RepoMan version 1.01, user
manual, HTML version. revision 2 Please note that this document is formatted to be read in display resolutions of 800x600 or better.
|
|||
The contents of this
document:
General information
|
|||
General
information.
Please note : In this document we refer to the "recovery manual". This recovery manual is not yet finished. Please check the site http://diydatarecovery.sites.cc for info on the recovery procedures that in the future will be described in the recovery manual. The direct link is here, (http://home.soneraplaza.nl/mw/prive/jvs/repoman.htm).
|
|||
This documentation accompanies RepoMan
version 1.01.
|
|||
Files currently in the
distribution :
Repoman.exe - the program, version
1.01
|
|||
This document assumes the reader to have
some knowledge concerning harddisks and the like. You should know what
drive overlay software is, what it is you can do with a hex-editor, what
the basic layout for a harddisk is. We also assume you know how to make
a bootdisk and have at least working knowledge of Win9x and real mode
environments.
For info on harddisks and recovery check the DIY datarecovery (http://diydatarecovery.sites.cc) pages. This site contains information on harddisk recovery and assorted info and is maintained by RepoMan co-writer, Joep van Steen.
|
|||
Copyright, disclaimer,
permission and distribution notices.
This program is conceived and written bij Joep van
Steen and Tom Kuurstra. You may not include (parts of) this program in your own code and/or programs. Please check below for redistribution notices. This program does NOT write anything to the harddisk that the recovery is performed on (unless the user directs the recovery output to a logical partition that is on the harddisk that is examined). This program therefore does NOT perform any recovery by itself. This is by design. The output this utility creates is to be used for the recovery of harddisk content. We can and will not be held responsible for any damage that might be inflicted by the user as he or she performs the recovery operations. You, as the user, are not permitted to:
This program is distributed as Freeware. You are free to use this program, as long as you comply with the above mentioned rules. There is one restriction. You may NOT redistribute the program. This program may not be placed on bbs's, websites, FTP sites or any other location that facilitates download. If this is desired anyway, please contact us on one of the supplied e-mail addresses and we will get back to you. Please point to the original download location for redistribution, here, (http://home-1.worldonline.nl/~heems002/repoman.htm). We also ask that you supply us with feedback on what has been achieved with the program or what has gone wrong. Also, any suggestions for changes or improvements are welcome. Contact information can be found at the end of this document.
|
|||
Program description.
- In short A tool that runs in real-mode win9x/DOS environment, analyzes a harddisk that has suffered dataloss caused by whatever reason, on a sector basis and reports anything interesting it may find, aiding in the recovery of the information on the harddisk. - A little less short RepoMan scans the region on a harddisk that the user specified, sector by sector. Currently the program is limited to the first 1024 cylinders of a harddisk. The program will notify the user of any sectors that may be of interest, we call them "significant sectors". Notification is done through the use of recovery output. The recovery output contains dumps of the possibly significant sectors and any additional information that can be ascertained about these sectors. Use the recovery output, together with the recovery manual that is also in the distribution, to perform harddisk recovery. Read the recovery manual for information on the content of the recovery output. The recovery output can be directed to any logical drive, the floppy drive (A:) is default. RepoMan uses int13H calls to access the harddisk through BIOS. The program has several modes of operation. These modes can be selected in the "options" menu. The modes are: QCK - quick scan. Only sector 1 on heads 0 and 1 are scanned. These are usually the sectors that contain interesting information. For instance, partitions always start on cylinder X, head 0/1, sector 1. This scan is very fast for obvious reasons but may skip potentially interesting sectors. FUL - full scan. This mode scans all sectors within the specified search scope. This may take quite some time and produce large recovery output files. TXT - text search. The specified search scope is scanned for a text string. The search string can be entered in the "options" menu. The search is NOT case sensitive. The search string has a maximum length of 16 characters. The search for the text string is the only operation that is performed, no significant sectors will be found, unless they contain the search string. HEX - hex search. The specified search scope is scanned for a string of hex bytes. The string can be entered in the "options" menu and has a maximum length of 32 characters, which represent 16 bytes in hex. The string is NOT tested for validity so check carefully when you enter the hex bytes. DMP - this mode performs a standard sector by sector dump for the specified search scope. Use this to look around on the disk, or to look at the region around sectors that RepoMan has marked as significant. No search or scan is performed. This may produce large recovery output files. The master boot record (MBR, located at cylinder / head / sector 0/0/1) is always read, checked and dumped to the recovery output during QCK, FUL and DMP scans. Search modes (TXT and HEX) do not read and/or dump the MBR. The program does NOT perform any recovery, nor does it write anything on the disk that has been selected for recovery, unless the user specifies a logical drive on that disk for the recovery output. This is by design. In it's default state this program can safely analyze a harddisk without destroying anything on it. The recovery output should be used for the actual recovery operation. We call the files that RepoMan produces, the Recovery
Output. It is adviced to view the recovery output in a DOS text editor.
If you view the recovery output in Windows using Notepad for instance,
your Windows settings (codepage and font settings) might distort the
display of the ASCII display, on the right side of the recovery output
file. The HEX information will always be displayed correctly. Currently, RepoMan creates 1 recovery output file during a search. This file contains information on the significant sectors, any additional info Repoman can give about the sector and a dump of the sector. The recovery output files are named as follows: For a default dump : "REPOLOG.DMP" If a file already exists when the program starts, it will be overwritten (if "repolog.007" already exists when the program starts and the counter is at 7, the file will be overwritten). RepoMan uses a configuration file, "repoman.cfg", for it's settings. This file is written to and read from the current directory. If you do not wish to use this feature, use the "/c" switch (see "starting the program" below).
|
|||
How to use.
