Data Rescue is a tool for recovering lost Macintosh volumes. It recovers files and folders from crashed hard disks, floppy disks, or removable cartridges. Recovered data are saved to another medium, leaving the original disk untouched.
The main interest in Data Rescue is that the strategy for finding lost files is original, different from the strategies used by other tools like ﾔNorton Utilitiesﾕ. Not only will it find your data in situations where the other tools fail, but it will recover them in a much better condition, restoring icons, dates and even folder hierarchy.
While classic tools like ﾔNorton Utilitiesﾕ search for file fragments, Data Rescue searches for catalog fragments. The catalog is a file maintained by the system to keep track of other files ans folders. If catalog fragments can be found, the data recovery will be very efficient since the catalog contains valuable information about files: their size, type, hierarchy and location on disk.
There are many situations where Data Rescue can help you recover almost all of your lost data. Data Rescue is easy to use, fast, clean, and it also recovers the new HFS+ (ﾔMacOS Extendedﾕ) volumes.
The shareware fee for Data Rescue is $39. Until you register your copy with a personnal code, you can only recover 1 file per session. This allows you to test Data Rescue and check that it helps you in your particular situation. Registering is very simple, as explained in the last part of this documentation.
You can try Data Rescue at no risk because:
-Data Rescue never modifies the original disk.
-You donﾕt have to pay until you are sure that Data Rescue will recover your data.
Data Rescue is small in size (300 KB), so it can be run from a floppy disk if necessary. You should always keep a copy of Data Rescue on an emergency disk (a system disk if possible).
How to use Data Rescue?
･ Compatibility and requirements
Data Rescue requires System 7 or better. It is compatible with MacOS 8. It needs at least 512 KB of free RAM to run, but may need much more if it recovers a large volume (up to 4 MB).
Though Data Rescue is optimized for PowerPC computers, there is no minimum hardware configuration required. Data Rescue even works on 68000 systems.
Data Rescue was designed to cope with a wide range of situations:
-Data Rescue can handle any type of media (floppy disk, hard disk, zip, jazz, magneto-optical, etc.)
-Data Rescue can handle volumes which canﾕt be mounted, even if the driver is damaged.
-Data Rescue can handle disks with a damaged partition map.
-Data Rescue can handle both old and new (ﾔ4.3ﾕ) SCSI, and IDE disks (also called ATA disks).
-Data Rescue can handle the new HFS+ (ﾔMacOS Extendedﾕ) volumes (even on pre-8.1 systems).
-Data Rescue can handle large volumes (4 GB and larger).
-Data Rescue can handle password-protected volumes (if data are not scrambled).
-Data Rescue can recover fragmented files.
Data Rescue was found compatible with all the systems on which it was tested, which include:
ﾊ
However, you should be aware that Data Rescue will not be useful in all situations. Data Rescue searches for catalog fragments to locate your lost files so:
-if you have disposed of a file through the trash by mistake, it has no more catalog entry, so using Data Rescue wonﾕt help.
-if you have initialized a volume by mistake, the catalog may be completely erased, so Data Rescue may be unable to find your files.
Also note that you need some disk space on another device to recover your data. You may recover from one partition to another on the same disk, but that is strongly discouraged. Data Rescue canﾕt be used to fix the original disk.
･ operation overview
Operation is basically as follows:
-You select the volume to recover.
-Data Rescue searches for catalog fragments in that volume and displays files available for recovery.
-You select files and folders to recover.
-Data Rescue saves your data to another device.
Very important: Always check that your data are fully recovered by opening your documents before you reformat (or initialize) your original disk. You may feel that your data are recovered when they are not. The ﾔallocation blocks layoutﾕ section -later in this manual- explains why.
If you are using Data Rescue for the first time, you should read this manual in detail, because you may fail to recover your data if you donﾕt follow every step.
The following sections explain, step by step, how to use Data Rescue to recover your crashed disk.
･ Starting Data Rescue
Data Rescue comes in two versions: 68K and FAT. The 68K version is smaller in size, but the FAT version runs faster on PowerPC machines. Both versions run on every Macintosh.
