home *** CD-ROM | disk | FTP | other *** search
- TIRAMISU FOR NOVELL - SOPHISTICATED DATA RECOVERY
- (c) 1996, 1997, 1998 by Plug'n Play, Uwe Gissemann
-
-
- MANUAL
-
- 1. OVERVIEW
-
- 2. SYSTEM REQUIREMENTS
-
- 3. INSTALLATION
- 3.1. Boot diskette
- 3.2. Specify swap area
- 3.3. Which drive to RECOVER.
- 3.4. How to copy some or all files to a safe medium
-
- 4. RESULTS
- 4.1. Recovery quality
-
- 5. RESTRICTIONS
-
- 6. OPTIONS
- 6.1. Specify swap area
- 6.2. Restrict sectors
- 6.3. Logging (Logfile)
- 6.4. Restart from last / Keep for next session
- 6.5. Valid FAT Required
- 6.6. DET maintainance mode
-
- 7. VOLUME SELECTION WINDOW
-
- 8. TROUBLE SHOOTING
- 8.1. Computer frozen or runtime error
- 8.2. The resulting files contain garbage only
- 8.3. No volumes found at all or volume not listed
- 8.4. Drive structure recognition routine fails
- 8.5. "Restrict sectors" must match previous setting
- 8.6. Wrong disk size
- 8.7. Get a new version
-
- 9. REGISTRATION
-
- 10. NO WARRENTY
-
- 11. DISCLAIMER
-
-
-
-
-
- 1. OVERVIEW
-
- TIRAMISU FOR NOVELL is a software for reconstructing data from a crashed
- Novell server drive.
-
- It helps when the drive is
-
- - hit by a virus
- - formatted
- - 'fdisk'ed
- - zapped by a power failure
- - damaged by applications
-
- TIRAMISU FOR NOVELL scans the drive even when there are physical damages.
- The found data is analyzed and reconstructed. TIRAMISU FOR NOVELL can
- handle drives without readable boot sector, readable FAT or readable
- directories. It can recover data if you are unable to start the SERVER.EXE.
- It can handle drives that are not recognized by DOS anymore.
-
- TIRAMISU FOR NOVELL automatically creates a VIRTUAL DRIVE in memory.
- This virtual drive looks like a usual file manager. You can see the lost
- directories and files of your crashed drive. Now files and directories
- can be viewed and copied to a safe medium.
-
- The extensive use of our sophisticated pattern recognition technology
- enables TIRAMISU FOR NOVELL to put the right pieces of data together
- again. Even disks with very few administrative informations left can
- reach a high recovery quality.
-
- TIRAMISU FOR NOVELL is NON DESTRUCTIVE and READ ONLY. It does not put any
- data onto your crashed drive. Recovered data are restored to another
- destination (disk, diskette, network, interlink). TIRAMISU is run from
- a DOS diskette or drive.
-
- TIRAMISU FOR NOVELL works on NOVELL 3.XX and 4.XX with and without file
- compression. (For further information see section 4.1).
-
- Versions for DOS/WINDOWS (FAT16, FAT32) and WINDOWS-NT (NTFS) are
- available too.
-
-
- 2. SYSTEM REQUIREMENTS
-
- - 386 processor and up
- - 8 MB RAM and up
-
- Depending on the size of the drive to be recovered we recommend a 486 with
- 16 MB RAM. Installing 12 MB of EMS (Version 4) is recommended.
-
-
- 3. INSTALLATION
-
- 3.1. Boot diskette
-
- Create a boot diskette with a CONFIG.SYS similar to this:
- ┌─────────────────────┐
- │files=25 │
- │device=himem.sys │
- │device=emm386.exe ram│
- │DOS=HIGH │
- └─────────────────────┘
- Make sure you have specified the correct drive parameters
- in BIOS setup (Look to sec 8.6.).
-
- Boot the computer and start the program TIRANOV.EXE (best starting point
- is a good second harddisk).
-
-
- 3.2. Specify swap area
-
- By default TIRAMISU FOR NOVELL uses EMS as swap area. If for
- some reason there is no or not enough EMS you can specify a swap
- area on disk.
- Select OPTION -> DATA RECOVERY, tag 'DISK', specify path.
-
- CAUTION: Do not swap to the drive you intend to recover.
-
- You can swap to another computer via INTERLINK if you do not have
- enough memory or a second hard drive (typical laptop situation).
- However this should be your last choice because the speed would
- decrease dramatically.
-
-
- 3.3. Which drive to RECOVER.
-
- You can switch between the drives using the TAB key.
- Hit RECOVER for the drive you want to recover.
- HD 128 is normaly C: and 129 is D: and so on...
