Chip 2005 August

home *** CD-ROM | disk | FTP | other *** search

/ Chip 2005 August / CHIP_CD_2005-08.iso / bonus / photo_rest / files / setup.exe / {app} / DOS / MANUALS / zarntfs.txt < prev next >

Wrap

Text File | 2002-01-21 | 13.9 KB | 289 lines

Zero Assumption Recovery (ZAR) version 6.3 NTFS recovery (ZARNTFS) USER'S MANUAL Copyright (C) Alexey V. Gubin, 1999-2002 *** SYSTEM REQUIREMENTS *** * 386 or better processor * 4Mb memory + 1Mb memory per gigabyte of volume to recover * Additional disk device to store recovered data (preferably another HDD) * MS-DOS operating system or MS Windows 9x in DOS mode * HIMEM.SYS driver installed *** DATA RECOVERY PROCESS *** It is recommended that you print this manual so you can refer to it during the recovery process. Volume reconstruction basically consists of the following stages: 1. Determining the area to be recovered and configuring options 2. Pattern scanning of that area 3. Reconstruction of disk parameters based on pattern scan results 4. Reconstruction of directory tree 5. Recovering selected directories to another medium 6. Restoring long file names *** STAGE 0 - SETTING UP RECOVERY PROCESS *** ZAR cannot be used from within any multitasking environment (including Windows), so you must reboot from floppy disk or restart Windows in MS-DOS mode. 0.2 - LOG FILE LOCATION Once you start ZAR, you will be asked about log file location. Please note that log file can grow as large as 10 megabytes in size (for large disks) and it is written to quite often. So if you want logging, you should put logfile on a large and fast medium (I recommend using the same medium you plan to recover data to). You can press ENTER to accept default location (in a ZAR.EXE directory), enter NUL to disable logging or enter your custom log file name. *** STAGE 1 - DETERMINING THE AREA TO BE RECOVERED *** First of all you are prompted to select a physical disk you want to recover. ZAR displays a list of compatible disks found, showing their parameters (including capacity). Highlight the desired drive and hit "Enter". Two additional options exist here: 1. You can load the disk image from file. For more information about disk images, see appendix A in ZARFAT.TXT manual. 2. You can choose to load previously saved scan results. You will be asked about a file name later, because save file is only valid for a disk the scan was run on. After requesting a save file, you should select a disk (or image file) matching the save file. Once the disk is selected, you will be asked about the save file name. Program checks the disk size stored in a save file against the size of a selected disk (or image) and displays a warning if it detects a mismatch. If the physical disk is selected, program will perform some simple hardware diagnostics and try to read partition table to determine volume layout. If partition table is (at least partially) correct, the list of available volumes will be displayed with the following information: 1. Partition type ("Type") This can be either PRI for primary partition or EXT for logical drive in extended partition. This field is only provided for reference, and you can ignore it if you are not familiar with these FDISK terms. 2. Filesystem type for the partition ("OS / Filesystem type") This is a file system type as indicated by a partition table. For NTFS, "NTFS, HPFS or QNX" is reported, because all these filesystems have the same type identifier value in Partition Table. 3. Active partition flag ("Active") This is "Yes" when the volume is used for OS startup. Otherwise "No" is displayed. Only a single partition (on physical disk) can be active, and it must be primary ("PRI" partition type shown). 4. Start offset, in megabytes ("Start at, Mb") This is an offset of the first partition sector (form the start of disk) in megabytes. In most cases it should be equal to the sum of sizes for all previous volumes. 5. Volume size, in megabytes ("Vol. Size, Mb") This is a volume size as indicated by partition table 6. Boot sector signature status ("Boot Sig") Shows if the volume boot sector looks correct. Can be either "Good" or "Bad" A number of tests is performed in attempt to check partition table for consistency. Should these tests fail, a warning will be displayed stating that partition table is untrustworthy and describing problems found. Possible causes include: 1. Too much space left unallocated (this can be a false alarm). 2. Volumes that are sized greater than a physical disk can hold. 3. Some volumes overlapping each other. 4. Some volumes having bogus records (such as end sector before start sector) but still can be recognized. 5. Some partition table records damaged beyond recognition. Case 1.1 - PARTITION TABLE EXISTS AND IS CORRECT This is a case when no messages about bad signatures are shown and volume layout shown on the "Select partition to recover" screen is correct. In this case you should simply select the volume you want to recover from the list displayed. Case 1.2 - PARTITION TABLE IS DAMAGED OR CONTAINS INCORRECT DATA Systems with missing (e.g. overwritten) partition table exhibit the following symptoms a. Volumes, which are known to be on the disk, are not shown when operating system starts b. ZAR reports that "Partition table sector 0 signature is bad" and/or "Partition table seems to be damaged" c. ZAR shows no volumes on a "Select partition to recover" screen Systems with (partially) corrupt partition table exhibit the following symptoms a. Some volumes are not shown when operating system starts b. ZAR reports that "Partition table sector N signature is bad" and N is not zero c. ZAR shows incomplete or incorrect information about volumes You may also want to specify volume layout manually after accidental FDISKing the drive. In those cases partition table is valid but actually contains wrong information. If the volume you want to recover is either missing or displayed incorrectly, you should manually select area for recovery. This can be done by entering values for start sector and size of the volume. This values are accepted in sectors or in megabytes (which are automatically recalculated to sectors). Volume start offset (first sector) is usually a sum of sizes for all volumes preceding the volume in question. Assume as the example that there was a following partition layout: C: - 5 Gb volume (system startup) D: - 5 Gb volume E: - 10 Gb volume giving 20 Gb of total hard disk capacity Corresponding