Chip: 2005 Utilities

home *** CD-ROM | disk | FTP | other *** search

/ Chip: 2005 Utilities / CHIP Utilities 2005.7z / CHIP Utilities 2005.iso / images / killdisk.igz / killdisk.img / uneraser.txt < prev next >

Wrap

Text File | 2002-04-14 | 18.7 KB | 469 lines

Active@ UNERASER for DOS Copyright (C) 2002 Active@ Data Recovery Software All rights reserved. USERS MANUAL Table of Contents 1. PRODUCT OVERVIEW 2. SYSTEM REQUIREMENTS 3. DIFFERENCES BETWEEN DEMO AND COMMERCIAL VERSION 4. OPERATING PROCEDURES 4.1. Bootable floppy disk (startup disk) preparation 4.2. Program start and information display 4.3. Scan and search for deleted file(s)/folder(s) 4.4. Deleted file(s)/folder(s) recoverability check 4.5. Deleted file(s)/folder(s) recovery (Commercial version only) 4.6. Scan and detection of deleted partition(s) and drive(s) 4.7. Scan existing or damaged partition(s) and drive(s) 4.8. Backup MBR, Partition Table, Volume Boot Sectors 4.9. Virtual restoration of MBR and Partition tables(s) 4.10. Disk Image creation 4.11. Using Disk Viewer 4.12. Localized file names display 4.13. Long file names display 4.14. Command line parameters 5. RECOVERY TIPS 1. PRODUCT OVERVIEW Active@ UNERASER is a compact and powerful DOS utility that can recover deleted files and folders on FAT12, FAT16, FAT32 and NTFS systems. It can even restore your files from deleted partition(s)! With this data recovery software you can access NTFS volume(s) from DOS and can recover deleted item(s) from NTFS partitions. This software does not even require you to install it on your system's hard drive, so there are no risks of possible overwriting data, which you want to recover. 2. SYSTEM REQUIREMENTS Minimum system requirements for Active@ UNERASER are: - AT compatible CPU with 286 or newer processor - 640Kb of RAM - 1.44 Mb floppy diskette drive - EGA 640x480 or better screen resolution - Bootable Floppy disk containing MS-DOS 6.0+, or startup disk for Windows 95/98/ME/XP - HDD of type IDE/ATA/SCSI attached to be recovered. 3. DIFFERENCES BETWEEN DEMO AND COMMERCIAL VERSION Active@ UNERASER for DOS version DEMO COMMERCIAL Can be saved and run from bootable floppy Yes Yes Displays complete physical and logical drive information Yes Yes Supports IDE / ATA / SCSI drives Yes Yes Supports large (more than 8GB) Hard Drives Yes Yes Supports FAT12, FAT16, FAT32, NTFS, NTFS5 file systems Yes Yes Supports non-english and long file names Yes Yes Supports compressed and fragmented files on NTFS Yes Yes Supports MS-DOS, Windows 95/98/ME/NT/2000/XP partitions Yes Yes Detects deleted primary/extended partitions and drives Yes Yes Scans partition(s) damaged by virus or with damaged MBR Yes Yes Ability to check file(s)/folder(s) recoverability Yes Yes Ability to preview file(s)/folder(s) before recover Yes Yes Supports search by file name or mask Yes Yes Disk Viewer displays content of any sector on the drive Yes Yes Ability to create Disk Image Yes Yes Creates backup for MBR, Partion Table, Boot Sectors Yes Yes Virtually restores MBR and Partion Table from backup Yes Yes Un-erases and saves deleted files/folders onto FAT drive - Yes Copies existing files/folders from FAT/NTFS to FAT drive - Yes 4. OPERATING PROCEDURES 4.1 Bootable floppy disk (startup disk) preparation If you do not have bootable floppy disk, you can make one using MS-DOS, Windows 95/98/ME/XP following these steps: FROM MS DOS Prompt - Boot the system in MS-DOS or Command Prompt mode, - Insert a blank floppy and type: FORMAT A: /S and follow the instructions on a screen. FROM WINDOWS 95/98/ME - Boot the system in Windows 95/98/ME. - Open the "Control Panel" and click the "Add/Remove Programs" icon. - Switch to tab "Startup Disk" and click the button "Startup Disk" and follow the instructions FROM WINDOWS XP - Boot the system in Windows XP - Insert blank floppy, and right-click A: drive in Windows Explorer - Choose "Format", and select the "Create an MS-DOS startup disk" option. Click the "Start" button Copy Active@ UNERASER for DOS (UNERASER.EXE) to the bootable floppy disk 4.2 Program start and information display - Boot from the floppy drive in DOS mode, or in Command Prompt mode in Windows 95/98 - Run Active@ UNERASER for DOS by typing: UNERASER.EXE - The UNERASER program window will open up. - On the left side of the window you will see the list of detected Hard Disk Drives (HDD). - HDD Partitions and Logical Drives are displayed underneath. - Deleted partitions and HDD space not occupied by partitions will be shown as "Unallocated space". - Use the arrow keys to move the cursor between the HDD and logical drives. Positioning cursor to a particular drive, displays its information on the right side of the program window. 