TIRAMISU FOR DOS/WINDOWS V3.07 - SOPHISTICATED DATA RECOVERY (c) 1996, 97 by Plug'n Play GbR, Uwe Gissemann, Dirk Knoblauch CONTENT 1. OVERVIEW 2. SYSTEM REQUIREMENTS 3. INSTALLATION 3.1. Boot diskette 3.2. Specify swap area 3.3. Which Drive To RECOVER. 3.4. How to copy some or all files to a safe medium 4. RESULTS 5. RESTRICTIONS 6. OPTIONS 6.1. Swap Area 6.2. Excluded Main Directory Entries 6.3. Logging (Logfile) 6.4. Automatic Identification (Verify correct file system structure) 6.5. Start Identification At Sector X (multi partition problem) 6.6. Bad File Entry Acceptance 7. TROUBLE SHOOTING 7.1. Wrong Disk Size 7.2. Drive Structure Recognition Routine 7.3. Missing files or directories 7.4. Other Disk Tools 7.5. Get a New Version 8. REGISTRATION 9. NO WARRENTY 10.DISCLAIMER 1. OVERVIEW TIRAMISU is a software for reconstructing data from a crashed hard drive. It helps when the drive is - hit by a virus - formatted - 'fdisk'ed - zapped by a power failure - damaged by applications TIRAMISU scans the drive even when there are physical damages. The found data are analyzed and reconstructed. TIRAMISU can handle drives without readable boot sector, readable Fat or readable directories. It can handle drives that are not recognized by DOS anymore. TIRAMISU automatically creates a VIRTUAL DRIVE in memory. This virtual drive looks like a usual file manager. You can see the lost directories and files of your crashed drive. Now files and directories can be viewed and copied to a safe medium. The extensive use of our sophisticated pattern recognition technology enables TIRAMISU to put the right pieces of data together again. Even disks with very few administrative informations left can reach a high recovery quality. TIRAMISU recovers much more data than any other 'disk doctor'. TIRAMISU is NON DESTRUCTIVE and READ ONLY. It does not put any data onto your crashed drive. Recovered data are restored to another destination (disk, diskette, network, interlink). TIRAMISU works on DOS and Windows platforms. Better Windows95 support has been added in version 1.03. Multi partition recovery has been added in version 2.0. Versions for NOVELL and NTFS are available too. 2. SYSTEM REQUIREMENTS - 286 processor and up - 4 MB RAM and up Depending on the size of the drive to be recovered we recommend a 486 with 8 MB RAM. Installing 5 MB of EMS (Version 4) is recommended. 3. INSTALLATION 3.1. Boot diskette Create a boot diskette with a CONFIG.SYS similar to this: 旼컴컴컴컴컴컴컴컴컴컴� 쿯iles=25 � 쿭evice=himem.sys � 쿭evice=emm386.exe ram� 쿏OS=HIGH � 읕컴컴컴컴컴컴컴컴컴컴� Make sure you have specified the correct drive parameters in BIOS setup (Look to sec 7.1.). Boot the computer and start the program TIRAMISU.EXE (best starting point is a good second harddisk). 3.2. Specify swap area By default TIRAMISU uses EMS as swap area. If for some reason there is no or not enough EMS you can specify a swap area on disk. Select OPTION -> DATA RECOVERY, tag 'DISK ALLOWED', specify path. CAUTION: Do not swap to the drive you intend to recover. You can swap to another computer via INTERLINK if you do not have enough memory or a second hard drive (typical laptop situation). However this should be your last choice because the speed would decrease dramatically. 3.3. Which Drive To RECOVER. You can switch between the drives using the TAB key. Hit RECOVER for the drive you want to recover. HD 128 is normaly C: and 129 is D: and so on... 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � File Options Registration Help Registered 14:05:35 � � TIRAMISU DATA RECOVERY � � SOPHISTICATED DATA RECOVERY (V3.03) STATUS � � (c) '96 by Plug'n Play, Uwe Gissemann � � IDENTIFICATION � 냥袴� HD 128 袴袴� 旼컴 HD 129 컴컴� Cluster � 낳 1022*64* 63 � � 786*64* 63 � Main � 낳 4120704 sec � � 3169152 sec � FAT � 낳 2012 MB � � 1547 MB � � 낳 RECOVER � � � RECOVER � � CLASSIFICATION � 낳 賽賽賽賽� � � 賽賽賽賽� � Cluster � 냠袴袴袴袴袴袴袴暠 읕컴컴컴컴컴컴컴� Fat � � � � PROCESSING � � Main � � Subs � � Files � � � � DONE � � � 쿌lt+F3 Close F10 Menu F7 Copy F8 View E:28896 403648 � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 TIRAMISU starts processing. Depending on your system's speed and the size of your drive this can take 5 minutes or even up to 2 hours. 