home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Chip 2005 August
/
CHIP_CD_2005-08.iso
/
bonus
/
photo_rest
/
files
/
setup.exe
/
{app}
/
DOS
/
MANUALS
/
zarbbt.txt
< prev
next >
Wrap
Text File
|
2002-01-21
|
17KB
|
378 lines
Zero Assumption Recovery (ZAR) version 6.3
Boot-Based Tools (ZARBBT)
USER'S MANUAL
Copyright (C) Alexey V. Gubin, 1999-2002
*** CAUTION! ***
ZAR Boot-Based Tools are extremelly powerful, and may cause MAJOR DAMAGE
when used improperly. Please read the manual completely before doing anything.
*** CONTENTS ***
This manual covers the following topics:
1. ZAR Boot-Based Tools overview.
2. Installation instructions.
3. List of tools, including a description and configuration requirements.
4. "Howto" for common usage pattern - disk-to-disk copying
5. List of all boot-time messages.
*** PURPOSE AND CONCEPTS ***
ZAR Boot-Based Tools (BBT) are all designed to work independently of an
operating system. They will still allow repairs even if MS DOS boot floppy
refuses to start. You can of course use these tools as a part of a normal
recovery process, with no extreme conditions.
BBT allow you to wipe the data on disk (i.e. write zeros to it), perform
a disk-to-disk copy in cases when the disk is physically near-to-fail, or
clear the MBR if its contents are corrupt. There are some cases when corrupt
MBR prevents DOS (and any other Microsoft operation system) from booting, even
from the floppy disk. The only solution in such a case is to completely bypass
DOS and work directly with the disk, like BBT do.
*** BOOT DISKETTE CREATION TOOL ***
Floppy creation tool (ZARBBT.EXE) writes the appropriate tool to the boot
sector of a floppy disk you provide. The floppy must be formatted and blank
(no files). The process is quite simple: just run ZARBBT.EXE, select a floppy
drive from list, then select a tool from list and it is done.
CAUTION: Installation of a boot-startable code modifies some system areas
of a floppy disk (including but may be not limited to File Allocation Tables)
in inadequate manner, so copying any file to the floppy will result in
boot-startable code corruption. Additionally, resulting floppy will be
considered damaged by disk checking software, such as ScanDisk or Norton Disk
Doctor. You must not try to run such tools to fix the floppy, for this will
lead to boot-startable code corruption.
After the floppy has been written, it is ready for use. Make sure the
configuration requirements for a particular tool are fullfilled, check that
your BIOS is configured to first attempt to boot from floppy disk, insert the
floppy in drive and reboot.
*** LIST OF TOOLS ***
*** ZAR Disk Eraser ***
Writes zeros to all sectors on disk, DESTROYING ALL DATA previously on
the disk. The intended use is a disk preparation to use as a copy target with
ZAR Disk-To-Disk copier.
Configuration requirements:
1. Target disk should be the ONLY device BIOS recognizes as a hard drive.
2. Partition table on the disk must be empty (deleting all partitions
with FDISK is sufficient).
*** ZAR Disk-To-Disk Copier ***
Copies first hard disk in a system to second hard disk sector-by-sector,
skipping sectors which produce an error on read. No useful data can be ever
overwritten with this tool (see notes below). It can be used to create a drive
copy to operate on (istead of the original damaged drive), including cases
when a damaged drive has physically bad sectors.
Configuration requirements:
1. There must be exactly two disks in a system.
2. Of these two, source disk must be the first BIOS device (ID 0x80) and
target must be installed as the second BIOS device (ID 0x81).
3. Target disk must be completely zero-filled beforehand.
Important notes:
1. Should some non-zero data be discovered on target, copy process will
be immediately aborted, thus ensuring that no data will be overwritten (even
in case of misplaced target and source disks)
2. Target disk can be smaller than source disk. In such a case, copy
process is considered completed as soon as target disk is filled. However, you
will be warned should this condition be detected.
3. If read error occurs on a source disk, zeros are written to a
corresponding sector on target. Number of read errors is displayed during
copy.
4. If write error occurs on a target disk, these data are merely lost,
and copy process continues WITHOUT ANY NOTIFICATION. Number of write errors is
not shown. So make sure your target drive works fine before you use it. (Note
that Disk Eraser tool reports the number of write errors, if you had used it
for target preparation).