start offsets will be 0 Mb for volume C:, 5000 Mb for D: and 10000 Mb for E:. It is recommended to subtract 10..100 Mb (to avoid calculation errors, such as a possible confusion between decimal and binary megabytes), adding the same values to the volume size. Taking the above into account, the following values should be used for this example: C: - 0 Mb offset, 5000 Mb size D: - 4900 Mb offset, 5100 Mb size E: - 9900 Mb offset, 10100 Mb size. WARNING: Should you specify incorrect area to search in, the entire recovery will fail. *** STAGE 2 - PATTERN SCANNING *** Pattern scanning is used to detect all recognizable pieces of data remaining on volume. It is always a tradeoff between gathering as much data as possible (to allow for successful recovery) and not to gather the infinite quantity (for higher analysis speed). Recognition for some types of disk areas is mandatory (these are system structures). You can disable recognition for others, but it is strongly recommended that you leave the default setting (All enabled) and select "Proceed". Program scans the area you selected during stage 1 and locates all data pieces it can recognize. This information is then used in analysis. *** CONFIGURING RECOVERY OPTIONS *** There are the following options available in ZARNTFS: 1. "Recover long file names". "Yes" or "No", "Yes" by default. This toggles long file name information recording (see STAGE 6 below for details of LFN reconstruction process). 2. "Recover erased files". "Yes" or "No", "Yes" by default. This option controls recovery of files erased prior to a disk crash. Not of a much use, except for mass undeletions after virus attack. 3. "Skip files > X Mb, 0 - all files". Number from 0 to 2047, 100 by default. With this option active files greater than X Mb in size will not be recovered. Value of 0 disables size checking. I consider the default 100 Mb limit to be acceptable (swapfiles and MPEG/AVI videos are common examples of what will be filtered out). 4. "Simulation mode (DEBUG)". "Yes" or "No", "No" by default. This option is intended primarily for debugging purposes. It SHOULD NOT be used during normal recovery run. If "Simulation" is set to "Yes" ZAR will create directories and files requested, but NO DATA WILL BE WRITTEN to files (they will be all of zero size). However, the logfile will be created. When options are configured, hit "Proceed" *** STAGE 3 - DISK PARAMETERS RECONSTRUCTION *** NTFS has 3 significant volume parameters, namely 1. FRS size - size of a so-called "File Record Segment", an entry in the volume Master File Table (MFT), which describes a file or directory. At least one FRS is recorded into MFT for each file. 2. Cluster Factor (CF) - a number of sectors per cluster. 3. Start Sector (SS) - sector number for cluster number 0. All MFT records on volume have the same FRS size, so its determination is very simple. ZARNTFS will show the table which lists all possible FRS size values, along with their "Relevance". In this case "Relevance" is simply a percentage of records having this FRS size. You should choose the most relevant value from list (it is already highlighted as default choice, so in most cases you only need to press Enter). CF and SS understanding (and determination) is a little bit more difficult. Locations of the files on volume are expressed in number of clusters, while the same locations on the physical disk should be expressed in sectors. Number of sector is computed from the number of cluster by the following simple formula: Sector = CF * Cluster + SS where CF (Cluster Factor) is number of sectors per cluster and SS (Start Sector) is a sector number for cluster 0. When volume is damaged, values of CF and SS are usually lost or corrupt, so they are determined statistically based on pattern scan results. Automatic CF determination procedure simply tries all possible values from 1 to 16 and computes a number of errors for each value. The table usually looks as follows CF = 1 gives 0% errors CF = 2 gives 0% errors CF = 4 gives 0% errors CF = 8 gives 50% errors CF = 16 gives 75% errors and so on. The maximum CF value that gives less than 20% errors (which can arise from old data and from pattern scanning errors) is considered good. You can however enter a broader range of CFs to search, if you know that autodetected value is incorrect. For each CF value in a selected range, Start Sector (SS) is guessed. Total execution time for this stage is limited to approximately 3 minutes per each CF value tested. When it is finally done, you are to choose between several variants, which are displayed with their corresponding relevance values. In most cases you should select the first (default) variant (with maximum relevance). *** STAGE 4 - DIRECTORY TREE RECONSTRUCTION *** This step is fully automatic and you cannot interfere with a process. During the reconstruction process the details are shown on screen, but you should merely ignore them (they are recorded into the log file as well). *** STAGE 5 - RECOVERING FILES *** When directory tree is refined, you are presented with a simple directory tree viewer. The viewer tries to find the most readable form of a directory name to display. When a long name is available for a directory, it will be shown. ZARNTFS shows a number of files in the directory following its name. Use Up and Down arrow buttons to move through the list and Spacebar to select/deselect directory. The full list of the hotkeys available is provided in a bottom line of screen. When done, press "S" to start recovery. You will be prompted about the target location where recovered files will be stored. WARNING: Never copy files to the volume you are recovering, as it is likely to cause further damage! During the copy process the following information will be shown: * Total number of files requested. * Number of files copied * File name and size for the file being copied. * Some technical information (like filesystem flags for the file). *** STAGE 6 - RECOVERING LONG NAMES *** During file copy operation, long file name information is collected to file named LFNINFO.DAT. This file is stored in the directory you specified as a file copy destination. When copying is done, you should boot into Windows (any version will do, but it must support the language used on a crashed system), run FIXLFN.EXE and follow onscreen instructions. IMPORTANT: Do not modify the recovered data location (i.e. do not rename/move files) before you run FIXLFN!