3.4. How to copy some or all files to a safe medium Now you see the virtual drive and you can view and copy (registered version only) the files to any DOS-available destination by pressing the F7-key. 4. RESULTS The virtual drive is a file manager like window. It will look like this: File Options Registration Help Registered 12:13:11 ��[�]袴袴袴袴袴袴錮袴袴 Virtual Drive 袴袴袴袴袴袴袴袴袴袴袴袴袴袴[]敲 봬ROOT128  IO.SYS 41055 31.05.94 06:22 a__shr8BF0�8 � 쳐횫OL25I � MSDOS.SYS 38186 31.05.94 06:22 a__shr8C0A�8� � � 쳐횯OWNLOAD � COMMAND.COM 57377 31.05.94 06:22 a____r8BC6�8� � � 쳐훁POOL � DRVSPACE.BIN 66294 31.05.94 06:22 a__shr8BD4�8� � � 쳐횽RGANIZE � AOL25I 05.05.97 13:31 _d____0015캐� � � � 읕훁AVE � AWR 05.05.97 13:31 _d____03FB캐� � � 쳐횮CL � BATCH 05.05.97 13:31 _d____043A캐� � � 쳐횵DB � BITMAP 05.05.97 13:31 _d____044A캐� � � � 읕훁AVE � CHIP 05.05.97 13:31 _d____0475캐� � 쳐횫WR � CORELDRW 05.05.97 13:31 _d____070C캐� � 쳐횭ATCH � CORLSCSI 05.05.97 13:31 _d____0716캐� � 쳐횮LUS1234 � CSERVE 05.05.97 13:31 _d____073B캐� � � 쳐횫NW16 � DBASE3 05.05.97 13:32 _d____0EB8캐� � � 읕횫NW256 � DECODER 05.05.97 13:32 _d____0EF2캐� � 쳐횮HIP � DESKJET 05.05.97 13:32 _d____10BE캐� � 쳐횮LIPART � DOS 05.05.97 13:32 _d____10DA캐� � � 쳐횭USINESS � DUMMY 05.05.97 13:32 _d____12AF캐� � � 읕횮ARTOONS  EATEMS 05.05.97 13:32 _d____12B7캐 �께께께께께께께賈袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴켸 Alt+F3 Close F10 Menu F7 Copy F8 View E:26320 F:7576 117696 On the left side you can see the directory names. If for some reason your main directory was destroyed there can be some dummies ("CLUS1234"). This usually does not effect the quality of the recovered files. You will find the recovered files inside of these dummy directories. The right part of the windows contains the file and directory entries of the directory you selected on the left side. You can copy (registered version only) the recovered files either from the left or the right side of the virtual drive window. If you want to retrieve the whole drive you should select "ROOT128" on the left side and press F7-Copy. The quality of the recovered files depends on the condition of the drive. The recovery quality of a single file can be checked by selecting the file in the right part of the window and pressing the space key: File Options Registration Help Registered 12:13:11 ��[�]袴袴袴袴袴袴錮袴袴 Virtual Drive 袴袴袴袴袴袴袴袴袴袴袴袴袴袴[]敲 봬ROOT128  IO.SYS 41055 31.05.94 06:22 a__shr8BF0�8 � 쳐횫OL25I � MSDOS.SYS 38186 31.05.94 06:22 a__shr8C0A�8� � � 쳐횯OWNL��[�]袴袴袴袴袴袴 SAMANTA.DOC 袴袴袴袴袴袴袴袴�___r8BC6�8� � � 쳐훁POOL튍ttributes: a_____ _shr8BD4�8� � � 쳐횽RGAN튒ate: 20.02.97 �____0015캐� � � � 읕훁A튦ime: 18:00:22 �____03FB캐� � � 쳐횮CL 튛ength: 484864 (x00076600) �____043A캐� � � 쳐횵DB 튝ethode: DSF �____044A캐� � � � 읕훁A튏haining: �____0475캐� � 쳐횫WR �8C36�8C37�8C38�8C39�8C3A�8C3B�8C3C�8C3D� �____070C캐� � 쳐횭ATCH �8C3E�8C3F�8C40�8C41�8C42�8C43�8C44�8C45� �____0716캐� � 쳐횭ITMAP �8C46�8C47�8C48�8C49�8C4A�8C4B�8C4C�8C4D� �____073B캐� � � 쳐횫NW16�8C4E�8C4F�8C50�8C51�8C52�8C53캐 �____0EB8캐� � � 읕횫NW25� �____0EF2캐� � 쳐횮HIP � Ok � �____10BE캐� � 쳐횮LIPART � 賽賽賽賽 ____10DA캐� � � 쳐횭USIN훤�굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇暠____12AF캐� � � 읕횮ARTOONS  EATEMS 05.05.97 13:32 _d____12B7캐 �께께께께께께께賈袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴켸 Alt+F3 Close F10 Menu F7 Copy F8 View E:26320 F:7576 117696 The characters next to "Methode:" tell you something about the quality of this single file. F - FAT approved. This file has been recovered using a valid FAT entry. This is a very good sign. In all probability this file is good. D - Directory entry found. A directory entry was found for this file. This is usually a minimum requirement for a good file quality S - Confirmed by signature. Some kinds of files (for example EXE files) has signatures. An 'S' indicates that the found data indeed have this signature. Another way to check the file quality before you copy is viewing it with the hex-viewer (F8). 