*** ZAR MBR Eraser ***
Erases Master Boot Record (MBR). There are several possible reasons to do
this. Most common are:
1. You need to delete all partitioning information from disk, but FDISK
fails to perform this for some reason.
2. MBR is damaged, and its damage does not allow you to boot even from a
DOS floppy disk (symptoms: when you insert a boot floppy and the hard disk in
question is properly attached, loading stops after "Verifying DMI Pool
Data..." message or after PCI devices listing, with no error messages shown.
However, when you disconnect the hard disk, DOS boots normally).
Two options exist (you will be prompted during boot-time operation):
either wipe the MBR completely (including all partition information) or modify
the MBR so it will not be recognized by BIOS/DOS as a valid boot sector, thus
allowing you to boot at least with DOS and perform repairs (in this mode, only
55AAh signature is removed from MBR).
Configuration requirements:
1. Target disk should be the ONLY device BIOS recognizes as a hard drive.
*** COMMON USAGE PATTERNS ***
Problem: Hard disk containing important data is worn out and there are
bad sectors on it (including in a system areas).
Hint: It would be much easier (and much safer) to work with a physically
functional copy of the original disk.
Proposed actions:
1. Get another disk, of equal or greater size.
2. Zero-fill it.
3. Copy faulty disk to this new disk.
4. Run data-recovery tools against the new disk, thus mitigating the risk
of further damaging the original.
To do this:
1. Prepare 2 empty formatted floppies and run ZARBBT in order to write
two tools onto them: Disk Eraser and Disk-to-disk Copier. Mark the flopiies by
writing big red labels on them, so noone uses these floppies later without
reformatting.
2. Make sure you have correct boot order set in BIOS setup, allowing you
to boot from floppies first.
3. Get another hard disk (borrow from someone if you have no spare disk
readily available). Mark it clearly as a "TARGET" disk (I myself do this by
writing on a disk itself with a red marker). Having disks marked distinctly is
important, as it reduces a risk of messing everything up. Backup all data from
it (it will be completely overwritten in process). Delete all partitions on it
using FDISK.
4. Turn off the system. Don't forget to turn off 5V standby power as
well. If you are unsure about this, simply pull the power cord out of the
outlet or UPS - this will do. Disconnect the faulty drive and remove it from
the system. Mark it clearly as a "FAULTY" disk (I do it with a marker again).
Put the "FAULTY" disk away.
5. Disconnect all IDE cables in a system. Insert "TARGET" disk into the
system and plug it in with a cable to a Secondary IDE channel. Check that
"FAULTY" disk still lies away where you put it.
6. Insert ZAR Disk Eraser floppy and turn on the power. Enter BIOS setup
and perform a disk autodetection. It should detect target disk as either
Secondary Master or Secondary Slave. Then, proceed with zero-filling the
"TARGET" disk. Note number of errors reported during process - normally, it
must be zero. 10 errors or so are still tolerable. When drive is erased
(SYSTEM HALTED message appears), wait ten seconds, then turn off the power.
7. Connect the "FAULTY" disk to a Primary IDE channel. Insert ZAR
Disk-to-Disk Copier floppy and turn on the power. Enter BIOS and repeat
autodetection. A new drive ("FAULTY" one) should appear on Primary IDE
channel. Exit BIOS Setup (don't forget to save the changes), and proceed to
boot off the floppy disk.
8. If you have everything set up correctly, the copy will start (as soon
as you confirm it). When it is done, note the number of read errors reported
by a copier. Write it down for further reference. Then, power down the system,
then remove "FAULTY" HDD and put it away. You can now run data recovery tools
on a copy of a disk.
*** LIST OF ALL POSSIBLE BOOT-TIME PROCESSING MESSAGES ***
Message list is in the following format:
--------------------------------------------------------------------------------
Message
--------------------------------------------------------------------------------
Tool: [name of a tool producing this message]
Type: [message class]
Explanation.
Proposed action(s).
--------------------------------------------------------------------------------
SYSTEM HALTED.
Please wait at least 10 seconds for the disk to flush caches...
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Informative
Menas just what it says. The processing is either completed or aborted
due to an error. The error message, if any, is shown just above the "System
Halted" message. On most modern disks you should wait some time for a disk to
flush its onboard write-back cache. System restart must be performed with a
Reset button or power cycle (Ctrl+Alt+Del will not work).
Wait 10 seconds, then press Reset button.