-
- ┌──────────────────────────────────────────────────────────────────┐
- │ File Options Registration Help Registered 14:05:35 │
- │ TIRAMISU FOR NOVELL DATA RECOVERY │
- │ SOPHISTICATED DATA RECOVERY (V2.13) STATUS │
- │ (c) '96 by Plug'n Play, Uwe Gissemann │
- │ CLASSIFICATION│
- │┌─── HD 128 ────┐┌─── HD 129 ────┐╔═══ HD 130 ════╗ Scan │
- ││ 786* 64* 63 ││ 611* 64* 63 │║ 1024* 64* 32 ║ │
- ││ 3169152 sec ││ 2463552 sec │║ 2097152 sec ║ INTERVAL │
- ││ 1547 MB ││ 1202 MB │║ 1024 MB ║ Calc │
- ││ RECOVER ▄ ││ RECOVER ▄ │║ RECOVER ▄ ║ Test │
- ││ ▀▀▀▀▀▀▀▀▀ ││ ▀▀▀▀▀▀▀▀▀ │║ ▀▀▀▀▀▀▀▀▀ ║ Size │
- │└───────────────┘└───────────────┘╚═══════════════╝ │
- │ VOLUME │
- │ Fat │
- │ Trans │
- │ Fet │
- │ Files │
- │ │
- │ DONE │
- │ │
- │Alt+F3 Close F10 Menu F7 Copy F8 View E:28896 403648 │
- └──────────────────────────────────────────────────────────────────┘
-
- TIRAMISU FOR NOVELL starts processing. Depending on your system's
- speed and the size of your drive this can take 30 minutes or even
- up to 24 hours.
- Finally you will be shown a window containing propositions what the
- lost Novell volume(s) might have been.
-
- ┌──────────────────────────────────────────────────────────────────┐
- │ File Options Registration Help Registered 14:05:35 │
- │ TIRAMISU FOR NOVELL DATA RECOVERY │
- │ SOPHISTICATED DATA RECOVERY (V2.13) STATUS │
- │ (c) '96 by Plug'n Play, Uwe Gissemann │
- │ CLASSIFICATION│
- │┌─── HD 128 ────┐┌─── HD 129 ────┐╔═══ HD 130 ════╗ Scan │
- ││ 78╔═[■]═══════════ Select a volume to recover ═══════╗ │
- ││ 31║ START: 238544 ( 942MB) BS: 8KB SCORE:29 ║VAL │
- ││ 1║ START: 62544 ( 90MB) BS: 8KB SCORE:6 ■ ║c │
- ││ R║ START: 223568 (*378MB) BS: 8KB SCORE:1 ▒ ║t │
- ││ ▀║ START: 68752 (*605MB) BS: 8KB SCORE:1 ▒ ║e │
- │└────║ START: 131184 (*684MB) BS: 8KB SCORE:1 ║ │
- │ ║ ║E │
- │ ║ OK ▄ Cancel ▄ ║ │
- │ ║ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ║ns │
- │ ╚══════════════════════════════════════════════════╝ │
- │ Files │
- │ │
- │ DONE │
- │ │
- │Alt+F3 Close F10 Menu F7 Copy F8 View E:28896 403648 │
- └──────────────────────────────────────────────────────────────────┘
-
- Select the entry that describes your lost volume best.
- THE BEST CHOICE IS USUALLY THE FIRST ENTRY.
-
- Entries with a high score are better than low ones.
- Entries without "*" are better than entries with a "*".
- Ignore entries that start at 0.
-
- Please read section 7 ("VOLUME SELECTION WINDOW") for further
- information or if the recovery is not successful.
-
- TIRAMISU FOR NOVELL continues processing. This can take up to 2 hours.
-
-
- 3.4. How to copy some or all files to a safe medium
-
- Now you see the virtual drive and you can view and copy (registered
- version only) the files to any DOS-available destination by pressing
- the F7-key.
