TIRAMISU FOR 32-BIT FAT V1.14 - SPECIAL EDITION
- SOPHISTICATED DATA RECOVERY -
(c) 1997 by Plug'n Play GbR, Uwe Gissemann, Dirk Knoblauch
CONTENT
1. OVERVIEW
1.1. Features
1.2. Differences between 16-bit and 32-bit Fat systems
2. SYSTEM REQUIREMENTS
3. INSTALLATION
3.1. Boot diskette
3.2. Specify swap area
3.3. Which Drive To RECOVER.
3.4. How to copy some or all files to a safe medium
4. RESULTS
5. RESTRICTIONS
6. OPTIONS
6.1. Swap Area
6.2. Excluded Main Directory Entries
6.3. Logging (Logfile)
6.4. Force recovery without FAT
6.5. LFN (long file name) support
6.6. Automatic Identification (Verify correct file system structure)
6.7. Start Identification At Sector X (multi partition problem)
6.8. Bad File Entry Acceptance
7. TROUBLE SHOOTING
7.1. Wrong Disk Size
7.2. Drive Structure Recognition Routine
7.3. Missing files or directories
7.4. Other Disk Tools
7.5. Get a New Version
8. OTHER FUNCTIONS
8.1 Long file names (LFN)
8.2 Save & Load a Recovery
9. REGISTRATION
10. NO WARRENTY
11. DISCLAIMER
1. OVERVIEW
1.1. Features
TIRAMISU is a software for reconstructing data from a crashed hard drive.
It helps when the drive is
- hit by a virus
- formatted
- 'fdisk'ed
- zapped by a power failure
- damaged by applications
TIRAMISU scans the drive even when there are physical damages. The found
data are analyzed and reconstructed. TIRAMISU can handle drives without
readable boot sector, readable Fat or readable directories. It can
handle drives that are not recognized by the operation system anymore.
TIRAMISU automatically creates a VIRTUAL DRIVE in memory. This virtual
drive looks like a usual file manager. You can see the lost directories
and files of your crashed drive. Now files and directories can be viewed
and copied to a safe medium.
The extensive use of our sophisticated pattern recognition technology
enables TIRAMISU to put the right pieces of data together again. Even
disks with very few administrative informations left can reach a high
recovery quality.
TIRAMISU recovers much more data than any other 'disk doctor'.
TIRAMISU is NON DESTRUCTIVE and READ ONLY. It does not put any data onto
your crashed drive. Recovered data are restored to another destination
(disk, diskette, network, interlink).
TIRAMISU works on WIN95 rel. B platforms with 32-bit Fat.
Versions for DOS/WINDOWS (16-Bit Fat), NOVELL and NTFS are available too.
TIRAMISU is copyrighted by Plug'n Play GbR, Uwe Gissemann, Dirk Knoblauch.
The DPMI run-time modules RTM.EXE and DPMI16BI.OVL are copyrighted by
Borland International, Inc.
1.2. Differences between 16-bit and 32-bit Fat systems
The "TIRAMISU for 32-bit Fat Special Edition" works only for 32-bit Fat
systems. This file system was first introduced by Microsoft with
Windows 95 Rel. B. in 1996.
The "16-bit" or "32-bit" refers to the maximal size of a Fat entry. The
maximal size of a Fat entry in a 16-bit system is 16 bit. This means
you can address up to
binary 1111111111111111 (= 2^16-1 = 65535)
clusters. A cluster is the smallest logical allocation unit on the
disk drive.
The maximal size of a Fat entry in a 32-bit system is 32 bit. Consequently
you can address up to
binary 2^32-1 (= 42949672950)
clusters.
The advantage of the 32-bit Fat systems is the ability to use smaller
allocation units (cluster sizes).
A 16-bit formatted 2GB drive for example uses a cluster size of 32KB.
32-bit formatted it uses a cluster size of 4KB only. Because the average
disk space loss per file (ADSLPF) due to internal fragmentation is
cluster size / 2
you get
ADSLPF(16-bit) = 16KB
and
ADSLPF(32-bit) = 2KB
This is a saving of 14 kb for every file on you hard drive. A typical
system has 10000 files. With the 32-bit system you save 140MB!
