Quick start

1. Verify all items in the Before starting checklist .

2. Preliminary Setup screen, which opens when you launch the program, usually does not require any interaction, just click Proceed button.

3. A list of disks in system will be displayed. Select a physical disk you want recovered, click Proceed button.

4. List of known partitions will be displayed. select partition you want recovered, click Proceed button. If you don't see the partition of interest, click here.

Program starts the analysis in automatic mode once parition to work with is specified.

If you want more control over the recovery, you may want to use Advanced Mode instead.


Before starting checklist
Some conditions do exist which must be met to allow for a successful recovery. Make sure you aren't missing something:
1. Check that you have a known-good hard disk with enough free space on it.
WARNING: Never recover data to the damaged drive. Doing so will cause further filesystem damage. It is possible to recover data to a known-working partition on the same physical disk, but it does require special consideration.
2. Check that the system you are working on has the appropriate code pages installed in order to be able to read national-language symbols in file and directory names.
3. Make sure that you understand volume locations. That means you should have clear understanding of the following question: "where is the damaged volume located? what size it was?".
4. When working under Windows NT/2000/XP, you need administrative access to the computer in order to be able to access the disk(s) directly.


Preliminary setup

License information.

For a registered version this field is purely informational - it displays current registration information. "Order now" and "Enter code" buttons are only available in demo version and are related to the registration process.

Automatic update information.

This group controls automatic checking for the newer version. You need an internet connection for this feature to function. When auto update is enabled, program connects to the server and fetches lastest version information. To disable this behavior, clear the corresponding checkbox. To force new version check when auto update is disabled, click "Check now" button.

Interface language.

This option is used to switch between available languages. Effective immediately.


Physical disk selection

Physical disk selection tab

The list displays all hard disks found in the system. No specific ordering is enforced, but for purely IDE system one should expect the following order:
Motherboard integrated IDE controller:
1. Primary Master; 2. Primary Slave; 3. Secondary Master; 4. Secondary Slave
Additional IDE controller:
5. Primary Master; 6. Primary Slave; 7. Secondary Master; 8. Secondary Slave
For each hard disk, its capacity and physical geometry (if provided by the system) is shown.
You should select the appropriate hard disk and click "Proceed".

The option is available to load a raw image file. Raw image file is in fact a sector-by-sector disk copy stored in the file in plain (that is, no compression and no skipped sectors). To load image, click the appropriate button, then specify an image file to load. Note this option is only available if "Enable advanced mode prompt" is set in Options.


Partition selection

Partition selection tab

The list shows all the available partitions stored on the physical disk. Some partitions may be missing because system information about them is damaged beyond recognition.
The following parameters are shown for each partition found:
Filesystem type - displays partition type as recorded in Master Boot Sector. Actual volume type is not tested at this time.
Start at, Mb and Size, Mb - these values describe the location of volume on the physical disk.
Active - Can be "Yes" or "No". "Yes" indicates that partition is configured so that BIOS attempts to load the operating system from this partition when computer starts.
Type - Can be "Primary" or "Logical", which corresponds to the basic (old-style MBR) partition type. "Dynamic" parition type indicates a Windows 2000/XP dynamic disk listed in LDM (Logical Disk Management) database but without its corresponding entry in MBR. "Scan" type is used to indicate partitions found by scanning the disk, rather than by partition table analysis.
Label - Displays the volume label as recorded in a volume boot sector. Always "N/A" for NTFS volumes because NTFS does not store the volume label in the boot sector.

Checking boot sector validity

You can request a quick boot sector validity inspection for any listed partition. To do it, right-click the partition and select "Check boot sector".

Defining partition to scan manually.

In some cases MBR is corrupt or physically unreadable, and you need to define a partition configuration manually.
To do so, click "Manual" in partition selection tab. The following dialog box will appear:
If there was only one volume on the physical disk, select the appropriate option and hit "OK".
If there was more than one volume, you will need to perform some calculations.
1. Sum up sizes of all partitions preceding the one you need to recover. Keep in mind that 1Gb is 1024Mb (rather than 1000Mb). Subtract 50 Mb from the result and now you have a partition start location. If the result is negative, assume it is zero. Enter it into "Partition starts at" field.
2. Enter partition size + 100 Mb into "Partition size is" field.
3. Hit "OK".
Please be careful and double-check results you got. The -50 Mb at start and +100Mb at end are added to avoid possible errors due to Gb-to-Mb conversion and/or inexact partition positioning.
If you know exact partition start and size, you may want to switch units to "Sectors" and enter those values.