ﾊ
When you launch Data Rescue for the first time, you are prompted for your name and registration code. If you have already registered Data Rescue and you have that code, fill the corresponding fields in the dialog box and click the ﾔRegisterﾕ button. Be sure that the name you enter is exactly the name you gave when you registered. After you have clicked ﾔRegisterﾕ, a file named ﾔRegistration dataﾕ is created in the same folder as Data Rescue. This file contains your code. If you later move Data Rescue to another folder or disk, be sure to move that file with it, or you will be prompted for your code again. If you copy Data Rescue to a write-protected medium or a CD-R, donﾕt forget to copy the registration data file with it, or you will have to enter the code each time.
If you have not registered yet, and you only want to test Data Rescue, just click the ﾔLaterﾕ button. Data Rescue will run, but it will only recover one file. If you want to recover more files, you will have to quit Data Rescue and launch it again.
ﾊ
･ Selecting a volume
When Data Rescue starts, it scans the SCSI and IDE buses for available volumes (this may take a few seconds), then it displays them in a list. If you check the ﾔShow extended informationﾕ box, hardware information (bus, ID) is displayed.
If your volume does not appear in the list, try to rescan the buses with the ﾔRescan device listﾕ button. If your diskﾕs partition map is damaged, the name of the disk maker may appear instead of that of the volume. You can still identify your disk through its bus and ID (or through its size).
Note that in some special circumstances, your volume may appear more than once in the list.
ﾊ
If your volume is HFS+ (a.k.a. ﾔMacOS extendedﾕ), you must check the corresponding box before you start. If you donﾕt know what HFS+ is, then most probably your volume isnﾕt. HFS+ is a new file system which was first implemented in MacOS 8.1. Currently, volumes are still initialized as HFS (ﾔMacOS standardﾕ) by default. If you check HFS+ whereas your volume is actually HFS, no file will be found. If you donﾕt check HFS+ whereas your volume is actually HFS+, only a few uninteresting files will be found.
Some options should be set before you start, as explained in the next section. Then you can click the ﾔStartﾕ button. Data Rescue will scan the selected volume for catalog fragments. It will also attempt to detect the allocation blocks layout, unless specified otherwise in the options.
If you click ﾔStartﾕ and then feel that you have chosen the wrong volume or options, you can still click ﾔCancelﾕ in the progress window while Data Rescue is scanning for files. When Data Rescue has finished scanning for files, you can still go back to the volume selection window by choosing ﾔRecover New Volumeﾕ in the ﾔFileﾕ menu.
･ Data Rescue options
You can set options by choosing ﾔOptionsﾉﾕ in the ﾔFileﾕ menu. Most options are meaningful only at scan-time, which is why they are presented here. Once set, options are saved in the ﾔPreferencesﾕ folder of your system folder. The default options are fine for most situations.
ﾊ
･ Fast scan: If you check this box, only 2% of your disk will be scanned for catalog fragments. The search will be much shorter, but some files may not be found. In almost every volume, most of the catalog is contained in the first 2% of the volume. So if you are only looking for a particular file, you can try a fast scan first, and then proceed to full scan if your file wasnﾕt found. But if you wish to recover your whole volume, donﾕt check this box. Note that if partitioning is ignored, a fast scan may fail because of the space used by the driver.
･ Ignore partitioning: If you check this box, partitions will be ignored. This means that your whole disk (including its partition map and drivers) will be seen as a volume. Donﾕt use this option if there is more than one volume on your disk. Note that if this option is set, some volumes may appear twice in the list (once as the volume, once as the whole disk). You should check this box only if you feel that the partition map is damaged. Anyway, Data Rescue may ignore partitioning automatically for disks with questionable partition maps. You can see that partitioning is ignored for a particular disk because the name of the disk maker appears instead of that of the volume.