5. RESTRICTIONS TIRAMISU handles only drives with 16-Bit Fats, which applies to most systems. Very old (10 MB) drives have another Fat (12-Bit). The very new 32-Bit Fat is not supported. Since TIRAMISU is very memory hungry, your PC might run out of memory. If you face this problem, install a memory manager with as much RAM and EMS as possible. Watch the available memory displayed at the bottom line. The value displayed at the far right shows the free RAM. The E:XXX shows the free EMS. The RAM should not go below 50000. 6. OPTIONS There are several options you can change in the OPTIONS->DATA RECOVERY screen: ��[�]袴袴袴袴� Tiramisu Data Recovery Options 袴袴袴袴袴袴敲 � Swap area: ***CAUTION: Don't swap to the drive � � () EMS only you intend to recover! � � ( ) Disk allowed D:\TEMP � � � � Excluded main directory entries: � � FILE*.CHK;DIR*.CHK;*._DD;PCT*.FIX;DIR0????.* � � � � Logging to file: � � � � � � [X] Automatic Identification � � Start identification at sector: 0 � � Bad file entry acceptance (0-100 %): 50 � � � � OK � Cancel � � � 賽賽賽賽 賽賽賽賽 � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 6.1. Swap Area By default TIRAMISU stores memory intensive data in EMS. If your have no or not enough EMS available you can allow swapping to a drive. Be sure to choose a drive you are not just recovering. 6.2. Excluded Main Directory Entries This option tells TIRAMISU to ignore files entries that have been created during a previous run of another disk doctor (Norton, Scandisk,...). 6.3. Logging (Logfile) Use this option to create a log file of TIRAMISU's processing. This might be interesting for debug purposes. 6.4. Automatic Identification (Verify correct file system structure) The first thing TIRAMISU does is to retrieve the original structure of the file system: place of Fat1, Fat2, main directory, number of sectors per cluster, number of clusters. If you tag off this option TIRAMISU shows you what it thinks what kind of file system it found. Usually you confirm this by pressing OK. If you do not confirm the structure TIRAMISU found, you can continue the identification procedure by pressing SEARCH AGAIN. After a while TIRAMISU will make a new proposal. 6.5. Start Identification At Sector X (multi partition problem) By default TIRAMISU starts its identification procedure at sector 0. However you might be interested in recovering another but the first partition. Then you can enter a value in this field. Example: Let's suppose you have a 600 MB drive with two partions (400 MB and 200 MB). You want to recover the second (200 MB) partition. The first partition uses 400 MB space on the hard drive. These are approximately 800000 sectors (one sector has 512 bytes). Consequently you should enter the value 800000 in this field. You should tag the "Automatic Identifation" off. So you can verify if TIRAMISU retrieved the correct file system structure. 6.6. Bad File Entry Acceptance TIRAMISU uses statistical algorithms to decide if file entries are included into the recovery process. If you set this option to 0 TIRAMISU is very strict. If you set it to 100 TIRAMISU is very loose. 50 is a good value. Increase it if you miss some files in the resulting virtual drive. Decrease it if you get scrambled results. 7. TROUBLE SHOOTING Sometimes you might think the computer is frozen and TIRAMISU is crashed. Be patient! Some procedures might take up to one hour. If TIRAMISU crashes you usually get an error code. 7.1. Wrong Disk Size A nasty source of problems is a wrong disk size reported from BIOS. Check the size TIRAMISU thinks your drive has: �袴� HD 128 袴袴� � 1022*64* 63 � � 4120704 sec � � 2012 MB � � RECOVER � � � 賽賽賽賽� � 훤袴袴袴袴袴袴袴� If this size (2012 MB in this example) is not correct you won't get correct recovery results. Reboot your computer and enter the BIOS setup. Let it "auto detect" (if available) the drive size or enter the values manually. If the drive is bigger than 504 MB make sure the LBA mode is enabled. If you still get a wrong drive size try this (experts only!): - make a backup of the very first sector (physical sector 0,0,1) - Overwrite the very first sector (512 bytes) with zeros. You can use a disk editor like Norton's DISKEDIT for this task. Reboot the computer again. 