4.3. Scan and search for deleted file(s)/folder(s) If you know the exact location of the deleted file or folder, you can scan the drive and folders by: - Selecting the drive containing the deleted file(s) and scanning it by pressing the [ENTER] key. - Positioning the cursor to the proper folder and scanning the folder by pressing the [ENTER] key. - Repeat scanning until you reach the folder where the file or folder is located Deleted files are marked with a solid mark on the left side If you do not know the exact location of the deleted file(s), use the search mode by: - Selecting the drive containing the deleted file(s) and pressing the [Ctrl]+[F] keys. - Enter the exact filename or search pattern in the "Search Dialogue type" and pressing the [ENTER] key. - Search will initiate. You can stop the search process at any time by pressing the [ESC] key. - If file(s) matching the search pattern are found, the file information is displayed. - Press the [Ctrl]+[F] keys to continue searching if you are unable to locate the required file(s). - Press the [ENTER] key to go directly to the folder where the file was located or press the [ESC] key to cancel further search The search pattern to use to find the file(s) and folder(s) is the same pattern that is used when performing search in DOS or Windows. The * (asterisk) symbol is used as a wild card character(s). * during the search process is replaced by any allowed possible character(s) available on the system for search purposes. The ? (Question mark) symbol is used for a single wild card character and is replaced by any allowed possible character available on the system for search purpose. Examples for searchable expressions: * - All files in the folder(s) or drives(s) *.TXT - all files with the "TXT" extension My*.* - all files starting with "My" text MyFile.txt - search for the file named "MyFile.txt" 4.4. Deleted file(s)/folder(s) recoverability check To check for recoverability for deleted file(s)/folder(s) use the following steps: - Boot in DOS mode and run Active@ UNERASER for DOS - Scan or search for deleted file(s)/folder(s) (see paragraph 4.3) - Find and position the cursor on a detected deleted file or folder. Deleted file(s)/folder(s) are marked on the left side. - Press the [ENTER] key to check the file's recoverability by previewing the deleted file content. - If the file is recoverable - its content can be seen in the Disk Viewer. - If the file is not recoverable - an error message is displayed. You can check for the folder's recoverability at the same way. Try to open the folder by pressing the [ENTER] key. If the folder is not recoverable an error message is displayed. But if the folder is recoverable only the file(s) or sub- folder(s) inside that folder are displayed instead. Note: A deleted file is unrecoverable if overwritten with other data, or if the file's header in the root folder is overwritten/ damaged. A deleted folder is unrecoverable if the folder's header is overwritten/damaged. Usually it happens when data is written / saved onto the drive where the deleted file/folder is located. 4.5. Deleted file(s)/folder(s) recovery (Commercial version only) This functionality is only available in the commercial version of Active@ UNERASER for DOS. Use the following steps to recover deleted file(s)/folder(s): - Boot in DOS mode and run Active@ UNERASER for DOS - Scan or search the deleted file(s)/folder(s) (see section 4.3) - Find and position the cursor on your deleted file(s)/folder(s). Deleted files and folders are marked at the left side - (Optionally) Press the [ENTER] key to check for the recoverability by previewing the content of deleted file(s)/folder(s) (see section 4.4) - Press the [Ctrl]+[U] keys to execute the unerase command - If file(s)/folder(s) is recoverable, a dialog box is displayed where you can choose the output drive and path where the file(s)/folder(s) will be saved. - If it is not recoverable, an error message will be displayed instead. Note: The number and drive letters in this dialog box may not match with what was displayed in the previous window. It happens because the write operation is performed in DOS real mode and only the FAT drives are visible to the operating system as the output location. - Use the [TAB] key to move between controls, and press the [ENTER] key to change the drive or folder - Define the output name and location and press the [ENTER] key and start the recovery process - You can stop the recovery process at any time by pressing the [ESC] key - If you recover a folder, all recoverable file(s) and/or sub-folder(s) located in the deleted folder will be recovered and saved to the new location recursively. 