Partition table analysis results

During the partition analysis, filesystem control structures are examined and inconsistencies recorded. You can view the list of problems encountered during partition analysis by clicking "Details".

Scanning for missing volumes ("Scan" button) during Manual mode operation

Use this option when the volume you need to recover is not initially listed. For more information, see Searching for lost partitions.


Operating mode selection

IMPORTANT:
You will only be prompted to choose between Simple and Advanced modes if "Enable Advanced Mode" is enabled in Options . With this option disabled, program starts the analysis using Simple Mode automatically. If "Enable Advanced Mode" is set, you will be prompted choose between these two modes after a partition to analyze is selected.

Simple ("autopilot") Mode, which allows for automatic recovery. In Simple Mode, program asks no questions, but you can not interfere with a recovery process. Simple Mode is recommended for typical usage.
Advanced Mode, which gives you better control over the things program does. In Advanced Mode you are asked to confirm each step of the recovery. This does however require some technical skills and sometimes even some data recovery knowlege.


Data Identification

Data Identification tab

During this phase, ZAR scans the disk for fragments of filesystem metadata and data files. This information is then used in analysis. Bad sectors are also identified during the same scan pass.

"Number of objects found" table.

This table lists number of objects found on disk (by object type) and is provided for reference only.

Current analysis speed.

Shows current disk scan speed, measured at two-second intervals. This value will decrease sharply when bad sectors are encountered.

Estimated time left.

Shows estimation of a remaining time. The estimation is based average speed for entire elapsed scan time (note that "Current analysis speed" is based on a short-time history, providing in fact the "instant speed" reading).

Stop identification button.

Use it if for some reason you want to abort scan and continue analysis based on the partial disk information. Note: this requires thorough consideration, because missing data can affect analysis quality.


Filesystem type selection

Filesystem type selection tab

Once disk scan is complete, automatic detection of a filesystem type on the damaged volume is attempted. However, cases do exist when automatic detection fails. Example is a FAT32 volume accidentally reformatted to NTFS. In such a case there are two independent groups of filesystem structures - one for FAT32 and the other for NTFS - both of them being more or less valid. In such a case it is impossible to autodetect filesystem type because program does not know which of these two filesystems you want to recover. Generally, you should check that appropriate filesystem type is selected and adjust it if required.
If there were not enough filesystem structures found on disk to allow reconstruction using particular filesystem type, the corresponding option will be disabled (as shown on the screenshot above).

Please note that at this point of the analysis it is not required to know if a FAT filesystem is 32bit (FAT32) or 16bit (FAT16), you just need to choose between FAT and NTFS.


FRS size (NTFS only)

Most important NTFS control structure (Master File Table, MFT) is in fact a large array of equally sized blocks. These blocks are called File Record Segments (FRS).

Keep in mind: most common value of FRS size is 1024 bytes. It does not depend on cluster size (for 512 bytes per cluster FRS occupies two clusters, for 4096 bytes per cluster system stores four FRSes in one cluster).


Volume parameters
Locations of the files on volume are expressed in number of clusters, while the same locations on the physical disk should be expressed in sectors. During normal filesystem operation, number of sector containing file data is computed from the number of cluster by the following simple formula:
Sector = CF * Cluster + SS
where CF (Cluster Factor) is number of sectors per cluster and SS (Start Sector) is a sector number for cluster 0.
When volume is damaged, values of CF and SS are usually lost or corrupt, so they are determined statistically based on pattern scan results. Best matching values are listed in the table along with their corresponding relevance values. Additionaly, "Boot Sector" column indicates if a boot sector matching the parameter set was found on the disk.
In the above example, first parameter set is obviously good because it is three times more relevant than the second one (72.7% vs. 21.4%) and has a corresponding boot sector ("Good" mark in "Boot sector" column).

Specifying volume parameters manually.

In some cases it is impossible is to determine proper volume parameters, and the list would be empty. If you see nothing in the list, check scan area definition and filesystem type. If scan area is properly defined but program is still unable to detect volume paramters, the volume is usually damaged beyound any automatic repair. If you know a parameters set you may try to specify volume parameters manually. To do so, click "Manual", and enter volume start sector and number of sectors per cluster into appropriate fields.