-
-
- 4. RESULTS
-
- The virtual drive is a file manager like window. It will look like this:
-
- File Options Registration Help Not registered 16:30:03
- ╔═[■]═══════════════╤════ Virtual Drive ════════════════════════════[]═╗
- ║ ├──ETC _RUN.OVL 2815 19.01.93 10:33 _____r 00002
- ║ │ └──SAMPLES ▒ WHOAMI.EXE 26843 11.05.93 10:49 _____r 00002■
- ║ ├──00000158.DIR ▒ NPRINTER.EXE 43008 01.06.93 09:19 _____r 00001▒
- ║ ├──MAIL ▒ ALLOW.EXE 22557 13.05.93 12:29 _____r 00001▒
- ║ │ └──1 ▒ SETTTS.EXE 11471 14.04.93 16:55 _____r 00002▒
- ║ ├──PUBLIC ▒ REMOVE.EXE 27513 14.04.93 09:47 _____r 00001▒
- ║ │ ├──WIN ▒ PCONSOLE.EXE 183523 01.06.93 01:32 _____r 00001▒
- ║ │ ├──OS2 ▒ STATUS.ME 1022 11.09.92 20:30 ______ 00000▒
- ║ │ │ └──BAK ▒ SYS$HELP.DAT 14092 29.01.91 14:39 _____r 00002▒
- ║ │ ├──IBM_PC ▒ TEXTUTIL.HEP 11735 26.10.92 16:06 _____r 00002▒
- ║ │ │ ├──MSDOS ■ SYSTIME.EXE 7285 14.04.93 17:16 _____r 00002▒
- ║ │ │ │ ├──V6.22 ▒ SYS$MSG.DAT 25138 30.01.91 15:10 _____r 00002▒
- ║ │ │ │ └──V5.00 ▒ SYSCON.EXE 273454 11.04.94 15:33 ______ 00002▒
- ║ │ │ └──WIN ▒ USERLIST.EXE 20023 06.05.93 10:59 _____r 00002▒
- ║ │ │ └──V3.1 ▒ BTRCALLS.DLL 40674 20.09.91 01:23 ______ 00000▒
- ║ │ ├──UNIX ▒ NWLOCALE.DLL 34480 18.05.93 13:00 a_____ 00002▒
- ║ │ └──NLS ▒ VOLINFO.EXE 81587 14.04.93 15:16 _____r 00002▒
- ║ ├──HPCS ▒ NPRINT.MSG 17990 18.05.93 09:26 a_____ 00000▒
- ║ │ ├──FAXWARE ▒ NCOPY.EXE 99373 03.05.93 17:08 _____r 00001▒
- ║ │ │ ├──CLIENTS ▒ SETPASS.EXE 23947 19.04.93 10:55 _____r 00002▒
- ║ │ │ │ ├──DOS TLIST.EXE 23945 12.04.93 13:44 _____r 00002
- ╚▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓═╧══════════════════════════════════════════════════─┘
- Alt+F3 Close F10 Menu F7 Copy F8 View E:25M 326696
-
- On the left side you can see the directory names. Depending on the drive's
- condition there might some dummy directories (e.g. 00000158.DIR).
-
- The right part of the windows contains the file and directory entries of
- the directory you selected on the left side.
-
- You can copy (registered version only) the recovered files either from
- the left or the right side of the virtual drive window. If you want to
- retrieve the whole drive you should select "ROOT" on the left side
- and press F7-Copy.
-
-
- 4.1. Recovery quality
-
- Of course the quality of the recovered files depends on the condition
- of the drive.
-
- If the recovery was done without FAT (usually entries with a "*"
- from the VOLUME SELECTION WINDOW) the quality might be poor due
- to file fragmentation.
-
- IF YOUR SYSTEM WAS A NETWARE 4.XX *WITH* "FILE COMPRESSION" A
- RECOVERY WITHOUT FAT WILL BE COMPLETE GARBAGE.
-
- You should check the recovery quality before purchasing TIRAMISU FOR
- NOVELL.
-
- The recovery quality of a single file can be checked this way:
- Select a file in the right part of the window and press the space key.
- You will see a window like this:
-
- File Options Registration Help Not registered 16:30:03
- ╔═[■]═══════════════╤════ Virtual Drive ════════════════════════════[]═╗
- ║ ├──ETC _RUN.OVL 2815 19.01.93 10:33 _____r 00002
- ║ │ └──SAMPLES ▒ WHOAMI.EXE 26843 11.05.93 10:49 _____r 00002■
- ║ ├──0╔═[■]═══════════════════ WHOAMI.EXE ════════════════════════╗00001▒
- ║ ├──M║Attributes: _____r 00001▒
- ║ │ └║Date: 11.05.93 ▓00002▒
- ║ ├──P║Time: 10:49:10 ▓00001▒
- ║ │ ├║Length: 26843 (x000068DB) ▓00001▒
- ║ │ ├║Start: 8329 (x00002089) ▓00000▒
- ║ │ │║Group: 689 (x000002B1) ▓00002▒
- ║ │ ├║ID: 758 (x000002F6) ▓00002▒
- ║ │ │║File uses Fatx ▓00002▒
- ║ │ │║00002089─0000208A─0000208B─0000208C─│ ▓00002▒
- ║ │ │║ ▓00002▒
- ║ │ │║ ▓00002▒
- ║ │ │║ Ok ▄ ▓00000▒
- ║ │ ├║ ▀▀▀▀▀▀▀▀ 00002▒
- ║ │ └╚═■▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒═╝00002▒
- ║ ├──HPCS ▒ NPRINT.MSG 17990 18.05.93 09:26 a_____ 00000▒
- ║ │ ├──FAXWARE ▒ NCOPY.EXE 99373 03.05.93 17:08 _____r 00001▒
- ║ │ │ ├──CLIENTS ▒ SETPASS.EXE 23947 19.04.93 10:55 _____r 00002▒
- ║ │ │ │ ├──DOS TLIST.EXE 23945 12.04.93 13:44 _____r 00002
- ╚▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓═╧══════════════════════════════════════════════════─┘
- Alt+F3 Close F10 Menu F7 Copy F8 View E:25M 326696
-
- Important for the quality is the statement "File uses FATX". If no FAT
- has been used at all the recovery quality might be poor.