Another advantage of the 32-bit Fat system of course is the ability to
address drives larger than 2GB.
2. SYSTEM REQUIREMENTS
- 486 processor and up
- 8 MB RAM and up
Depending on the size of the drive to be recovered we recommend a 486
with 16 MB RAM.
3. INSTALLATION
3.1. Boot diskette
Create a boot diskette with a CONFIG.SYS similar to this:
Ŀ
files=25
device=himem.sys
DOS=HIGH
Make sure you have specified the correct drive parameters
in BIOS setup (Look to sec 7.1.).
Boot the computer and start the program TIRA32.EXE (best starting point
is a good second harddisk).
3.2. Specify swap area
By default TIRAMISU uses RAM as swap area. If for some reason there is
not enough RAM memory available you can specify a swap area on disk.
Select OPTION -> DATA RECOVERY, tag 'DISK', specify path.
CAUTION: Do not swap to the drive you intend to recover.
You can swap to another computer via INTERLINK if you do not have
enough memory or a second hard drive (typical laptop situation).
However this should be your last choice because the speed would
decrease dramatically.
3.3. Which Drive To RECOVER.
You can switch between the drives using the TAB key.
Hit RECOVER for the drive you want to recover.
HD 128 is normaly C: and 129 is D: and so on...
Ŀ
File Options Registration Help Registered 14:05:35
TIRAMISU FOR FAT 32 DATA RECOVERY
SOPHISTICATED DATA RECOVERY (V1.00) STATUS
(c) '97 by Plug'n Play, Uwe Gissemann
IDENTIFICATION
HD 128 ͻ HD 129 Ŀ Cluster
1022*64* 63 786*64* 63 Main
4120704 sec 3169152 sec FAT
2012 MB 1547 MB
RECOVER RECOVER CLASSIFICATION
Cluster
ͼ Fat
PROCESSING
Main
Subs
Files
DONE
Alt+F3 Close F10 Menu F7 Copy F8 View E:28896 403648
TIRAMISU starts processing. Depending on your system's speed and the size
of your drive this can take 15 minutes or even up to 2 hours.
3.4. How to copy some or all files to a safe medium
Now you see the virtual drive and you can view and copy (registered
version only) the files to any DOS-available destination by pressing
the F7-key.
4. RESULTS
The virtual drive is a file manager like window. It will look like this:
File Options Registration Help Registered 12:13:11
[] Virtual Drive []ͻ
ROOT IO.SYS 41055 31.05.94 06:22 a__shr8BF08
AOL25I MSDOS.SYS 38186 31.05.94 06:22 a__shr8C0A8
DOWNLOAD COMMAND.COM 57377 31.05.94 06:22 a____r8BC68
SPOOL DRVSPACE.BIN 66294 31.05.94 06:22 a__shr8BD48
ORGANIZE AOL25I
05.05.97 13:31 _d____0015ij
SAVE AWR 05.05.97 13:31 _d____03FBij
CCL BATCH 05.05.97 13:31 _d____043Aij
IDB BITMAP 05.05.97 13:31 _d____044Aij
SAVE CHIP 05.05.97 13:31 _d____0475ij
AWR CORELDRW 05.05.97 13:31 _d____070Cij
BATCH CORLSCSI 05.05.97 13:31 _d____0716ij
00123456 CSERVE 05.05.97 13:31 _d____073Bij
ANW16 DBASE3 05.05.97 13:32 _d____0EB8ij
ANW256 DECODER 05.05.97 13:32 _d____0EF2ij
CHIP DESKJET 05.05.97 13:32 _d____10BEij
CLIPART DOS 05.05.97 13:32 _d____10DAij
BUSINESS DUMMY 05.05.97 13:32 _d____12AFij
CARTOONS EATEMS 05.05.97 13:32 _d____12B7ij
Alt+F3 Close F10 Menu F7 Copy F8 View E:26320 117696
On the left side you can see the directory names. If for some reason your
main directory was destroyed there can be some dummies ("00123456"). This
usually does not effect the quality of the recovered files. You will find
the recovered files inside of these dummy directories.