FAT parameters (FAT only)

FAT parameters tab (FAT only)

File Allocation Table (FAT) is the main control structure on the FAT16/32 filesystem (in fact, filesystem is named FAT16/32 after the File Allocation Table). FAT keeps track of all the files on volume, recording where they are stored. Should the table become corrupted for some reason, files on the volume are no longer accessible because it is not known where they are stored. Implementations of FAT filesystem used in DOS and Windows keep two identical copies of the table to provide additional redundancy (for example, if a sector in one copy goes bad, backup copy can be used).
Once the area where FATs are stored is approximately located, ZAR scans this area in order to determine precise position of FAT copies, and ten most relevant variants are shown. For each probable FAT parameter set the following information is provided:
Start/Size, sectors - physical location of a first FAT copy on the disk.
Type - FAT type (can be either FAT16 or FAT32).
Volume Size, Mb - size of the volume described by FAT. It is useful to verify the size shown against the expected volume size.
Relevance - greater relevance means better parameter set.
Signatures field provides results of a FAT signature test. Each FAT copy starts with a specific well-known data sequence ("signature"). If both signatures were found where expected, "Both" is shown as test outcome. "Partial" means only one of two signatures was found, indicating that at least one FAT copy is (at least partially) damaged, and "Bad" status means no FAT signatures were found at all.
Boot Sector field indicates if a boot record matching the parameter set exists.

It is possible that no variants are displayed at all (table is empty). Usually this means FATs damaged beyond recognition. In such a case you should use "Manual" mode. Usual option is to choose "I want to continue assuming all FAT entries junk", unless you know the specific parameters.


MFT region assignment (NTFS only)

MFT region assignment phase is required to resolve issues associated with MFT fragmentation. Term "region" is used to describe single separate MFT fragment (it is used because "fragment" was already used for something else). This phase is fully automatic and you cannot interfere with the process. Assignment results are provided for reference only. Typical NTFS volume has up to 20 MFT regions, one of them being substantially larger than others. Percentage of unassigned MFT regions is also displayed. Some entries are always left unassigned, so one should not expect displayed value to be zero during normal operation. In general use, up to 5% unassigned entries should be considered acceptable.

Configuration options related to assignment process are "Exclude small MFT fragments from region analysis" and "Ignore gaps in MFT up to X records". We recommend using the default settings.


File copying

Once directory tree is rebuilt and file information collected and sorted, a directory tree is shown so you can select files to copy them from the damaged volume. You should browse through the tree to locate files and/or directories of interest, select them and select "Recover files".

If you see that file and/or directory names are garbled, check code page settings.


Duplicate files during copying
Sometimes you will see a program reporting duplicate files (that is two files with the same name in the same directory). Such a situation cannot occur during the normal filesystem operation and is usually a result of some corruption.
There are two widespread situations where filename conflicts arise:
1. Directory tree corruption may result in inexact reconstruction. This may cause some files to be placed improperly, thus resulting in filename conflict.
2. Erased files, when restored, may cause filename conflicts with the existing files in a directory.
To avoid the possibility of incomplete recovery, we suggest you use the option to add numbers to the conflicting file names, thus saving all possible data. Otherwise some important (or more current version of) file may be skipped during recovery.


Code Page setup

When you use file names in national language, filesystem stores them using a specific encoding method (the encoding rule is commonly refereed to as "Code Page"). FAT uses two different code pages (one for short names, the other for long names). It is however impossible to automatically determine which code page filesystem was using if normal filesystem operation is disrupted. Program tries to "guess" correct code page, and in most cases autodetection feature will work correctly.
You need to adjust code pages manually only if you see many garbled national-language file names. To do so, click "Code Pages" button once directory displayed. Keep in mind that file names may be garbled due to filesystem damage, rather than due to invalid code page setting.


Configuring options

CAUTION: When you run ZAR for a first time, options are preset to a default values which allow for optimal performance in common cases. Incorrect manual configuration may lead to recovery failures.
The following options are available:

Enable Advanced Mode

When enabled, you will be prompted to choose between Simple and Advanced operation modes after selecting the partition to analyse. When disabled, program automatically starts a Simple Mode analysis once partition to work on is defined.

Recover erased files

Controls if ZAR will attempt recovery of a files that were correctly erased prior to disk crash. Enable for mass undeletions, e.g. after a virus attack.

No retries on bad sectors

When enabled, bad sectors are considered "permanent". Once a sector read operation fails, bad sector number is stored. Subsequent attempts to read this sector will fail without actually attempting to read the sector, thus dramatically increasing analysis speed in some situations.