-
- Return to the file manager window and VIEW (F8) the file. You should
- see the content of this file in a hex viewer.
-
- HINT: Ascii text files are easiest to check (*.TXT, *.BAT). However,
- you also can check EXE or DLL files. They start with "MZ" followed by
- binary data.
-
-
- 5. RESTRICTIONS
-
- Since TIRAMISU FOR NOVELL is very memory hungry, your PC might run
- out of memory. If you face this problem, install a memory manager with as
- much RAM and EMS as possible.
- Watch the available memory displayed at the bottom line. The value
- displayed at the far right shows the free RAM. The E:XXX shows the free
- EMS. The RAM should not go below 50000.
-
- You can recover drives up to 8GB. However the actual ability might be
- limited by the memory available. We are working on further upgrades to
- improve the handling of bigger drives.
-
-
- 6. OPTIONS
-
- There are several options you can change in the OPTIONS->DATA RECOVERY
- screen:
-
- ╔═[■]═════════ Tiramisu Data Recovery Options ═════════════╗
- ║ Swap area: ***CAUTION: Don't swap to the drive ║
- ║ () EMS you intend to recover! ║
- ║ ( ) Disk C:\TEMP ║
- ║ ║
- ║ [ ] Restrict sectors ║
- ║ Scan 0 to 0 ║
- ║ ║
- ║ Logging to file: ║
- ║ ║
- ║ [ ] Restart from last [ ] Keep for next session ║
- ║ Restart file directory: C:\TEMP ║
- ║ ║
- ║ ║
- ║ [X] Valid fat required [ ] DET maintainance mode ║
- ║ ║
- ║ OK ▄ Cancel ▄ ║
- ║ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ║
- ╚══════════════════════════════════════════════════════════╝
-
- 6.1. Specify swap area
-
- By default TIRAMISU FOR NOVELL uses EMS as swap area. If for some reason
- there is no or not enough EMS you can specify a swap area on disk.
- Select OPTION -> DATA RECOVERY, tag 'DISK', specify path.
-
- CAUTION: Do not swap to the drive you intend to recover.
-
- You can swap to another computer via INTERLINK if you do not have
- enough memory or a second hard drive (typical laptop situation).
- However this should be your last choice because the speed would
- decrease dramatically.
-
-
- 6.2. Restrict sectors
-
- By default the whole drive will be scanned for Novell partitions. If for
- example you *know* that the Novell volume you want to recover is
- somewhere between sector 0 and sector 500000 of a 2GB drive (=4000000
- sectors) you can specify the area that will be scanned by TIRAMISU FOR
- NOVELL. This will speed up the recovery process.
-
-
- 6.3. Logging (Logfile)
-
- Use this option to create a log file of TIRAMISU's processing. This might
- be interesting for debug purposes.
-
-
- 6.4. Restart from last / Keep for next session
-
- The scanning of the drive can take up to several hours. It might be a
- good idea to keep the results of the drive scan for a future run of
- TIRAMISU FOR NOVELL. For doing this select OPTION -> DATA RECOVERY,
- tag KEEP FOR NEXT SESSION.
- This generates two files: SCAN_RES.RST and INTERVAL.RST.
- If you want to use scan results from a previous session tag RESTART
- FROM LAST.
- Specify a directory if you tagged one of these options.
- You always must select this option BEFORE hitting the RECOVER button.
-
-
- 6.5. Valid FAT Required
-
- By default TIRAMISU FOR NOVELL expects to find a valid FAT or at least
- FAT fragments on the drive.
- If TIRAMISU FOR NOVELL does not find the volume you want to recover
- untag this option.
- However, a recovery without any FAT will be poor.
-
-
- 6.6. DET maintainance mode
-
- By default TIRAMISU FOR NOVELL uses Novell's "directory entry tables
- (DET)". It might happen that these DETs are corrupt.
- If you miss files in the "Virtual Drive" tag this option on.
- Please note that this option does not effect the recovery quality of a
- single file.
-
-
- 7. VOLUME SELECTION WINDOW
-
- In this window you have to choose which volume you are going to
- recover. It is the most important decision you have to make
- during the data recovery process.