The right part of the windows contains the file and directory entries of
the directory you selected on the left side.
You can copy (registered version only) the recovered files either from
the left or the right side of the virtual drive window. If you want to
retrieve the whole drive you should select "ROOT" on the left side
and press F7-Copy.
The quality of the recovered files depends on the condition of the drive.
The recovery quality of a single file can be checked by selecting the file
in the right part of the window and pressing the space key:
File Options Registration Help Registered 12:13:11
[] Virtual Drive []ͻ
ROOT IO.SYS 41055 31.05.94 06:22 a__shr8BF08
AOL25I MSDOS.SYS 38186 31.05.94 06:22 a__shr8C0A8
[] LOGO.SYS ͻ68
úAttributes: ____h_ 48
úDate: 05.09.96 5ij
Time: 11:11:00 Bij
úLength: 129078 (x0001F836) Aij
úStart: 203292 (x00031A1C) Aij
Group: 0 (x00000000) 5ij
AId: 203292 (x00031A1C) Cij
BLong file name: (none) 6ij
BMethode: DF Bij
úChaining: 8ij
00031A1C00031A1D00031A1E00031A1F00031A2000031A21 2ij
C Ok Eij
C Aij
ͼFij
CARTOONS EATEMS 05.05.97 13:32 _d____12B7ij
Alt+F3 Close F10 Menu F7 Copy F8 View E:26320 F:7576 117696
The characters next to "Methode:" tell you something about the quality
of this single file.
F - FAT approved. This file has been recovered using a valid FAT
entry. This is a very good sign. In all probability this file
is good.
D - Directory entry found. A directory entry was found for this
file. This is usually a minimum requirement for a good file
quality
S - Confirmed by signature. Some kinds of files (for example EXE
files) has signatures. An 'S' indicates that the found data
indeed have this signature.
Another way to check the file quality before you copy is viewing it with
the hex-viewer (F8).
5. RESTRICTIONS
TIRAMISU FOR FAT32 handles only drives with 32-Bit Fats, which applies
only to some new WIN95 systems.
If you have a usual 16-bit fat you need TIRAMISU FOR DOS/WINDOWS.
Since TIRAMISU is very memory hungry, your PC might run out of memory.
If you face this problem, install a memory manager with as much RAM and
EMS as possible.
Watch the available memory displayed at the bottom line. The value
displayed at the far right shows the free RAM. The E:XXX shows the free
EMS. The RAM should not go below 50000.
6. OPTIONS
There are several options you can change in the OPTIONS->DATA RECOVERY
screen:
[] Tiramisu Data Recovery Options ͻ
Swap area:
(X) Memory ***CAUTION: Don't swap to the drive
( ) EMS you intend to recover!
( ) Disk D:\TEMP
Excluded main directory entries:
FILE*.CHK;DIR*.CHK;*._DD;PCT*.FIX;DIR0????.*
Logging to file:
[ ] Force recovery without FAT
[X] LFN (long file name) support
[X] Automatic identification
Start identification at sector: 0
Bad file entry acceptance (0-100 %): 50
OK Cancel
ͼ
6.1. Swap Area
By default TIRAMISU stores memory intensive data in ram memory. You
also can store it to EMS or disk drive. Be sure to choose a drive you
are not just recovering.
6.2. Excluded Main Directory Entries
This option tells TIRAMISU to ignore files entries that have been created
during a previous run of another disk doctor (Norton, Scandisk,...).
6.3. Logging (Logfile)
Use this option to create a log file of TIRAMISU's processing. This might
be interesting for debug purposes.
6.4. Force recovery without FAT
You usually will not tag on this option. During its structure recognition
TIRAMISU tries to reconstruct the remaining FAT fragments. However, if
TIRAMISU finds an old FAT that is not the FAT of the file system you
want to recover it is better to do the recovery without FAT than with
FAT.
6.5. LFN (long file name) support
By default the LFN support is enabled (see also section 7.1).
