Chip 2005 August/CHIP_CD_2005-08.iso/bonus/photo_rest/files/setup.exe/{app}/DOS/MANUALS/zarntfs.txt

Text File | 2002-01-21 | 14KB | 289 lines

                  Zero Assumption Recovery (ZAR) version 6.3
                           NTFS recovery (ZARNTFS)
                                USER'S MANUAL
                   Copyright (C) Alexey V. Gubin, 1999-2002

                         *** SYSTEM REQUIREMENTS ***

     * 386 or better processor
     * 4Mb memory + 1Mb memory per gigabyte of volume to recover
     * Additional disk device to store recovered data (preferably another HDD)
     * MS-DOS operating system or MS Windows 9x in DOS mode
     * HIMEM.SYS driver installed

                        *** DATA RECOVERY PROCESS ***

     It  is  recommended  that  you  print  this manual so you can refer to it
during the recovery process.

     Volume reconstruction basically consists of the following stages:
     1. Determining the area to be recovered and configuring options
     2. Pattern scanning of that area
     3. Reconstruction of disk parameters based on pattern scan results
     4. Reconstruction of directory tree
     5. Recovering selected directories to another medium
     6. Restoring long file names


                *** STAGE 0 - SETTING UP RECOVERY PROCESS ***

     ZAR  cannot  be  used from within any multitasking environment (including
Windows),  so  you  must  reboot from floppy disk or restart Windows in MS-DOS
mode.

                           0.2 - LOG FILE LOCATION

     Once  you  start  ZAR,  you will be asked about log file location. Please
note that log file can grow as large as 10 megabytes in size (for large disks)
and  it  is  written  to  quite  often. So if you want logging, you should put
logfile on a large and fast medium (I recommend using the same medium you plan
to  recover  data  to).  You  can press ENTER to accept default location (in a
ZAR.EXE directory), enter NUL to disable logging or enter your custom log file
name.

            *** STAGE 1 - DETERMINING THE AREA TO BE RECOVERED ***

     First  of  all  you  are  prompted  to select a physical disk you want to
recover.  ZAR  displays  a  list  of  compatible  disks  found,  showing their
parameters  (including capacity). Highlight the desired drive and hit "Enter".
Two additional options exist here:

     1. You can load the disk image from file. For more information about disk
images, see appendix A in ZARFAT.TXT manual.

     2.  You  can  choose  to  load previously saved scan results. You will be
asked  about a file name later, because save file is only valid for a disk the
scan  was  run  on. After requesting a save file, you should select a disk (or
image  file)  matching  the  save file. Once the disk is selected, you will be
asked  about the save file name. Program checks the disk size stored in a save
file  against the size of a selected disk (or image) and displays a warning if
it detects a mismatch.

     If  the  physical  disk  is  selected,  program  will perform some simple
hardware  diagnostics  and  try  to  read  partition table to determine volume
layout.  If  partition  table  is  (at  least  partially) correct, the list of
available volumes will be displayed with the following information:

1. Partition type ("Type")
     This  can be either PRI for primary partition or EXT for logical drive in
extended  partition.  This  field  is only provided for reference, and you can
ignore it if you are not familiar with these FDISK terms.

2. Filesystem type for the partition ("OS / Filesystem type")
     This  is  a file system type as indicated by a partition table. For NTFS,
"NTFS,  HPFS  or QNX" is reported, because all these filesystems have the same
type identifier value in Partition Table.

3. Active partition flag ("Active")
     This  is  "Yes" when the volume is used for OS startup. Otherwise "No" is
displayed.  Only  a  single partition (on physical disk) can be active, and it
must be primary ("PRI" partition type shown).

4. Start offset, in megabytes ("Start at, Mb")
     This  is an offset of the first partition sector (form the start of disk)
in  megabytes.  In  most  cases it should be equal to the sum of sizes for all
previous volumes.

5. Volume size, in megabytes ("Vol. Size, Mb")
     This is a volume size as indicated by partition table

6. Boot sector signature status ("Boot Sig")
     Shows  if  the  volume boot sector looks correct. Can be either "Good" or
"Bad"

     A  number  of  tests is performed in attempt to check partition table for
consistency. Should these tests fail, a warning will be displayed stating that
partition table is untrustworthy and describing problems found.
     Possible causes include:
     1. Too much space left unallocated (this can be a false alarm).
     2. Volumes that are sized greater than a physical disk can hold.
     3. Some volumes overlapping each other.
     4.  Some  volumes  having  bogus records (such as end sector before start
sector) but still can be recognized.
     5. Some partition table records damaged beyond recognition.