-
- ┌──────────────────────────────────────────────────────────────────┐
- │ File Options Registration Help Registered 14:05:35 │
- │ TIRAMISU FOR NOVELL DATA RECOVERY │
- │ SOPHISTICATED DATA RECOVERY (V2.13) STATUS │
- │ (c) '96 by Plug'n Play, Uwe Gissemann │
- │ CLASSIFICATION│
- │┌─── HD 128 ────┐┌─── HD 129 ────┐╔═══ HD 130 ════╗ Scan │
- ││ 786* 64* 63 ││ 611* 64* 63 │║ 1024* 64* 32 ║ │
- ││ 3169152╔═[■]═══════════ Select a volume to recover ═══════╗ │
- ││ 1547 M║ START: 238544 ( 942MB) BS: 8KB SCORE:29 ║ │
- ││ RECOVE║ START: 62544 ( 90MB) BS: 8KB SCORE:6 ■ ║ │
- ││ ▀▀▀▀▀▀║ START: 223568 (*378MB) BS: 8KB SCORE:1 ▒ ║ │
- │└─────────║ START: 68752 (*605MB) BS: 8KB SCORE:1 ▒ ║ │
- │ ║ START: 131184 (*684MB) BS: 8KB SCORE:1 ║ │
- │ ║ ║ │
- │ ║ OK ▄ Cancel ▄ ║ │
- │ ║ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ║ │
- │ ╚══════════════════════════════════════════════════╝ │
- │ │
- │ DONE │
- │ │
- │Alt+F3 Close F10 Menu F7 Copy F8 View E:28896 403648 │
- └──────────────────────────────────────────────────────────────────┘
-
- Select the entry that describes your lost volume best.
- THE BEST CHOICE IS USUALLY THE FIRST ENTRY.
-
- Every entry contains the following information:
-
- - Start sector of this volume (to be more exact: start of first FAT
- of this volume)
- - Size of this volume
- - Block size used by this volume
- - Score (entries with high scores are more likely to be valid than others)
- - A '*' indicates an inconstistency between the found FAT and the data
-
- Entries with a high score are better than low ones.
- Entries without "*" are better than entries with a "*".
-
- Please note that the proposed volumes are not neccessaryly real
- existing volumes. TIRAMISU uses advanced pattern recognition
- algorithms to decide which structure was the most likely.
-
- If the default choice does not show correct results or you are recovering
- a volume of a drive with more than one volume you must have a close look
- at the VOLUME SELECTION WINDOW.
-
- Example:
-
- Let's suppose you want to recover the third attached hard drive
- (HD 130). It is a 1GB drive that had this design before the
- crash:
- - 1 small DOS partition with 10MB
- - 1 Netware partition with two volumes:
- One volume with about 80MB
- One volume with about 900MB
-
- We want to calculate now which values for "START" we are looking
- for. The Netware partition begins after the small DOS partition.
- Therefore it begins approximately at sector 20000 (1 sector =
- 0.5KB).
- However, the start of the file system is defined by TIRAMISU as
- the location of cluster 0. This is usually the location of the
- start of the first FAT, not the start of the partition.
- The disk space used for additional administration outside of the
- file system takes about 20MB.
- Therefore the start of the first volume (to be exactly: cluster 0
- of the first volume's file system) is somewhere at sector
- 60000.
- The 2nd entry of the window will be correct for the 1st
- volume. The displayed size (90MB) is similar to the remembered
- size (80MB).
-
- If you want to recover the 2nd volume add the size of the
- first volume (80-90 MB) to the 60000 from the calculation above.
- This is a value of about 230000. Entry one is the correct entry
- for the 2nd volume.
-
- ╔═[■]═══════════ Select a volume to recover ═══════╗
- ║ START: 238544 ( 942MB) BS: 8KB SCORE:29 ║
- ║ START: 62544 ( 90MB) BS: 8KB SCORE:6 ■ ║
- ║ START: 223568 (*378MB) BS: 8KB SCORE:1 ▒ ║
- ║ START: 68752 (*605MB) BS: 8KB SCORE:1 ▒ ║
- ║ START: 131184 (*684MB) BS: 8KB SCORE:1 ║
- ║ ║
- ║ OK ▄ Cancel ▄ ║
- ║ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ║
- ╚══════════════════════════════════════════════════╝
-
- HINT: If possible do not use entries with a '*'.
-
- If the volume you want to recover is definitely not listed please
- read section 8.4. ("Drive structure recognition routine fails").
-
-
- 8. TROUBLE SHOOTING
-
- 8.1. Computer frozen or runtime error
-
- Sometimes you might think the computer is frozen and TIRAMISU FOR NOVELL
- is crashed. Be patient! Some procedures might take up to one hour. If
- TIRAMISU FOR NOVELL crashes you usually get an error code.
-
- If the program crashes check the available EMS and disk space. 32 MB ram
- configured as EMS are good.
-
-
- 8.2. The resulting files contain garbage only
-
- If you get only garbage files please read section 7
- ("VOLUME SELECTION WINDOW")
-
-
- 8.3. No volumes found at all or volume not listed
-
- If TIRAMISU FOR NOVELL does not find any volume tag off the option
- "Valid FAT required". Re-run TIRAMISU FOR NOVELL.
- Read section 7 ("VOLUME SELECTION WINDOW").
- Read section 8.4. ("Drive structure recognition routine fails").
-
-
- 8.4. Drive structure recognition routine fails
-
- If the "VOLUME SELECTION WINDOW" does not show your volume
- there are two possible reasons:
-
- - there is no volume anymore or the damage is too severe
- - TIRAMISU's drive structure routine has failed (yes, this can happen)
-
- The second reason can be solved the "hard way". Only professionals
- with a strong background should try the following solution.