･ Auto-detect allocation blocks layout: The allocation blocks layout is a pair of parameters which must be known in order to recover files correctly. The meaning of these parameters is explained in the next section. If this option is set, Data Rescue will attempt to detect these parameters automatically. Otherwise, it will use the parameters you provide. If the ﾔFastﾕ box is checked, Data Rescue will use 10 files to make its calculations (otherwise, it will use 100 files). Note that the ﾔmanualﾕ allocation blocks layout values are not stored in the preferences file.
The recommanded setting is ﾔAuto-detectﾕ, ﾔFastﾕ box clear.
･ Color for bad files: This option is meaningful only at recover-time. Files that have errors when recovered take the color you specify unless you set this menu to ﾔDo not changeﾕ. The 7 colors actually correspond to the 7 Finder ﾔfamiliesﾕ.
･ Replace missing data with zeros: This option is meaningful only at recover-time. If a read error occurs while a file is recovered (possibly because of a bad medium), and if this option is set, then the missing data are replaced with zeros and more data are read if possible. If this option is not set, no more data are read for this file, and the recovery goes on to the next file.
Click ﾔOKﾕ once you have set appropriate options.
･ About the allocation blocks layout
This section will discuss allocation blocks layout, an advanced topic. Unless you encounter troubles with the allocation blocks layout, you may skip this section, but there is at least one thing you must know:
important: before you start to recover files, you must look inside a few files and check that their content is what you expect. This will ensure that the allocation blocks layout is correct and that Data Rescue will recover your files, not random data.
-find a text file (a file with type ﾔTEXTﾕ), select ﾔNew Window With This Filesﾕs DATAﾕ in the ﾔBlocksﾕ menu, and check that the text in the rightmost column is what you expect.
-find a file which contains resources (e.g. an application, type ﾔAPPLﾕ), select ﾔNew Window With This Filesﾕs RSRCﾕ. The name of the file is usually written in the fourth row (rightmost column).
You can also recover a few test files if you have the necessary applications to open them.
If files contain what you expect, then the allocation blocks layout is correct, and you can move to the next section. Otherwise, you should read the present section.
All macintosh volumes are made of 512-byte blocks called ﾔlogical blocksﾕ. However, files are made of ﾔallocation blocksﾕ, whose size is a multiple of 512 bytes. The location of a file is written in the catalog in terms of allocation blocks. To find the corresponding logical blocks, the following formula is used:
logical block = allocation block ｴ a + b
Where a is the number of logical blocks per allocation blocks, and b is the logical block of the first allocation block. a and b are the allocation blocks layout. a and b take different values on different volumes.
Since Data Rescue finds allocation block numbers in the catalog but adresses disks in terms of logical blocks, it must know a and b to recover files. If either a or b has an incorrect value, the output files will contain random data, even if sizes and icons are correct! This is why you must check the content of a few files to be sure that a and b are correct.
To detect the allocation blocks layout automatically, Data Rescue picks 100 files in the volume, and finds which combination of a and b gives most files respecting the above formula. It can be long to find the 100 files, so there is a ﾔFast detectionﾕ option to get only 10 files. If a fast detection yields questionable values, you should restart with a normal detection. Fortunately, the automatic detection of the allocation blocks layout rarely fails.
If the allocation blocks layout cannot be detected, Data Rescue produces an alert box. This may happen when not enough files have been found for calibration. If so, or if the values found by Data Rescue are incorrect, youﾕll have to set a and b manually, in the options window.
To set a and b manually, open the options window by selecting ﾔOptionsﾉﾕ in the file menu. Then click the ﾔUse this:ﾕ button, and enter a and b in the lower and upper boxes, respectively. Once you have set values manually, check the contents of a few files, as explained at the beginning of this section, and change values again if the contents donﾕt match.
When the disk is scanned for files, Data Rescue tries to guess a and b from the diskﾕs size. It also tries to find these values in the volumeﾕs ﾔMaster Directory Blockﾕ (MDB). These values are logged to the report. To read the report, select ﾔShow Reportﾕ in the ﾔReportﾕ menu. Below is a sample report extract:
About the allocation blocks layout:
According to the volume information (MDB), base block=19, block size=8.