               Case 1.1 - PARTITION TABLE EXISTS AND IS CORRECT

     This is a case when no messages about bad signatures are shown and volume
layout  shown  on the "Select partition to recover" screen is correct. In this
case  you  should  simply  select the volume you want to recover from the list
displayed.

       Case 1.2 - PARTITION TABLE IS DAMAGED OR CONTAINS INCORRECT DATA

     Systems  with  missing  (e.g.  overwritten)  partition  table exhibit the
following symptoms
     a.  Volumes,  which  are  known  to  be  on  the disk, are not shown when
operating system starts
     b.  ZAR  reports  that "Partition table sector 0 signature is bad" and/or
"Partition table seems to be damaged"
     c. ZAR shows no volumes on a "Select partition to recover" screen

     Systems  with  (partially)  corrupt partition table exhibit the following
symptoms
     a. Some volumes are not shown when operating system starts
     b.  ZAR reports that "Partition table sector N signature is bad" and N is
not zero
     c. ZAR shows incomplete or incorrect information about volumes

     You  may  also  want  to  specify volume layout manually after accidental
FDISKing  the  drive.  In  those  cases  partition table is valid but actually
contains wrong information.

     If  the  volume  you  want  to  recover  is  either  missing or displayed
incorrectly, you should manually select area for recovery. This can be done by
entering  values  for  start  sector  and  size of the volume. This values are
accepted  in  sectors or in megabytes (which are automatically recalculated to
sectors). Volume start offset (first sector) is usually a sum of sizes for all
volumes preceding the volume in question.

Assume as the example that there was a following partition layout:
     C: - 5 Gb volume (system startup)
     D: - 5 Gb volume
     E: - 10 Gb volume
     giving 20 Gb of total hard disk capacity
     Corresponding  start  offsets  will be 0 Mb for volume C:, 5000 Mb for D:
and  10000  Mb  for  E:.  It  is  recommended to subtract 10..100 Mb (to avoid
calculation  errors,  such  as a possible confusion between decimal and binary
megabytes), adding the same values to the volume size.
     Taking  the  above  into account, the following values should be used for
this example:
     C: - 0 Mb offset, 5000 Mb size
     D: - 4900 Mb offset, 5100 Mb size
     E: - 9900 Mb offset, 10100 Mb size.


     WARNING: Should you specify incorrect area to search in, the entire
     recovery will fail.

                      *** STAGE 2 - PATTERN SCANNING ***

     Pattern  scanning  is  used  to  detect  all  recognizable pieces of data
remaining on volume. It is always a tradeoff between gathering as much data as
possible  (to  allow  for  successful recovery) and not to gather the infinite
quantity  (for  higher  analysis  speed).  Recognition  for some types of disk
areas  is mandatory (these are system structures). You can disable recognition
for  others, but it is strongly recommended that you leave the default setting
(All enabled) and select "Proceed".
     Program  scans  the area you selected during stage 1 and locates all data
pieces it can recognize. This information is then used in analysis.

                     *** CONFIGURING RECOVERY OPTIONS ***

There are the following options available in ZARNTFS:

1. "Recover long file names". "Yes" or "No", "Yes" by default.
     This  toggles long file name information recording (see STAGE 6 below for
details of LFN reconstruction process).

2. "Recover erased files". "Yes" or "No", "Yes" by default.
     This  option controls recovery of files erased prior to a disk crash. Not
of a much use, except for mass undeletions after virus attack.

3. "Skip files > X Mb, 0 - all files". Number from 0 to 2047, 100 by default.
     With  this  option  active  files  greater  than X Mb in size will not be
recovered.  Value  of  0 disables size checking. I consider the default 100 Mb
limit  to  be acceptable (swapfiles and MPEG/AVI videos are common examples of
what will be filtered out).