- Please understand that we do not provide support on the following
- procedure.
-
- 1. Start Norton's DISKEDIT. Select the drive you want to recover
- PHYSICALLY.
-
- 2. Do a SEARCH for the hexadecimal string
-
- 00 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00
-
- Check if the found sector looks "similar" to this:
-
- ╔════════════════════════Disk Editor═════════════════════════╗
- ║Physikalischer Sektor: Zyl 30, Seite 34, Sektor 17 ║
- ║00000000: 00 00 00 00 01 00 00 00 - 01 00 00 00 02 00 00 00║
- ║00000010: 02 00 00 00 03 00 00 00 - 03 00 00 00 04 00 00 00║
- ║00000020: 04 00 00 00 05 00 00 00 - 05 00 00 00 06 00 00 00║
- ║00000030: 06 00 00 00 07 00 00 00 - 07 00 00 00 08 00 00 00║
- ║00000040: 08 00 00 00 09 00 00 00 - 09 00 00 00 0A 00 00 00║
- ║00000050: 0A 00 00 00 FF FF FF FF - 02 00 00 00 0C 00 00 00║
- ║00000060: 03 00 00 00 FF FF FF FF - 00 00 00 00 FF FF FF FF║
- ║00000070: 00 00 00 00 FF FF FF FF - 00 00 00 00 FF FF FF FF║
- ║00000080: 00 00 00 00 FF FF FF FF - 00 00 00 00 61 14 00 00║
- ║00000090: 00 00 00 00 FF FF FF FF - 03 00 00 00 97 00 00 00║
- ║000000A0: 06 00 00 00 18 00 00 00 - 00 00 00 00 16 00 00 00║
- ║000000B0: 01 00 00 00 17 00 00 00 - 02 00 00 00 00 01 00 00║
- ║000000C0: 07 00 00 00 19 00 00 00 - 08 00 00 00 FF FF FF FF║
- ║000000D0: 7F 00 00 00 1F 00 00 00 - 00 00 00 00 1C 00 00 00║
- ║000000E0: 01 00 00 00 FF FF FF FF - 3C 00 00 00 1E 00 00 00║
- ║000000F0: 3D 00 00 00 32 00 00 00 - 80 00 00 00 2B 00 00 00║
- ║00000100: 00 00 00 00 21 00 00 00 - 01 00 00 00 22 00 00 00║
- ║00000110: 02 00 00 00 23 00 00 00 - 03 00 00 00 24 00 00 00║
- ║00000120: 04 00 00 00 25 00 00 00 - 05 00 00 00 26 00 00 00║
- ║00000130: 06 00 00 00 27 00 00 00 - 07 00 00 00 28 00 00 00║
- ║ Sektor 62,544 von 2,097,151 Zyl 30, Seite 34, Sektor 17║
- ║ Festplatte 3 Datei-Offset 0, Hex 0║
- ╚════════════════════════════════════════════════════════════╝
-
- This is the start of a Netware FAT.
-
- Write down the sector number (62544 in the example above)
- Repeat the search until the end of drive.
- Write down any sector number you find this way.
- Finally you will have a list of sector numbers:
-
- 62544
- 63056
- 238544
- 239056
-
- Note that Netware has two FATs. The 2nd FAT is usually allocated
- 512 sectors after the 1st FAT.
- Remember that TIRAMISU defines the start of FAT1 as cluster 0
- (=start) of the file system.
-
- Your commented list will look like this:
-
- 62544 FAT1 of 1st volume START OF 1ST VOLUME
- 63056 FAT2 of 1st volume
- 238544 FAT1 of 2nd volume START OF 2ND VOLUME
- 239056 FAT2 of 2nd volume
-
- 3. Leave Norton's DISKEDIT
-
- 4. Start TIRAMISU FOR NOVELL
-
- 5. Go into OPTIONS, tag "KEEP FOR NEXT" on
-
- 6. Start the recovery
-
- 7. When you get the "VOLUME SELECTION WINDOW" press ESCAPE and
- leave TIRAMISU FOR NOVELL
-
- 8. TIRAMISU has created two files:
-
- SCAN_RES.RST
- INTERVAL.RST
-
- INTERVAL.RST contains the found drive structures in a plain
- text format. Every single structure occupies 3 lines.
-
- ┌─────────────────────┐
- │<block size> │ ┐
- │0 │ ├ 1st found structure
- │<start sector> │ ┘
- │<block size> │ ┐
- │0 │ ├ 2nd found structure
- │<start sector> │ ┘
- │<block size> │ ┐
- │0 │ ├ 3rd found structure
- │<start sector> │ ┘
- │<block size> │ ┐
- │0 │ ├ 4th found structure
- │<start sector> │ ┘
- │<block size> │ ┐
- │0 │ ├ 5th found structure
- │<start sector> │ ┘
- │: │ ┐
- │: │ ├ more found structures
- │: │ ┘
- └─────────────────────┘
-
- We will write our own INTERVAL.RST now.