7.2. Drive Structure Recognition Routine If you get only scrambled results this could be due to the TIRAMISU drive structure recognition routine. Try this: Select OPTION -> DATA RECOVERY, tag 'AUTOMATIC IDENTIFICATION' off. Press RECOVER. After a while you get a window that proposes a certain drive structure: ��[�]袴袴袴袴袴袴袴袴袴袴 Drive structure 袴袴袴袴袴袴袴袴袴袴袴袴� 튥TRUCTURE-INFORMATION FOR DRIVE: 128  �1022 Cyl x 64 Heads x 63 Sec = 120704 phys. Sect. = 2012 MByte � � � 튏luster size: 32 (x20) � 튒ata start (Cluster 0) at sector: 538 (x0000021A) � 튛ast Cluster: 64767 (xFCFF) � � � 튔AT start: 64 (x00000040) � 튔AT end: 316 (x0000013C) � � � 튔ree: 27676 (x6C1C) Cluster = 42.73 % � 튣eserved: 0 (x0000) Cluster = 0.00 % � 튧sed: 37090 (x90E2) Cluster = 57.27 % � 튎ad: 0 (x0000) Cluster = 0.00 % � 튧ndefined: 0 (x0000) Cluster = 0.00 % � � � � Ok � Search again� Cancel � � � 賽賽賽賽賽賽� 賽賽賽賽賽賽� 賽賽賽賽賽賽�  훤�굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇暠 Check the value "Cluster size". It tells you how many sectors a cluster uses. In the example above the cluster size is 32 sectors (=16 kB). Check the value of "Data Start (Cluster 0) at sector". If you are retrieving the first partition it should be below 1000. If you try to retrieve - let's say - the 2nd partition of a 2 GB drive with two 1 GB partitions this value should be around 2000000. Check the value of "Last Cluster". Do the following calculation: (Last Cluster * Cluster Size) / 2 This is the size (in kB) of the partition you are going to recover. In the example above the partition size is 32 * 64767 / 2 = 1036272 kB This is approximately 1 GB. Since I know that my 2 GB drive had two partitions of 1 GB this identification is likely to be correct. If you are not satisfied with what you see you can press 'Search Again'. TIRAMISU tries to retrieve another structure. Repeat this until the proposed structure seems to be correct. Finally press 'Ok'. 7.3. Missing files or directories You can change the option "Bad file entry acceptance". 0% means a very strong directory recognition routine. Use only if TIRAMISU crashes. 100% means a very loose directory recognition routine. Use if TIRAMISU goes through but you miss some directories. 50% is a good standard value. (see 6.6.) 7.4. Other Disk Tools You should not use any other 'disk doctor' before running TIRAMISU. If you did so, please 'undo'. If you cannot 'undo' you can tell TIRAMISU to ignore the file entries the 'disk doctor' created (something like FILE0000.CHK...). Select OPTION -> DATA RECOVERY, modify the field 'Exclude Main Directory Entries'. 7.5. Get a New Version Download a new version from our Internet site (address below). If you find any bugs, please send a description to one of the addresses below or use our support form at "http://www.recovery.de". 8. REGISTRATION TIRAMISU IS DISTRIBUTED AS SHAREWARE. FEEL FREE TO COPY, DISTRIBUTE OR UPLOAD IT TO ANY MEDIUM. The unregistered version has all functions for recovering your crashed hard drive. But only the registered version of TIRAMISU allows you to COPY files from your recovered drive. There are two kinds of licenses available: - A limited version that can only be used for a PERIOD OF ONE WEEK. In effect this is a PAY PER USE registration. The fee is DM 145 (approximately US $95). Orders within the European Community add 15% VAT. - An unlimited version that can be used for an UNLIMITED PERIOD at one computer at the same time. The fee is DM 290 (approximately US $190). Orders within the European Community add 15% VAT. The registration procedure is this: - Run