4. "Simulation mode (DEBUG)". "Yes" or "No", "No" by default.
     This  option  is intended primarily for debugging purposes. It SHOULD NOT
be  used  during normal recovery run. If "Simulation" is set to "Yes" ZAR will
create  directories  and files requested, but NO DATA WILL BE WRITTEN to files
(they will be all of zero size). However, the logfile will be created.

     When options are configured, hit "Proceed"

               *** STAGE 3 - DISK PARAMETERS RECONSTRUCTION ***

     NTFS has 3 significant volume parameters, namely
     1.  FRS size - size of a so-called "File Record Segment", an entry in the
volume  Master  File Table (MFT), which describes a file or directory. At least
one FRS is recorded into MFT for each file.
     2. Cluster Factor (CF) - a number of sectors per cluster.
     3. Start Sector (SS) - sector number for cluster number 0.

     All MFT records on volume have the same FRS size, so its determination is
very  simple.  ZARNTFS  will  show the table which lists all possible FRS size
values,  along  with  their  "Relevance". In this case "Relevance" is simply a
percentage  of  records  having  this  FRS  size.  You  should choose the most
relevant  value from list (it is already highlighted as default choice, so
in most cases you only need to press Enter).

     CF  and  SS  understanding  (and  determination)  is  a  little  bit more
difficult.
     Locations  of  the  files  on volume are expressed in number of clusters,
while  the same locations on the physical disk should be expressed in sectors.
Number  of  sector  is  computed  from  the number of cluster by the following
simple formula:

                          Sector = CF * Cluster + SS

     where  CF (Cluster Factor) is number of sectors per cluster and SS (Start
Sector) is a sector number for cluster 0.
     When  volume is damaged, values of CF and SS are usually lost or corrupt,
so they are determined statistically based on pattern scan results.

     Automatic  CF  determination  procedure  simply tries all possible values
from  1  to  16  and  computes  a  number of errors for each value. The table
usually looks as follows
     CF = 1 gives 0% errors
     CF = 2 gives 0% errors
     CF = 4 gives 0% errors
     CF = 8 gives 50% errors
     CF = 16 gives 75% errors
     and so on.
     The  maximum  CF  value  that gives less than 20% errors (which can arise
from  old  data  and from pattern scanning errors) is considered good. You can
however   enter   a  broader  range  of  CFs  to  search,  if  you  know  that
autodetected value is incorrect.

     For  each  CF  value  in  a selected range, Start Sector (SS) is guessed.
Total  execution time for this stage is limited to approximately 3 minutes per
each CF value tested.

     When  it  is  finally  done,  you are to choose between several variants,
which  are  displayed with their corresponding relevance values. In most cases
you should select the first (default) variant (with maximum relevance).

               *** STAGE 4 - DIRECTORY TREE RECONSTRUCTION ***

     This  step  is  fully  automatic and you cannot interfere with a process.
During  the  reconstruction  process  the details are shown on screen, but you
should merely ignore them (they are recorded into the log file as well).

                     *** STAGE 5 - RECOVERING FILES ***

     When directory tree is refined, you are presented with a simple directory
tree  viewer.  The  viewer tries to find the most readable form of a directory
name  to  display.  When  a long name is available for a directory, it will be
shown.  ZARNTFS  shows  a number of files in the directory following its name.
Use  Up  and  Down  arrow  buttons  to  move  through the list and Spacebar to
select/deselect   directory.  The  full  list  of  the  hotkeys  available  is
provided in a bottom line of screen.

     When done, press "S" to start recovery.

     You will be prompted about the target location where recovered files will
be stored.

     WARNING:  Never  copy  files  to  the volume you are recovering, as it is
likely to cause further damage!

     During the copy process the following information will be shown:
     * Total number of files requested.
     * Number of files copied
     * File name and size for the file being copied.
     * Some technical information (like filesystem flags for the file).

                   *** STAGE 6 - RECOVERING LONG NAMES ***

     During  file  copy  operation, long file name information is collected to
file  named LFNINFO.DAT. This file is stored in the directory you specified as
a  file  copy  destination. When copying is done, you should boot into Windows
(any  version  will  do,  but  it  must support the language used on a crashed
system), run FIXLFN.EXE and follow onscreen instructions.

     IMPORTANT:  Do  not  modify  the  recovered  data  location  (i.e. do not
rename/move files) before you run FIXLFN!