According to the alternate MDB, base block=19, block size=8.
Best guess according to the volume's size: base block=19, block size=8.
Note: a is the ﾔblock sizeﾕ, b is the ﾔbase blockﾕ.
You should start from the values given in the report if you donﾕt know what to set as a and b. Also try other values around these. Sometimes, b is exactly twice what Data Rescue guessed.
Note that if the file(s) you want to recover were not found by Data Rescue, there is no point in determining the allocation blocks layout, as your files wonﾕt be recovered anyway.
･ using the ﾔRecoverﾕ window
After Data Rescue has scanned your volume for catalog fragments and, if required, detected the allocation blocks layout, it opens a new window titled ﾔRecover filesﾕ.
Files found by Data Rescue are presented in a list with their names, types, creators, size and modification date. As in the standard Macintosh ﾔOpenﾕ window, you can go down the folder tree by double-clicking folders, and up by using the hierarchy pop-up menu above the list.
There may be a folder named ﾔAnonymous foldersﾕ at the root of your file hierarchy. This folder contains folders whose information (name, location in the folder tree) could not be found in the catalog, but who are referenced as parent folder for other files or folders.
ﾊ
Files can be sorted by name, size, date, type or creator, as chosen with the ﾔSort byﾕ pop-up menu.
You can search for files having a particular name, size, date, type or creator. For instance, if you are looking for files that were modified since August 1, 1998, set the ﾔFindﾕ menu to ﾔDate ｳﾕ and enter ﾔ8/1/98ﾕ in the ﾔFindﾕ box. Then click ﾔSearchﾕ. Data Rescue will jump to the folder containing the matching items. If several folders contain matching items, use the ﾔnext folderﾕ and ﾔprevious folderﾕ buttons to move to other folders.
You can hide files or folders from the list. Data Rescue will not recover the hidden items. Assuming that you want to recover your whole volume at once, you can hide undesirable items located in sub-folders before you recover, so that you donﾕt have to remove them after you have recovered. To hide files or folders, select them in the list, then click ﾔHideﾕ. To revert all items in the volume to visible, click ﾔShow Allﾕ.
Items you may want to hide include:
-Artifacts. These are pseudo-items that donﾕt really exist on your disk. They always have weird names. They are in the list because from Data Rescueﾕs point of view, they look like files or folders. Artifact files can be very large and could clutter your recovery medium.
-Large files that you donﾕt really need to recover, for instance an application that you can reinstall from the original disk or CD-ROM. Use the ﾒSearchﾓ feature to find large files.
-The system folder. You will probably want to reinstall a clean system from the Apple CD-ROM, so you donﾕt need the old folder. However, you may want to recover your ﾔpreferences folderﾕ, or some files installed in your system folder by third party softwares.
-The trash, and temporary or system files like the ﾔDesktop databaseﾕ.
When you have located the file(s) or folder(s) that you want to recover, select them and click ﾔRecoverﾕ. You will be asked for a place to save your files to. Needless to say, you must not select the volume that you are recovering. A folder named ﾔRecovered #ﾉﾕ will be created and your folders and files will be saved to it. You should try to open a few files to check that they were properly recovered. Also check the report by selecting ﾔShow Reportﾕ in the ﾔReportﾕ menu.
Always check every file that has importance to you after is is recovered. Data Rescue never alters the original disk, so you can try other methods to recover your files if Data Rescue fails. After you reformat or initialize your disk, it is very likely that Data Rescue wonﾕt be able to recover data anymore. In general, always try non-destructive methods like ﾔData Rescueﾕ before you attempt to ﾔfixﾕ your disk.
･ Block-level tools
Data Rescue features block-level tools to display and save raw disk blocks.
To display a block, select ﾔNew Window With Block#ﾉﾕ, and then enter the number of the logical block you want to display. The block is read in the currently selected volume. You can also read the first block of the data fork (resp. resource fork) of a file by selecting this file and selecting ﾔNew Window With This Fileﾕs DATAﾕ (resp. RSRC). In that case, the logical block read depends on the allocation blocks layout.