TIRAMISU and check if it can restore your data (VIEW your files) - Select REGISTRATION->REGISTRATION. You will be asked to insert a diskette in drive A:. ��[�]袴袴袴袴 Information 袴袴袴袴袴袴敲 � � � Please insert the license or a � � blank diskette in drive A: � � � � � � OK � Cancel � � � 賽賽賽賽 賽賽賽賽 � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 Please have ready a blank formatted 1.44 MB or 1.2 MB diskette. This diskette will become your license diskette later. Be aware that any data on this diskette might be damaged during this procedure. ��[�]袴袴袴袴袴 Confirm 袴袴袴袴袴袴袴敲 � � � Disk in drive A: will be prepared � � now for STEP 1 of registration. � � DATA MIGHT BE DESTROYED! Continue? � � � � Yes � No � � � 賽賽賽賽 賽賽賽賽 � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 If you encounter any problems please try it again using a fresh formatted and error free diskette. If you are running TIRAMISU from diskette do not remove the diskette during the registration process because it is needed for reloading overlays. If you do not want to risk this diskette's data, please terminate the program, put the TIRAMISU program files onto a new diskette and start TIRAMISU again to do the registration. Finally you will be shown a 16- or 17-letter code. ��[�]袴袴袴袴 Information 袴袴袴袴袴袴敲 � � � Your license diskette is prepared � � for registration now. Send us this � � code: � � CPYQ BVVN MHVA VCWX K � � OK � � � 賽賽賽賽 � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 - Submit this code to the TIRAMISU registration service (preferably by fax, use the form you can find in REGISTER.TXT): Tel.: 49-30-292 00 99 (Germany) Fax: 49-30-292 60 63 Email: data_recovery@compuserve.com http://www.recovery.de http://ourworld.compuserve.com/homepages/data_recovery Address: Plug 'n Play Uwe Gissemann Scharnweberstr. 43 D-10247 Berlin Germany - Specify the kind of license you want to purchase (7 days license or unlimited license). Send the money or credit card information (VISA, MASTERCARD or DINERS). - The registration key will be forwarded to you immediately by fax or email after we charged to your account. - After receiving the registration key from us, please insert the prepared diskette. Start TIRAMISU. Select REGISTRATION->REGISTRATION. Enter the received key in the registration screen. - Ready! Now you can use COPY to save your data. IMPORTANT: Label the diskette as your license diskette. You will need it anytime you run TIRAMISU. The license diskette can not be duplicated. This is a copy protection. The limited license allows you to recover data only from one computer. It is not valid for other systems. (This restriction does not apply for the unlimited license.) 9. NO WARRENTY The quality of data recovery that is done by TIRAMISU depends on: - physical condition of the hard drive - fragmentation of the files - grade of the loss of drive informations TIRAMISU data recovery software, as all applications, has limitations. We cannot provide recovery capabilities under certain conditions. Due to the many variables associated with drive corruption, we cannot guarantee recovery in all cases. However, downloading and running the shareware version gives you the closest idea to what we can offer. All customers are recommended to check the files with the build-in quality control (file information and file viewer) before they buy. We do not do refunds. 10. DISCLAIMER PLUG'N PLAY DOES NOT WARRANT THAT THE SOFTWARE IS ERROR FREE. PLUG'N PLAY DISCLAIMS ALL WARRANTIES WITH RESPECT TO THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. NO LIABILITY FOR CONSEQUENTIAL DAMAGES. IN NO EVENT SHALL PLUG'N PLAY BE LIABLE FOR CONSEQUENTIAL, INCIDENTAL OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE DELIVERY, PERFORMANCE OR USE OF THE SOFTWARE, EVEN IF PLUG'N PLAY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL PLUG'N PLAY'S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT OR ANY OTHER THEORY OF LIABILITY, EXCEED THE LICENSE FEE PAID BY THE BUYER.