarily destructive) operation. The confirmation is complicated to avoid accidental activation of any destructive features. Review previous program output to ensure you are doing everything correctly. Then type "I confirm this" without quotes. Any typing error will result in immediate execution termination. Backspace is not allowed. -------------------------------------------------------------------------------- Disk is of unsupported size. -------------------------------------------------------------------------------- Tool: Multiple tools Type: Error Disk exceeds 128Gb in capacity. Such disks are not supported in current version. Report a bug if you wish. -------------------------------------------------------------------------------- Generic Int13x call error. -------------------------------------------------------------------------------- Tool: Multiple tools Type: Error Int 13h Extensions BIOS unexpectedly reported an error (during some basic function call, which should be always possible and successful). Check hardware. A disk may be completely faulty. If you have older motherboard, retry on another system (with a newer one). If none of this applies, contact me. -------------------------------------------------------------------------------- Reported disk size is 0. -------------------------------------------------------------------------------- Tool: Multiple tools Type: Error BIOS reported a disk as having a zero size. This is out of a normal order of things. Check hardware. A disk may be completely faulty. If you have older motherboard, retry on another system (with a newer one). If none of this applies, contact me. -------------------------------------------------------------------------------- Non-zero data discovered on target, aborting... -------------------------------------------------------------------------------- Tool: Disk-to-disk Copier Type: Error Copy process was aborted to prevent a data loss on a target disk. See configuration requirements for disk copier tool. Check if your disk subsystem is set up correctly (i.e. SOURCE drive goes first). Zero-fill the target drive (remember to disconnect source beforehand). -------------------------------------------------------------------------------- WARNING: Target disk is smaller than source disk. -------------------------------------------------------------------------------- Tool: Disk-to-disk Copier Type: Confirmation request It was discovered that you are about to copy larger drive onto the smaller one. You can still proceed if this is what you want. If it is OK to perform a partial copy, just type "I confirm this" (no quotes, case matters). Otherwise check if your disk subsystem is set up correctly (i.e. SOURCE drive goes first). -------------------------------------------------------------------------------- Partition table must be empty on a disk to be erased. -------------------------------------------------------------------------------- Tool: Disk Eraser Type: Error It was discovered that a drive still has some data on it, and a erase process was aborted. Check if you are erasing a correct drive. Delete all partitions from it (either using FDISK or with ZAR MBR Eraser tool, Complete Wipe mode). -------------------------------------------------------------------------------- Operation completed (no errors reported) -------------------------------------------------------------------------------- Tool: MBR Eraser Type: Informative Indicates that disk write was performed successfully. No action required. -------------------------------------------------------------------------------- Operation completed (disk reports error) -------------------------------------------------------------------------------- Tool: MBR Eraser Type: Warning Disk reported an error when asked to write to a Master Boot Record. The sector is (probably) unchanged and/or in uncertain state. This usually indicates some problems with the medium. Check if disk is physically functional. If it is not, copy it sector-by-sector to another disk and continue recovery with a physically functional copy. -------------------------------------------------------------------------------- Invalid input -------------------------------------------------------------------------------- Tool: MBR Eraser Type: Error You entered an invalid value when asked to choose the operation mode. Restart the system (either by Reset button or by cycling power), then retry.