Automatically save state in Simple Mode

Allows autosave after each recovery stage in Simple Mode. Recommened setting is "Enabled". Final state (file and directory tree created during final processing stage) is not saved automatically. Save files are located under AUTOSAVE subdirectory of a directory where ZAR is installed (typically C:\Program Files\ZAR\AUTOSAVE).

Analyze dynamic disks

With this setting enabled, program automatically attempts to analyze disk structures specific to Windows 2000 and XP during partition table analysis. It is only useful to disable this option when the disk has some physical damage that prevents reading of the LDM database.

"Volume parameters analysis" group

Two parameter analysis methods are available - faster vs. slower method. Faster method uses lot of memory. Maximum memory usage observed during tests on actual disks was around 120Mb.
When "Limit to" option is enabled, volume parameters will be considered invalid if volume start sector deviates too much from the start of disk region you asked to analyze. This option can significantly increase parameter determination speed when enabled. It is safe to use when partition table is correct. When you are specifying a partition location manually with this option enabled, keep in mind that recovery will fail should you specify too broad area to analyze.

"MFT fragmentation analysis" group

Ignore gaps in MFT up to X record(s) option allows better MFT reconstruction if some records are damaged (usually due to bad sectors) when enabled. Allowing very long gaps can cause recovery errors on fragmented MFT, because two different MFT fragments would be errorneously considered single large fragment.

Additionally Ignore small MFT fragments option, when enabled, dramatically reduces memory usage on heavily fragmented volumes. This can however impact directory tree reconstruction.

"Miscellaneous" group

Skip X sector(s) after read error option is useful when disk surface is physically bad. Read operation attempted on the bad sector usually takes a long time to complete. Setting this option to something like 16 accelerates disk scan, because bad sectors usually tend to group close tougether.

Maximum number of passes on FAT option controls iterative process is used to reconstruct a directory tree on FAT filesystem. Usually, it takes two or three passes for the algorithm to converge. It is however possible that algorithm would fail to achieve a consistent solution (e.g. when there is a directly contradicting data on volume). This option specifies an iteration limit to avoid possible infinite looping. Once the limit is reached, directory tree refining stops.

"Logging" control group.

Log file is used to store information about analysis progress. This information is required when volume is severely damaged and automatic reconstruction fails or for troubleshooting program problems. To use logging feature, you need to specify a file name to write log to and detail level ("Log level") of the events to record. Always set log level to "Normal" if you use this feature, unless specifically asked for a "Debug" log by technical support. Please note that a log file can grow quite large, depending on the number of files damaged partition contains.


Saving and restoring program state

Saving

Saving is pretty straightforward - you should click "Save state" button in main window. Note that save files can be quite large, especially when final state (including directory tree and file information) is saved. In Simple Mode, program state is saved automatically unless this option is disabled (see Configuring Options).

Restoring (registered version only)

You should select the appropriate physical disk before restoring ("Restore State" button is disabled unless phyiscal disk is successfully opened or image file is loaded).
After the file is opened, you will be asked if you want to continue in Simple or Advanced mode and about the amount of data you want to restore. The screenshot below shows all possible options, some of them may not be available depending on the amount of data stored in the save file.
The default setting is to restart in Simple Mode and use all data available in the save file.


Boot sector validity checking

This operation is available during partition selection. To request a boot sector validity check, right click the partiton and select the appropriate option. Please note that you might need some familiarity with the filesystem structures to draw conclusions from the data program provides. If you are not familiar with those structures, you still may check for the red marks in the analysis results.
Program reviews system parameters as recorded in boot sector and checks them against some common limits and invariants. If some of the limits are exceeded, corresponding parameters are marked red.
For FAT filesystems, boot sectors and FATs are examined. For NTFS, only boot sector is examined.
Examples
Valid NTFS boot sector | Boot sector of a damaged FAT32 volume.


Searching for lost partitions
This function is available during Partition Selection phase of the recovery. Using this function one can attempt to locate volumes otherwise lost. For example, when partition table is damaged and no volumes are visible, "scan" function can reveal the volumes still on disk.

What does this operation do?

During "Scan" program checks sectors most likely containing partitioning information for missing partitions. Scan speed is faster than during normal disk analysis, but still may take about 10-20 minutes to complete (depending on many factors).
When disk scan is finished, the volumes found (if any) are added to the main volume list. Their "Type" field is set to "Scan" to indicate that there is no corresponding partition table entries. Volumes already listed will not be added twice. Restarting scan for a second time will thus be useless - it will not add any more information to that already known.