- Get started. When performing recovery with RepoMan and when running RepoMan, it is best to do this from a real mode DOS/win9x bootdisk. We assume you know how to create one. We suggest you create a bootdisk that boots with a large RAMdrive installed. The output RepoMan creates can then be redirected to the RAMdrive which speeds up the search process considerably. The output may also be redirected to the floppydrive or any other logical drive. Note that when the drive is full the recovery output will be overwritten, no warning is given. Make sure you have a large enough logical drive to hold the recovery output. You should not use the harddisk that the recovery is performed on for recovery output, even if it still contains a valid logical drive. Have a printer connected to the machine you are working on, the recovery output should be DOS textprinter friendly. If you wish you can print the files for reference. Include a compression utility on the bootdisk to transport the recovery output from the RAMdrive to any other machine, if so desired. We endorse the ARJ compressor, the best and most flexible commandline compressor available, which can be found here (http://www.arjsoftware.com). Starting the program from the commandline with no parameters will display the main menu. Before the main menu is displayed some checks are performed: the target disk is checked to see if it exists and if it can be read; the disk is scanned for drive overlay signatures; the RepoMan configuration file is read. If any errors occur during these checks the user is notified. If the disk can not be found or read, the program exits with an int13H error code. Use the code to see which exit condition is the cause for the abort and see if you can fix the problem. The list with exit int13H error return codes can be found in the "run errors" section. If a signature for drive overlay software is found the program will notify the user. The program will not abort. The user should check to see if the drive overlay software is loaded. If not, the search results will be erratic and can not be used for recovery. If the program finds errors or inconsistancies in the configuration file, it will alert the user and correct the settings in error. If the configuration file does not exist when the program is started, default settings are used and a new configuration file is created. Use the following parameters at the commandline for additional settings or to change the way the program runs: /D:x, where x
is 0, 1, 2 or 3 - use to select the disk number, default is 0. These parameters can be used in any order and in any combination. If you specify "/X" the configuration file is always used, if the config file is not found, the program will abort.
|
|||
- The menus
When the program is ready for use it will display the main menu, which looks like this :
The left side of the screen contains the menu options, the right side contains information on the current disk geometry and the current settings. Below the settings is the filename for the results of the previous scan or dump. The top line contains the program name and version information. The bottom 3 lines are used for status information and for user input. During a search or scan the location that is currently scanned is displayed. Also displayed are two values, the first being "SD" (sectors dumped and/or found) and the second being "I13E" (the number of int13H errors encountered so far). The basic screen layout is the same for all menus. Main menu options : (s) - use this option to enter the search
scope, sector based, on which to perform the scan. The scope is entered
on a C/H/S (Cylinder / Head / Sector) bases. Press Escape to exit the program. The "specify search scope" menu looks like this :
Options : (s) - enter the start address for the scan or
dump, in cylinder/head/sector format. If you selected the
"qck" (quick) search you can only enter the cylinder value.
Validity checking is performed on the entries. If you enter any invalid
value the program will notify you and then reset the value to default.
Check your entries based on the notification the program gives you. The
first sector you can specify is sector 0/0/2. The MBR is always checked
for modes QCK, FUL and DMP and never checked for TXT and HEX searches. Press Escape to return to the main menu. The "options" screen looks like this:
Options: (s) - resets all settings to their defaults.
This is the same as deleting the "repoman.cfg" file. Press Escape to return to the main menu.
|
|||
Run errors.
If a problem occurs during a scan or search that
effects the program run, the program will interrupt the search, clear
the screen and display text about the error found. A description of the
error will be given unless the error is unknown, in which case the user
will be given the errorcode. See contact information
for info on how to deal with this. If an error in an int13H function occurs, the program will not abort, unless the error occurred during the initialization fase. All int13H errors are logged to the recovery output and can be traced back to the sector where they occurred. By capturing int13H errors this way it is easy to find the offending sector. The error return codes for the program: 02 file not found The error return codes for int13H functions : 01 - Bad command If you get a different returncode than the ones listed here, send us an e-mail. Check contact information for info on this.
|
|||
Tools used in
creating RepoMan and other copyrights that need mentioning.
We would like to acknowledge the copyrights and extend our respect to the following people for creating the following tools: BASM 6.5 (BASIC to 286 Assembly Language Compiler) (c)
1999 by Kevin Diggins. Please go to http://www.users.uswest.net/~sdiggins/basm.html for more information on BASM and the above mentioned tools. All mentioning in the text of "win9x/DOS " refers to MS-Windows, (c) Microsoft Coorporation.
|
|||
Changes
since previous version.
|
|||
Known issues.
|
|||
Contact information.
DIYdatarecovery (Joep van Steen) : website : DIY
datarecovery, (http://diydatarecovery.sites.cc) Intra_Vee Developments (Tom Kuurstra) : website : Intra_Vee,
(http://intravee.sites.cc) If you experience an unknown error or any other problems please mail us on one the above mentioned addresses. Please explain the situation in which the error occurred and note any codes or text the program displayed during the error. Also include a description of the machine the program is running on, try to be as specific as you can. Include the log file, if you have one and the RepoMan version number. Currently, the distribution point for RepoMan can be
found here.
(http://home-1.worldonline.nl/~heems002/repoman.htm).
|
|||
Enjoy. |