If you do not need long file names or your file system did not support
them you can switch this options off. This speeds up the recovery.
6.6. Automatic Identification (Verify correct file system structure)
The first thing TIRAMISU does is to retrieve the original structure of
the file system: place of Fat1, Fat2, main directory, number of sectors
per cluster, number of clusters.
If you tag off this option TIRAMISU shows you what it thinks what kind
of file system it found. Usually you confirm this by pressing OK. If you
do not confirm the structure TIRAMISU found, you can continue the
identification procedure by pressing SEARCH AGAIN. After a while TIRAMISU
will make a new proposal.
6.7. Start Identification At Sector X (multi partition problem)
By default TIRAMISU starts its identification procedure at sector 0.
However you might be interested in recovering another but the first
partition. Then you can enter a value in this field.
Example: Let's suppose you have a 600 MB drive with two partions (400 MB
and 200 MB). You want to recover the second (200 MB) partition. The first
partition uses 400 MB space on the hard drive. These are approximately
800000 sectors (one sector has 512 bytes). Consequently you should enter
the value 800000 in this field.
You should tag the "Automatic Identifation" off. So you can verify if
TIRAMISU retrieved the correct file system structure.
6.8. Bad File Entry Acceptance
TIRAMISU uses statistical algorithms to decide if file entries are
included into the recovery process. If you set this option to 0
TIRAMISU is very strict. If you set it to 100 TIRAMISU is very loose.
50 is a good value. Increase it if you miss some files in the resulting
virtual drive. Decrease it if you get scrambled results.
7. TROUBLE SHOOTING
Sometimes you might think the computer is frozen and TIRAMISU is
crashed. Be patient! Some procedures might take up to one hour. If
TIRAMISU crashes you usually get an error code.
7.1. Wrong Disk Size
A nasty source of problems is a wrong disk size reported from BIOS.
Check the size TIRAMISU thinks your drive has:
HD 128 ͻ
1022*64* 63
4120704 sec
2012 MB
RECOVER
ͼ
If this size (2012 MB in this example) is not correct you won't get
correct recovery results.
Reboot your computer and enter the BIOS setup. Let it "auto detect"
(if available) the drive size or enter the values manually.
If the drive is bigger than 504 MB make sure the LBA mode is enabled.
If you still get a wrong drive size try this (experts only!):
- make a backup of the very first sector (physical sector 0,0,1)
- Overwrite the very first sector (512 bytes) with zeros.
You can use a disk editor like Norton's DISKEDIT for this task.
Reboot the computer again.
7.2. Drive Structure Recognition Routine
If you get only scrambled results this could be due to the TIRAMISU
drive structure recognition routine. Try this:
Select OPTION -> DATA RECOVERY, tag 'AUTOMATIC IDENTIFICATION' off.
Press RECOVER. After a while you get a window that proposes a certain
drive structure:
[] Drive structure ͻ
STRUCTURE-INFORMATION FOR DRIVE: 129
620 Cyl x 64 Heads x 63 Sec = 2499840 phys. Sect. = 1220 MByte
Cluster size: 8 (x08)
Data start (Cluster 0) at sector: 4957 (x0000135D)
Last Cluster: 312191 (x0004C37F)
FAT start: 95 (x0000005F)
FAT end: 2533 (x000009E5)
Free: 439 (x000001B7) Cluster = 0.14 %
Reserved: 0 (x00000000) Cluster = 0.00 %
Used: 311751 (x0004C1C7) Cluster = 99.86 %
Bad: 0 (x00000000) Cluster = 0.00 %
Undefined: 0 (x00000000) Cluster = 0.00 %
Ok Search again Cancel
ͼ
Check the value "Cluster size". It tells you how many sectors a cluster
uses. In the example above the cluster size is 8 sectors (=4 kB).
Check the value of "Data Start (Cluster 0) at sector". If you are
retrieving the first partition it should be below 10000. If you try to
retrieve - let's say - the 2nd partition of a 2 GB drive with two 1 GB
partitions this value should be around 2010000.
Check the value of "Last Cluster". Do the following calculation:
(Last Cluster * Cluster Size) / 2
This is the size (in kB) of the partition you are going to recover.