4.6. Scan and detection of deleted partition(s) and drive(s) To scan and detect the deleted partitions and drives use the following steps: - Boot in DOS mode and run Active@ UNERASER for DOS - Position to "Unallocated" line below the HDD containing deleted partition - Press [ENTER] to scan drive. If partition or logical drive is found, you are suggested to add it to the drive's list - If the partition parameters look similar, press the [Y] key to add it to the list and skip space equal partition size, otherwise press the [N] key to continue to scan the space allocated by this partition. - When a partition is properly detected and added to drive's list, position the cursor on the partition line and verify the partition's information - Press the [ENTER] key to scan the deleted partition for files(s) and/or folder(s) - Scan, search and recover file(s) and folder(s) on this virtual drive the same way as it's described in sections 4.3, 4.4, 4.5 4.7. Scan existing or damaged partition(s) and drive(s) When a partition is damaged, it will be displayed as type "Unknown". Active@ UNERASER cannot handle such a partition properly and is unable to preview the files and folders in that partition. It does not mean that the partition does not exist. It exists but as there is no "Unallocated" space on the screen, due to which it cannot scan it for other partition information detection. To solve this problem, start the program using the parameter -ignoreMBR. This will start Active@ UNERASER while ignoring the default MBR and partition information. This makes the Active@ UNERASER to scan the drive as if all the drives partitions are deleted. For example: A:\>UNERASER.EXE -ignoreMBR=80h After scanning, the "Unallocated" space will be displayed under HDD 80h. Try to scan it by pressing the [ENTER] key to detect and recover partitions as described in section 4.6. 4.8. Backup MBR, Partition Table, Volume Boot Sectors To make backups of MBR, Partition Table(s) and/or Volume Boot Sector(s) use the following steps: - Run Active@ UNERASER for DOS - Select the HDD which is to be backed up - Insert the floppy disk and press the [Ctrl]+[B] keys - Information will be saved to A:\HDD80h.MBR if HDD 80h is being backed up. Using this floppy the system's MBR can be virtually restored and partitions and drives will be viewable for the files and folders to be recovered. Note: It is strongly advised to make MBR and partitions backup every time the computer configurations is changed (such as adding/removing HDDs, partitions, logical drives). 4.9. Virtual restoration of MBR and Partition Table To virtually restore the MBR and Partition Table from backup use the following steps: - Insert floppy disk with the backup MBR file - Run Active@ UNERASER for DOS with the parameter of -restoreMBR like: A:\>UNERASER.EXE -restoreMBR=80h - It will virtually restore the MBR and Partition Table(s) to the state as it was before (when the MBR backup was created). You can see your drives and folders, and can recover the deleted file(s) and folder(s) to another drive (see sections 4.3, 4.4, 4.5). It is important to make MBR and Partition Table backup regularly. If a partition becomes damaged and requires restoration from the backup MBR, Partition Table and Volume Boot Sectors to the HDD, please be advised to use Active@ Partition Recovery software. 4.10. Disk Image creation A Disk Image is a copy of the hard drive saved in file. Disk Image can be useful for backup purposes or, even for the analysis by other utilities. Using Active@ UNERASER a Disk Image can be created for the whole Hard Disk Drive(s) as well as for a particular logical drive. Use the following steps for this purpose: - Run Active@ UNERASER for DOS - Select the drive (HDD or Logical) for which the "Disk Image" is to be created and press the [Ctrl]+[I] keys - Select the path on another logical or network drive where the "Disk Image" will be saved - A "Disk Image" can only be saved on a FAT or network drive - Press the [ENTER] key to see the progress and wait until creation of disk image is completed - To cancel this process press the [ESC] key at any time. Another way (available in commercial version only) is to run software with the parameter -image, for example: A:\>UNERASER.EXE -image80h=E:\BACKUPS "Disk Image" is a set of files: Drive_80h.hdd, Drive_80h.001, Drive_80h.002... Each file (except the last one) has a size of 1GB, because MS DOS does not support files having size more than 2GB. If you require a "Disk Image" of the whole drive in one file, these files can merge later manually. 