- Delete the file INTERVAL.RST.
-
- In step 2 we found the START values. We do not know the block sizes
- yet. If you remember the block size from the installation - great!
-
- If not, possible block size are (in sectors):
-
- 8 (4KB)
- 16 (8KB)
- 32 (16KB)
- 64 (32KB) (Netware 4.XX only)
- 128 (64KB) (Netware 4.XX only)
-
- Create an INTERVAL.RST entry for each combination of the START value
- and the BLOCK SIZE value:
-
- Create a new file INTERVAL.RST with a text editor that looks like this:
-
- ┌─────────────────────┐
- │8 │
- │0 │
- │62544 │
- │16 │
- │0 │
- │62544 │
- │32 │
- │0 │
- │62544 │
- │64 │
- │0 │
- │62544 │
- │128 │
- │0 │
- │62544 │
- │8 │
- │0 │
- │238544 │
- │16 │
- │0 │
- │238544 │
- │32 │
- │0 │
- │238544 │
- │64 │
- │0 │
- │238544 │
- │128 │
- │0 │
- │238544 │
- └─────────────────────┘
-
- 9. Re-run TIRAMISU FOR NOVELL with the option "RESTART FROM LAST"
-
- You will be shown this partition selection window:
-
- ╔═[■]═══════════ Select a volume to recover ═══════════════╗
- ║ START: 62544 ( 22MB) BS: 4KB SCORE:1 ║
- ║ START: 62544 ( 90MB) BS: 8KB SCORE:1 ■ ║
- ║ START: 62544 ( 360MB) BS: 16KB SCORE:1 ▒ ║
- ║ START: 62544 ( 1441MB) BS: 32KB SCORE:1 ▒ ║
- ║ START: 62544 ( 5767MB) BS: 64KB SCORE:1 ▒ ║
- ║ START: 238544 ( 235MB) BS: 4KB SCORE:1 ▒ ║
- ║ START: 238544 ( 942MB) BS: 8KB SCORE:1 ▒ ║
- ║ START: 238544 ( 3768MB) BS: 16KB SCORE:1 ▒ ║
- ║ START: 238544 ( 15073MB) BS: 32KB SCORE:1 ■ ║
- ║ START: 238544 ( 60293MB) BS: 64KB SCORE:1 ║
- ║ ║
- ║ OK ▄ Cancel ▄ ║
- ║ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ║
- ╚══════════════════════════════════════════════════════════╝
-
- Choose the entries that fit most.
-
- For the first (80MB) volume:
-
- START: 62544 ( 90MB) BS: 8KB SCORE:1
-
- For the second (900MB) volume:
-
- START: 238544 ( 942MB) BS: 8KB SCORE:1
-
- Proceed as usual.
-
-
- 8.5. "Restrict sectors" must match previous setting
-
- If you selected "Restrict sectors" *and* "Keep for next session" you
- must enter the same sector range for a further session using "Restart
- from last".
-
-
- 8.6. Wrong disk size
-
- A nasty source of problems is a wrong disk size reported from BIOS.
- Check the size TIRAMISU FOR NOVELL thinks your drive has:
- ╔═══ HD 128 ════╗
- ║ 1022*64* 63 ║
- ║ 4120704 sec ║
- ║ 2012 MB ║
- ║ RECOVER ▄ ║
- ║ ▀▀▀▀▀▀▀▀▀ ║
- ╚═══════════════╝
- If this size (2012 MB in this example) is not correct you won't get
- correct recovery results.
-
- Reboot your computer and enter the BIOS setup. Let it "auto detect"
- (if available) the drive size or enter the values manually.
- If the drive is bigger than 504 MB make sure the LBA mode is enabled.
-
- If you still get a wrong drive size try this (experts only!):
-
- - make a backup of the very first sector (physical sector 0,0,1)
- - Overwrite the very first sector (512 bytes) with zeros.
-
- You can use a disk editor like Norton's DISKEDIT for this task.
- Reboot the computer again.
-
-
- 8.7. Get a new version
-
- Download a new version from our Internet site (address below).
- If you find any bugs, please send a description to one of the addresses
- below or use our support form at "http://www.recovery.de".
-
-
- 9. REGISTRATION
-
- TIRAMISU IS DISTRIBUTED AS SHAREWARE. FEEL FREE TO COPY, DISTRIBUTE OR
- UPLOAD IT TO ANY MEDIUM. The unregistered version has all functions
- for recovering your crashed hard drive. But only the registered version
- of TIRAMISU allows you to COPY files from your recovered drive.
-
- There are two kinds of licenses available:
-
- - A limited version that can only be used for a PERIOD OF ONE WEEK.
- In effect this is a PAY PER USE registration. The fee is
- DM 590 (approximately US $390).
- Orders within the European Community add 15% VAT.