In the example above the partition size is
8 * 312191 / 2 = 1248763 kB
This is approximately 1.2 GB. Since I know that my 1.2 GB drive had one
partitions this identification is likely to be correct.
If you are not satisfied with what you see you can press 'Search Again'.
TIRAMISU tries to retrieve another structure. Repeat this until the
proposed structure seems to be correct.
Finally press 'Ok'.
If you do not get any satisfying results consider if you really have
a 32-bit Fat system.
7.3. Missing files or directories
You can change the option "Bad file entry acceptance". 0% means a
very strong directory recognition routine. Use only if TIRAMISU crashes.
100% means a very loose directory recognition routine. Use if TIRAMISU
goes through but you miss some directories. 50% is a good standard value.
(see 6.9.)
7.4. Other Disk Tools
You should not use any other 'disk doctor' before running TIRAMISU. If you
did so, please 'undo'.
If you cannot 'undo' you can tell TIRAMISU to ignore the file entries
the 'disk doctor' created (something like FILE0000.CHK...).
Select OPTION -> DATA RECOVERY, modify the field 'Exclude Main
Directory Entries'.
7.5. Get a New Version
Download a new version from our Internet site (address below).
If you find any bugs, please send a description to one of the addresses
below or use our support form at "http://www.recovery.de".
8. OTHER FUNCTIONS
The FILE menu contains some additional functions. The are described
below.
8.1 Long File Names (LFN)
TIRAMISU is able to retrieve the WIN95 long file names (LFN). The
recovery itself is done using the short (alias) names. After copying
the data to a safe medium you can select FILE->CREATE LONGNAME BATCH.
You will be prompted for a file name. Type in 'LONGNAME.BAT' for
example (CAUTION: Do not write this file to the drive you are just
reocvering). TIRAMISU will create a batch similar to this:
Ŀ
REM TIRAMISU long name batch created: 19970604 16:35:17
REM This batch file renames the recovered file to the long file names
REM This batch must be started in a WIN95 dos box
REM Check that the path names are correct
ren \ROOT\00036326\AOL&IN~1.LNK "AOL & Internet jetzt testen!.lnk"
ren \ROOT\PROGRA~1\MICROS~1 "Microsoft Exchange"
ren \ROOT\PROGRA~1\INTERN~1 "Internet Explorer"
ren \ROOT\PROGRA~1\THEMIC~1 "The Microsoft Network"
ren \ROOT\PROGRA~1\ICW-IN~1 "ICW-Internet Connection Wizard"
ren \ROOT\PROGRA~1\ONLINE~1\COMPUS~1 "CompuServe"
ren \ROOT\PROGRA~1\ONLINE~1 "Online-Dienste"
ren \ROOT\PROGRA~1 "Programme"
ren \ROOT\VERKN~1.LNK "Verknpfung mit Fawin.lnk"
ren \ROOT\WINDOWS\SENDTO\3_5-DI~1.LNK "3,5-Diskette (A).lnk"
Run this batch under WIN95. Make sure it shows the correct path names,
especially if you copied your files to a different location.
8.2 Save & Load a Recovery
You can save a successful recovery on disk using the SAVE command (F2).
You will be prompted to specify a file name. Depending on the size of
the drive you are recovering, the size of this file can be up to 20 MB.
CAUTION: Do not write this file to the drive you are just recovering.
After starting TIRAMISU you can load a previous saved recovery using
the LOAD command (F3).
Make sure the matching drive is selected (high-lighted). Do not load
the stored recovery for a different drive.
9. REGISTRATION
TIRAMISU IS DISTRIBUTED AS SHAREWARE. FEEL FREE TO COPY, DISTRIBUTE OR
UPLOAD IT TO ANY MEDIUM. The unregistered version has all functions
for recovering your crashed hard drive. But only the registered version
of TIRAMISU allows you to COPY files from your recovered drive.
There are two kinds of licenses available:
- A limited version that can only be used for a PERIOD OF ONE WEEK.
In effect this is a PAY PER USE registration. The fee is
DM 145 (approximately US $95).