4.11. Using Disk Viewer Disk Viewer allows view and accesses any sector on the physical or logical drive. Also it allows the preview of file sectors for the existing or deleted file (if it is still recoverable). - Run Active@ UNERASER for DOS - Select the object HDD to view physical sectors, Logical drive to view logical sectors, file/folder to view its sectors - Press the [Ctrl]+[S] keys to open Disk Viewer The Title displays the object to be viewed and the current sector number will be shown below. The rest of the area displays sector content in Hex view on the left side and Text View on the right side. - Use arrows, [HOME], [END] keys to scroll the view - Use [Page Down], [Page Up] keys to go to the next/previous sector - Press [Ctrl]+[G] to go the particular sector - Press [TAB] key to change Hex/Text view to Text Only and backward 4.12. Localized file names display Localized file names are stored on the drive in Unicode format. Operating System (Windows 95/98/ME/NT/2000/XP) creates filenames based on regional settings. Also Windows has set of fonts to handle and display filenames properly. MS DOS might have local fonts supported but it cannot display filenames in Unicode. Active@ UNERASER can display localized filenames in DOS only if a proper font definition file for the same locale settings is available. To prepare this file with font definitions follow these steps: - Download UNICODE.EXE and save it to the same place where UNERASER.EXE is located. - Boot in Windows 95/98/ME/NT/2000/XP that has the same locale settings and run UNICODE.EXE. - File UNICODE.DAT having size 65536 bytes should be created in the same folder. - Boot in DOS mode and run Active@ UNERASER for DOS - Scan your drive and switch to "Long file names" mode by pressing the [TAB] key Now you should be able to see your localized file names. Note: To be able to see localized filenames you must have support for the local fonts when booted in DOS mode. In other words, display driver for the proper code page must be loaded. 4.13. Long file names display Since Windows 95 OS launch filename is not limited to 8.3 patterns and can have a length of up to 255 characters. Standard View displays all files and folders the same way as DOS does, i.e. in 8.3 formats. However sometimes it is not convenient to see only first symbols of the long file name. To display long filenames (up to 36 symbols): - Boot in DOS mode and run Active@ UNERASER - Scan the particular drive by pressing the [ENTER] key - Press the [TAB] key to switch to long filenames view 4.14. Command line parameters Active@ UNERASER for DOS supports a set of command line parameters. To view them and their definitions, type: A:\>UNERASER -? Here is a list of command line parameters available: -lba - Force LBA mode for access to all detected HDDs -lba=N - Force LBA mode for access to the particular HDD Where N=[80h,81h,82h,83h] -restoreMBR=N - Virtually restore MBR from the backup for a particular drive Where N=[80h,81h,82h,83h] -ignoreMBR=N - Do not load MBR information for the particular drive, Where N=[80h,81h,82h,83h]. It allows scanning of existing or damaged partitions -imageN=PATH - Create image for the physical drive (Professional version), Where N=[80h,81h,82h,83h] and PATH=<drive>:\\<path\\> 5. RECOVERY TIPS Do not save the recovered files onto the same drive from where they were recovered. This can overwrite table records for deleted entities like file(s) and folder(s) and thus can intrude in the process of recovery. Please save your recovered data onto another logical, removable, network or floppy drive. Do not save/write/install anything onto the drive containing your important deleted data that is required to be recovered. Even installing the data recovery software to the same drive could make your sensitive data irrecoverable. Download and save Active@ UNERASER for DOS onto a bootable floppy and boot your system using that disk!