ﾊ
The first number in a row is the offset in the block (in hex). Then follow the blockﾕs data in hex and ASCII. You can view the next (resp. previous) block by selecting ﾔNext Blockﾕ (resp. ﾔPrevious Blockﾕ) in the ﾔBlocksﾕ menu. You can also jump to a particular block by selecting ﾔGo To Block#ﾉﾕ in the same menu.
If you wish to view your diskﾕs partition map, you must ignore partitioning, since the partition map does not belong to a volume. Also note that you canﾕt edit a block in the block display.
You can save raw blocks to another medium by selecting ﾔSave Blocks Asﾉﾕ in the ﾔBlocksﾕ menu. This brings the following window:
ﾊ
Select a location to save your blocks and enter the number of the first logical block to save and the number of logical blocks to save. You can also set a particular type or creator for the file. Click ﾔSaveﾕ to save the blocks.
･ Data Rescue report
Data Rescue reports comments and errors in a window titled ﾔReportﾕ which you can view by selecting ﾔShow Reportﾕ in the ﾔReportﾕ menu. This window cannot be edited, but you can save its content to a text file by selecting ﾔSave Report Asﾉﾕ in the ﾔReportﾕ menu. This file can be edited or printed with a basic text editor like ﾔSimpleTextﾕ.
-You can list all files and folders in the current folder by selecting ﾔList Files/Foldersﾕ in the ﾔReportﾕ menu.
-You can get more information about the selected file(s) or folder(s) by selecting ﾔReport File/Folder Infoﾕ in the ﾔReportﾕ menu.
The report contains 500 lines at most. When the report reaches 500 lines, the first lines are removed as new lines are added. You can clear the report by selecting ﾔClear Reportﾕ in the ﾔReportﾕ menu.
･ Limitations to version 2.0.2
-Apple has not released the official specifications for HFS+ yet, so HFS+ operation is subject to future improvements. In particular, scripts other than ﾔromanﾕ (western) are not supported yet.
-The block-level display is not (and will never be) an editor.
-Logical unit numbers (LUN) other than 0 are not supported yet. This may be a problem for disk arrays.
-Balloon help is not implemented.
Registering and other issues
･ Registering Data Rescue
You have 3 good reasons to register Data Rescue:
-When you register, you will receive a personal registration code that will allow you to recover as many files as you want.
-When you register, you can get free technical support by e-mail (see next section).
-When you register, you are entitled to all future versions of Data Rescue for free.
Data Rescue has the following pricing:
Single user license: $39 per user.
A Site License costs $390 (equal to 10 users) and covers all locations for your organization within a 160 kilometer radius of your site (100 miles). One big advantage of a Site License is that you do not need to keep track of how many people at your site are using the software.
A World-Wide License costs $3900 and it covers all locations for your organization on the planet earth.
Paying for Data Rescue is fairly simple. Open the Register program that accompanies Data Rescue. Enter your name, your email address, and the number of single user licenses you desire for each program you wish to purchase (or Site or Word-Wide licenses). Save or Copy or Print the data from the Register program and send the data and payment to Kagi. More specifics on the Register program to follow. Kagi handles the payment processing.
You can also register through Kagiﾕs online registration service at <http://order.kagi.com/?9YO> (card payment only). SSL (secured) payment is also available.
If paying with Credit Card or First Virtual, you can email or fax the data to Kagi. Their email address is sales@kagi.com and their fax number is +1 510 652-6589. You can either Copy the data from Register and paste into the body of an email message or you can Save the data to a file and you can attach that file to an email message. There is no need to compress the data file, it's already pretty small. If you have a fax modem, just Print the data to the Kagi fax number.
Payments sent via email are processed within 3 to 4 days. You will receive an email acknowledgement when it is processed. Payments sent via fax take up to 10 days and if you provide a correct internet email address you will receive an email acknowledgement.