--------------------------------------------------------------------------------
Disk 0x8X - number of sectors YYYYYYYY
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Informative
Indicates a disk size. 0x8X is a disk BIOS ID (with 0x80 being first HDD,
0x81 - second HDD), and YYYYYYYY is a total number of sectors on disk,
hexadecimal.
No action required.
--------------------------------------------------------------------------------
Processing sector XXXXXXXX, YYYYYYYY error(s)
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Informative
Indicates a progress of current operation. XXXXXXXX is a hexadecimal
number of sector currently being processed, and YYYYYYYY is a hexadecimal
number of errors encountered so far.
No action required.
--------------------------------------------------------------------------------
Must be exactly X drive(s) in system, actually found Y drive(s)
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Error
Actual disk configuration violates the configuration requirements for the
particular tool.
Review the requirements and physically reconfigure hardware to match
them. Basically, remove all unnecessary storage devices from the system.
--------------------------------------------------------------------------------
If you want to continue please type:
"I confirm this" (case matters):
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Confirmation request
Program is requesting a confirmation before proceeding with some (not
necessarily destructive) operation. The confirmation is complicated to avoid
accidental activation of any destructive features.
Review previous program output to ensure you are doing everything
correctly. Then type "I confirm this" without quotes. Any typing error will
result in immediate execution termination. Backspace is not allowed.
--------------------------------------------------------------------------------
Disk is of unsupported size.
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Error
Disk exceeds 128Gb in capacity. Such disks are not supported in current
version.
Report a bug if you wish.
--------------------------------------------------------------------------------
Generic Int13x call error.
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Error
Int 13h Extensions BIOS unexpectedly reported an error (during some basic
function call, which should be always possible and successful).
Check hardware. A disk may be completely faulty. If you have older
motherboard, retry on another system (with a newer one). If none of this
applies, contact me.
--------------------------------------------------------------------------------
Reported disk size is 0.
--------------------------------------------------------------------------------
Tool: Multiple tools
Type: Error
BIOS reported a disk as having a zero size. This is out of a normal order
of things.
Check hardware. A disk may be completely faulty. If you have older
motherboard, retry on another system (with a newer one). If none of this
applies, contact me.
--------------------------------------------------------------------------------
Non-zero data discovered on target, aborting...
--------------------------------------------------------------------------------
Tool: Disk-to-disk Copier
Type: Error
Copy process was aborted to prevent a data loss on a target disk. See
configuration requirements for disk copier tool.
Check if your disk subsystem is set up correctly (i.e. SOURCE drive goes
first). Zero-fill the target drive (remember to disconnect source beforehand).
--------------------------------------------------------------------------------
WARNING: Target disk is smaller than source disk.
--------------------------------------------------------------------------------
Tool: Disk-to-disk Copier
Type: Confirmation request
It was discovered that you are about to copy larger drive onto the
smaller one. You can still proceed if this is what you want.
If it is OK to perform a partial copy, just type "I confirm this" (no
quotes, case matters). Otherwise check if your disk subsystem is set up
correctly (i.e. SOURCE drive goes first).
--------------------------------------------------------------------------------
Partition table must be empty on a disk to be erased.
--------------------------------------------------------------------------------
Tool: Disk Eraser
Type: Error
It was discovered that a drive still has some data on it, and a erase
process was aborted.
Check if you are erasing a correct drive. Delete all partitions from it
(either using FDISK or with ZAR MBR Eraser tool, Complete Wipe mode).
--------------------------------------------------------------------------------
Operation completed (no errors reported)
--------------------------------------------------------------------------------
Tool: MBR Eraser
Type: Informative
Indicates that disk write was performed successfully.
No action required.
--------------------------------------------------------------------------------
Operation completed (disk reports error)
--------------------------------------------------------------------------------
Tool: MBR Eraser
Type: Warning
Disk reported an error when asked to write to a Master Boot Record. The
sector is (probably) unchanged and/or in uncertain state. This usually
indicates some problems with the medium.
Check if disk is physically functional. If it is not, copy it
sector-by-sector to another disk and continue recovery with a physically
functional copy.
--------------------------------------------------------------------------------
Invalid input
--------------------------------------------------------------------------------
Tool: MBR Eraser
Type: Error
You entered an invalid value when asked to choose the operation mode.
Restart the system (either by Reset button or by cycling power), then
retry.