Ordering information

Unregistered (demo) version limitations.

Unregistered version has the following limitations:

1. Save files cannot be loaded (while can be saved).
2. Total number of folders recovered is limited to 4.

Ordering process information.

For price quote and to order fully functional version of ZAR, please visit the following page:
http://www.z-a-recovery.com/register.htm
Once you register, you will recieve the "unlock code" (also called "registration key") via e-mail.
1. Copy the code from the e-mail message to the clipboard.
2. Run ZAR, click "Enter code" button on the "Preliminary setup" tab.
3. Click "Paste from clipboard" button, the code will be copied into the appropriate field.
4. Click "OK" to close registration window
5. Close and restart ZAR. You will see your name and license type in the "License information" box.

What we consider "fair use" and what we don't.

1. You use an unregistered version as you need only two files from a crashed disk. This is normal.
2. You have two computers hit by virus at the same time, and use a full version to recover data from their disks. This is normal.
3. You use a registered version to recover data for all your friends. This is normal while the following holds: you do it yourself and you do not charge for recovery. Distribution of the registered version is not acceptable.

4. You use a registered version to recover data for fee. This is not acceptable unless you have a commercial license.


License Agreement

PLEASE READ THE FOLLOWING LEGAL AGREEMENT CAREFULLY. USE OF THE SOFTWARE PROVIDED WITH THIS AGREEMENT (ZERO ASSUMPTION RECOVERY, THE "SOFTWARE") CONSTITUTES YOUR ACCEPTANCE OF THESE TERMS. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, DO NOT INSTALL AND/OR USE THIS SOFTWARE. USER'S USE OF THIS SOFTWARE IS CONDITIONED UPON COMPLIANCE BY USER WITH THE TERMS OF THIS AGREEMENT.

LICENSE GRANT. Zero Assumption Recovery Software grants you a license to use one copy of the version of this SOFTWARE on any one hardware product for as many licenses as you purchase, OR a license to use the evaluation version of the software. "You" means the company, entity or individual whose funds are used to pay the license fee. "Use" means storing, loading, installing, executing or displaying the SOFTWARE. You may not modify the SOFTWARE or disable any licensing or control features of the SOFTWARE except as an intended part of the SOFTWARE's programming features. This license is not transferable to any other company, entity, or individual.
OWNERSHIP. The SOFTWARE is owned and copyrighted by Zero Assumption Recovery Software. Your license confers no title or ownership in the SOFTWARE and should not be construed as a sale of any right in the SOFTWARE.
UNAUTHORIZED USE. You may not use, copy, rent, lease, sell, modify, decompile, disassemble, otherwise reverse engineer, or transfer the SOFTWARE except as provided in this agreement. Any such unauthorized use shall result in immediate and automatic termination of this license.
LIMITED WARRANTY. THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS. ZERO ASSUMPTION RECOVERY SOFTWARE DISCLAIMS ALL WARRANTIES RELATING TO THIS SOFTWARE, WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. NEITHER ZERO ASSUMPTION RECOVERY SOFTWARE NOR ANYONE ELSE WHO HAS BEEN INVOLVED IN THE CREATION, PRODUCTION, OR DELIVERY OF THIS SOFTWARE SHALL BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, OR INCIDENTAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE SUCH SOFTWARE, EVEN IF THEY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR CLAIMS. THE PERSON USING THE SOFTWARE BEARS ALL RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE.
SOME JURISDICTIONS DO NOT ALLOW LIMITATION OR EXCLUSION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE LIMITATIONS OR EXCLUSION MAY NOT APPLY TO YOU TO THE EXTENT THAT LIABILITY IS BY LAW INCAPABLE OF EXCLUSION OR RESTRICTION.
IN NO EVENT SHALL ANY THEORY OF LIABILITY EXCEED THE LICENSE FEE PAID TO ZERO ASSUMPTION RECOVERY SOFTWARE COMPANY.
SEVERABILITY. In the event of invalidity of any provision of this license, the parties agree that such invalidity shall not affect the validity of the remaining portions of this license.
ENTIRE AGREEMENT. This is the entire agreement between you and Zero Assumption Recovery Software which supersedes any prior agreement or understanding, whether written or oral, relating to the subject matter of this license.
RESERVED RIGHTS. All rights not expressly granted here are reserved to Zero Assumption Recovery Software.