If you are paying with Cash or USD Check you should print the data using the Register application and send it to the address shown on the form, which is:
Kagi
1442-A Walnut Street #392-9YO
Berkeley, California 94709-1405
USA
You can pay with a wide variety of cash from different countries but at present if you pay via check, it must be a check drawn in US Dollars. Kagi cannot accept checks in other currencies, the conversion rate for non-USD checks is around USD 15 per check and that is just not practical.
If you have a purchasing department, you can enter all the data into the Register program and then select Invoice as your payment method. Print three copies of the form and send it to your accounts payable people. You might want to highlight the line that mentions that they must include a copy of the form with their payment.
Kagi can not invoice your company, you need to act on my behalf and generate the invoice and handle all the paperwork on your end.
Please do not fax or email payment forms that indicate Cash, Check or Invoice as the payment method. As far as we know, there is still no technology to transfer physical objects via fax or email and without the payment, the form cannot be processed.
Payments send via postal mail take time to reach Kagi and then up to 10 days for processing. Again, if you include a correct email address, you will hear from Kagi when the form is processed
When your payment is processed, you will receive a personal registration code that will allow you to recover as many files as you want. If you do not have an email address you should consider selecting the Postcard Receipt so that Kagi can inform you of your registration code. Kagi transmits the registration codes via email and paid postcard receipt only.
･ Technical support
When you register, you can get free technical support by e-mail at <support@wildbits.com>.
The purpose of technical support is to help you understand how Data Rescue works. I will make every possible effort so that you can get the maximum out of Data Rescue, but I cannot guarantee that Data Rescue will succeed in recovering your data. Therefore, you should check that Data Rescue fits to your particular situation before you register Data Rescue.
The only channel of communication for technical support to Data Rescue is by e-mail at <support@wildbits.com>. Other technical support requests will be ignored. Please send your name and registration code with any technical support request.
I will try to reply to technical support requests as fast as possible. However, I cannot guarantee any reply delay.
Suggestions and bug reports from registered or unregistered users are welcome at <report@wildbits.com>
･ Copyright and acknoledgements
Data Rescue 2.0.2 and this documentation ｩ 1997-1998, Sylvain Demongeot.
Data Rescue 2.0.2 and this documentation can be distributed freely for non-profit purposes in the form of the original archive. Data Rescue may not be distributed for profit purposes without the authorﾕs permission.
Many thanks to Vincent Berville and Paul K殄n for all their suggestions, testing and help.
CIconButton CDEF from Digital Alchelmy
ｩ Ramon M. Felciano 1993, All Rights Reserved
About the firemanﾕs helmet:
The ﾔabout boxﾕ helmet is a modified picture of an antique firemanﾕs helmet found in the ﾔR1Antiques Cybermallﾕ. My thanks go to Ron Clapp for letting me use the image. The firemanﾕs helmet is probably not for sale anymore, but there are many fine antiques to see in this site, so visit them at <http://www.r-one.com/antiques/>
I recommend ﾔSeditﾕ by David Shayer, a remarkable block-level disk editing tool that I used extensively to write Data Rescue. The latest version of Sedit can be found at: <ftp://members.aol.com/sentientsw/>
Check for new versions at <http://www.wildbits.com/rescue/>
Technical support (for registered users): support@wildbits.com
Bug reports & suggestions: report@wildbits.com
Information: info@wildbits.com
Snail-mail: Sylvain Demongeot, 34 Chemin Lat屍al, 94140 Alfortville, France (not for payments!)
･ Disclaimer of warranty
In using this software, you understand and agree that this software is provided "as is" without warranty of any kind. The entire risk as to the results and performance of using this software lies entirely with you, the user. The author does not make any warranties, either expressed or implied, including but not limited to implied warranties of merchantability and fitness for a particular purpose, with respect to this software. In no event shall the author be liable for any consequential, incidental, or special damages whatsoever (including without limitation damages for loss of critical data, loss of profits, interruption of business, and the like) arising out of the use or inability to use this software.
Although the author would appreciate any feedback and bug reports, the author shall not be responsible for correcting any problems which you discover. Furthermore, the author may at any time replace, modify, alter, improve, enhance or change this software.↵