-
- - An unlimited version that can be used for an UNLIMITED PERIOD at
- one computer at the same time. The fee is DM 980 (approximately
- US $650).
- Orders within the European Community add 15% VAT.
-
- The registration procedure is this:
-
- - Run TIRAMISU and check if it can restore your data (VIEW your files)
-
- - Select REGISTRATION->REGISTRATION. You will be asked to insert a
- diskette in drive A:.
-
- ╔═[■]════════ Information ═════════════╗
- ║ ║
- ║ Please insert the license or a ║
- ║ blank diskette in drive A: ║
- ║ ║
- ║ ║
- ║ OK ▄ Cancel ▄ ║
- ║ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ║
- ╚══════════════════════════════════════╝
-
- Please have ready a blank formatted 1.44 MB or 1.2 MB diskette.
- This diskette will become your license diskette later. Be aware
- that any data on this diskette might be damaged during this procedure.
-
- ╔═[■]══════════ Confirm ═══════════════╗
- ║ ║
- ║ Disk in drive A: will be prepared ║
- ║ now for STEP 1 of registration. ║
- ║ DATA MIGHT BE DESTROYED! Continue? ║
- ║ ║
- ║ Yes ▄ No ▄ ║
- ║ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ║
- ╚══════════════════════════════════════╝
-
- If you encounter any problems please try it again using a fresh
- formatted and error free diskette.
-
- If you are running TIRAMISU from diskette do not remove the diskette
- during the registration process because it is needed for reloading
- overlays. If you do not want to risk this diskette's data, please
- terminate the program, put the TIRAMISU program files onto a new
- diskette and start TIRAMISU again to do the registration.
-
- Finally you will be shown a 16- or 17-letter code.
-
- ╔═[■]════════ Information ═════════════╗
- ║ ║
- ║ Your license diskette is prepared ║
- ║ for registration now. Send us this ║
- ║ code: ║
- ║ CPYQ BVVN MHVA VCWX K ║
- ║ OK ▄ ║
- ║ ▀▀▀▀▀▀▀▀ ║
- ╚══════════════════════════════════════╝
-
- - Submit this code to the TIRAMISU registration service (preferably
- by fax, use the form you can find in REGISTER.TXT):
-
- Tel.: 49-30-292 00 99 or 49-30-78 70 51 58 (Germany)
- Fax: 49-30-292 60 63 or 49-30-78 70 51 59
- Email: data_recovery@compuserve.com
- http://www.recovery.de
- http://ourworld.compuserve.com/homepages/data_recovery
-
- Address: Plug 'n Play
- Uwe Gissemann
- Scharnweberstr. 43
- D-10247 Berlin
- Germany
-
- - Specify the kind of license you want to purchase (7 days license or
- unlimited license). Send the money or credit card information (VISA,
- MASTERCARD, AMEX or DINERS).
-
- - The registration key will be forwarded to you immediately by fax
- or email after we charged to your account.
-
- - After receiving the registration key from us, please insert the
- prepared diskette. Start TIRAMISU. Select REGISTRATION->REGISTRATION.
- Enter the received key in the registration screen.
-
- - Ready! Now you can use COPY to save your data.
-
- IMPORTANT: Label the diskette as your license diskette. You will need it
- anytime you run TIRAMISU. The license diskette can not be duplicated.
- This is a copy protection.
-
- The limited license allows you to recover data only from one
- computer. It is not valid for other systems. (This restriction does not
- apply for the unlimited license.)
-
-
- 10. NO WARRENTY
-
- The quality of data recovery that is done by TIRAMISU depends on:
-
- - physical condition of the hard drive
- - fragmentation of the files
- - grade of the loss of drive informations
-
- TIRAMISU data recovery software, as all applications, has limitations.
- We cannot provide recovery capabilities under certain conditions. Due
- to the many variables associated with drive corruption, we cannot
- guarantee recovery in all cases.
-
- However, downloading and running the shareware version gives you the
- closest idea to what we can offer.
- All customers are recommended to check the files with the build-in
- quality control (file information and file viewer) before they buy.
-
- We do not do refunds.
-
-
- 11. DISCLAIMER
-
- PLUG'N PLAY DOES NOT WARRANT THAT THE SOFTWARE IS ERROR FREE.
-
- PLUG'N PLAY DISCLAIMS ALL WARRANTIES WITH RESPECT TO THE SOFTWARE,
- EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- OF THIRD PARTY RIGHTS.
-
- NO LIABILITY FOR CONSEQUENTIAL DAMAGES. IN NO EVENT SHALL
- PLUG'N PLAY BE LIABLE FOR CONSEQUENTIAL, INCIDENTAL
- OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE DELIVERY,
- PERFORMANCE OR USE OF THE SOFTWARE, EVEN IF PLUG'N PLAY HAS BEEN
- ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL
- PLUG'N PLAY'S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT OR
- ANY OTHER THEORY OF LIABILITY, EXCEED THE LICENSE FEE PAID BY
- THE BUYER.
-