Orders within the European Community add 15% VAT.
- An unlimited version that can be used for an UNLIMITED PERIOD at
one computer at the same time. The fee is DM 290 (approximately
US $190).
Orders within the European Community add 15% VAT.
The registration procedure is this:
- Run TIRAMISU and check if it can restore your data (VIEW your files)
- Select REGISTRATION->REGISTRATION. You will be asked to insert a
diskette in drive A:.
[] Information ͻ
Please insert the license or a
blank diskette in drive A:
OK Cancel
ͼ
Please have ready a blank formatted 1.44 MB or 1.2 MB diskette.
This diskette will become your license diskette later. Be aware
that any data on this diskette might be damaged during this procedure.
[] Confirm ͻ
Disk in drive A: will be prepared
now for STEP 1 of registration.
DATA MIGHT BE DESTROYED! Continue?
Yes No
ͼ
If you encounter any problems please try it again using a fresh
formatted and error free diskette.
If you are running TIRAMISU from diskette do not remove the diskette
during the registration process because it is needed for reloading
overlays. If you do not want to risk this diskette's data, please
terminate the program, put the TIRAMISU program files onto a new
diskette and start TIRAMISU again to do the registration.
Finally you will be shown a 16- or 17-letter code.
[] Information ͻ
Your license diskette is prepared
for registration now. Send us this
code:
CPYQ BVVN MHVA VCWX K
OK
ͼ
- Submit this code to the TIRAMISU registration service (preferably
by fax, use the form you can find in REGISTER.TXT):
Tel.: 49-30-292 00 99 or 49-30-78 70 51 58 (Germany)
Fax: 49-30-292 60 63 or 49-30-78 70 51 59
Email: data_recovery@compuserve.com
http://www.recovery.de
http://ourworld.compuserve.com/homepages/data_recovery
Address: Plug 'n Play
Uwe Gissemann
Scharnweberstr. 43
D-10247 Berlin
Germany
- Specify the kind of license you want to purchase (7 days license or
unlimited license). Send the money or credit card information (VISA,
MASTERCARD or DINERS).
- The registration key will be forwarded to you immediately by fax
or email after we charged to your account.
- After receiving the registration key from us, please insert the
prepared diskette. Start TIRAMISU. Select REGISTRATION->REGISTRATION.
Enter the received key in the registration screen.
- Ready! Now you can use COPY to save your data.
IMPORTANT: Label the diskette as your license diskette. You will need it
anytime you run TIRAMISU. The license diskette can not be duplicated.
This is a copy protection.
The limited license allows you to recover data only from one
computer. It is not valid for other systems. (This restriction does not
apply for the unlimited license.)
10. NO WARRENTY
The quality of data recovery that is done by TIRAMISU depends on:
- physical condition of the hard drive
- fragmentation of the files
- grade of the loss of drive informations
TIRAMISU data recovery software, as all applications, has limitations.
We cannot provide recovery capabilities under certain conditions. Due
to the many variables associated with drive corruption, we cannot
guarantee recovery in all cases.
However, downloading and running the shareware version gives you the
closest idea to what we can offer.
All customers are recommended to check the files with the build-in
quality control (file information and file viewer) before they buy.
We do not do refunds.
11. DISCLAIMER
PLUG'N PLAY DOES NOT WARRANT THAT THE SOFTWARE IS ERROR FREE.
PLUG'N PLAY DISCLAIMS ALL WARRANTIES WITH RESPECT TO THE SOFTWARE,
EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF THIRD PARTY RIGHTS.
NO LIABILITY FOR CONSEQUENTIAL DAMAGES. IN NO EVENT SHALL
PLUG'N PLAY BE LIABLE FOR CONSEQUENTIAL, INCIDENTAL
OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE DELIVERY,
PERFORMANCE OR USE OF THE SOFTWARE, EVEN IF PLUG'N PLAY HAS BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL
PLUG'N PLAY'S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT OR
ANY OTHER THEORY OF LIABILITY, EXCEED THE LICENSE FEE PAID BY
THE BUYER.