Data Rescue is a tool for recovering lost Macintosh volumes. It recovers files and folders from crashed hard disks, floppy disks, or removable cartridges. Recovered data are saved to another medium, leaving the original disk untouched.
The main interest in Data Rescue is that the strategy for finding lost files is original, different from the strategies used by other tools like ‘Norton Utilities’. Not only will it find your data in situations where the other tools fail, but it will recover them in a much better condition, restoring icons, dates and even folder hierarchy.
While classic tools like ‘Norton Utilities’ search for file fragments, Data Rescue searches for catalog fragments. The catalog is a file maintained by the system to keep track of other files and folders. If catalog fragments can be found, the data recovery will be very efficient since the catalog contains valuable information about files: their size, type, hierarchy and location on disk.
There are many situations when Data Rescue can help you recover almost all of your lost data. Data Rescue is easy to use, fast, clean, and it also recovers the new HFS+ (‘MacOS Extended’) volumes.
The shareware fee for Data Rescue is $39. Until you register your copy with a personal code, you can only recover 1 file per session. This allows you to test Data Rescue and check that it helps you in your particular situation. Registering is very simple, as explained in the last part of this documentation.
You can try Data Rescue at no risk because:
-Data Rescue never modifies the original disk.
-You don’t have to pay until you are sure that Data Rescue will recover your data.
Data Rescue is small in size (300 KB), so it can be run from a floppy disk if necessary. You should always keep a copy of Data Rescue on an emergency disk (a system disk if possible).
How to use Data Rescue?
• Compatibility and requirements
Data Rescue requires System 7 or better. It is compatible with MacOS 8.5. It needs at least 512 KB of free RAM to run, but may need much more if it recovers a large volume (up to 4 MB).
Though Data Rescue is optimized for PowerPC computers, there is no minimum hardware configuration required. Data Rescue even works on 68000 systems.
Data Rescue was designed to cope with a wide range of situations:
-Data Rescue can handle any type of media (floppy disk, hard disk, zip, jazz, magneto-optical, etc.)
-Data Rescue can handle volumes which can’t be mounted, even if the driver is damaged.
-Data Rescue can handle disks with a damaged partition map.
-Data Rescue can handle both old and new (‘4.3’) SCSI, and IDE disks (also called ATA disks).
-Data Rescue can handle the new HFS+ (‘MacOS Extended’) volumes (even on most pre-8.1 systems).
-Data Rescue can handle large volumes (4 GB and larger).
-Data Rescue can handle password-protected volumes (if data are not scrambled).
-Data Rescue can handle non-Roman-script (e.g. Japanese) file names.
-Data Rescue can recover fragmented files.
Data Rescue was found compatible with all the systems on which it was tested, which include:
However, you should be aware that Data Rescue will not be useful in all situations. Data Rescue searches for catalog fragments to locate your lost files. Therefore:
-if you have disposed of a file through the trash by mistake, it has no more catalog entry, so using Data Rescue won’t help.
-if you have initialized a volume by mistake, the catalog may be completely erased, therefore Data Rescue may be unable to find your files.
Also note that you need some disk space on another device to recover your data. You may recover from one partition to another on the same disk, but that is strongly discouraged. Data Rescue can’t be used to fix the original disk.
• operation overview
Operation is basically as follows:
-You select the volume to recover.
-Data Rescue searches for catalog fragments in that volume and displays files available for recovery.
-You select files and folders to recover.
-Data Rescue saves your data to another device.
Very important: Always check that your data are fully recovered by opening your documents before you reformat (or initialize) your original disk. You may think that your data are recovered when they are not. The ‘allocation blocks layout’ section - later in this manual - explains why.
If you are using Data Rescue for the first time, you should read this manual in detail, because you may fail to recover your data if you don’t follow every step.
The following sections explain, step by step, how to use Data Rescue to recover your crashed disk.
• Starting Data Rescue
Data Rescue comes in two versions: 68K and FAT. The 68K version is smaller in size, but the FAT version runs faster on PowerPC machines. Both versions run on every Macintosh.
When you launch Data Rescue for the first time, you are prompted for your name and registration code. If you have already registered Data Rescue and you have that code, fill the corresponding fields in the dialog box and click the ‘Register’ button. Be sure that the name you enter is exactly the name you gave when you registered. When you click ‘Register’, a file named ‘Registration data’ is created in the same folder as Data Rescue. This file contains your code. If you later move Data Rescue to another folder or disk, be sure to move that file with it, or you will be prompted for your code again. If you copy Data Rescue to a write-protected medium or a CD-R, don’t forget to copy the registration data file with it, or you will have to enter the code each time.
If you have not registered yet, and you only want to test Data Rescue, just click the ‘Later’ button. Data Rescue will run, but it will only recover one file. If you want to recover more files, you will have to quit Data Rescue and launch it again.
• Selecting a volume
When Data Rescue starts, it scans the SCSI and IDE buses for available volumes (this may take a few seconds), then it displays them in a list. If you check the ‘Show extended information’ box, hardware information (bus, ID) is displayed.
If your volume does not appear in the list, try to rescan the buses with the ‘Rescan device list’ button. If your disk’s partition map is damaged, the name of the disk maker may appear instead of that of the volume. You can still identify your disk through its bus and ID (or through its size).
Note that in some special circumstances, your volume may appear more than once in the list.
If your volume is HFS+ (a.k.a. ‘MacOS extended’), you must check the corresponding box before you start. If you don’t know what HFS+ is, then most probably your volume isn’t. HFS+ is a new file system which was first implemented in MacOS 8.1. Currently, volumes are still initialized as HFS (‘MacOS standard’) by default. If you check HFS+ whereas your volume is actually HFS, no file will be found. If you don’t check HFS+ whereas your volume is actually HFS+, only a few uninteresting files will be found.
Some options should be set before you start, as explained in the next section. Then you can click the ‘Start’ button. Data Rescue will scan the selected volume for catalog fragments. It will also attempt to detect the allocation blocks layout, unless specified otherwise in the options.
If you click ‘Start’ and then feel that you have chosen the wrong volume or options, you can still click ‘Cancel’ in the progress window while Data Rescue is scanning for files. When Data Rescue has finished scanning for files, you can still go back to the volume selection window by choosing ‘Recover New Volume’ in the ‘File’ menu.
• Data Rescue options
You can set options by choosing ‘Options…’ in the ‘File’ menu. Most options are meaningful only at scan-time, which is why they are presented here. Once set, options are saved in the ‘Preferences’ folder of your system folder. The default options are fit for most situations.
• Fast scan: If you check this box, only 2% of your disk will be scanned for catalog fragments. The search will be much shorter, but some files may not be found. In almost every volume, most of the catalog is contained in the first 2% of the volume. So if you are only looking for a particular file, you can try a fast scan first, and then proceed to full scan if your file wasn’t found. But if you wish to recover your whole volume, don’t check this box. Note that if partitioning is ignored, a fast scan may fail because of the space used by the driver.
• Ignore partitioning: If you check this box, partitions will be ignored. This means that your whole disk (including its partition map and drivers) will be seen as a volume. Don’t use this option if there is more than one volume on your disk. Note that if this option is set, some volumes may appear twice in the list (once as the volume, once as the whole disk). You should check this box only if you feel that the partition map is damaged. Anyway, Data Rescue may ignore partitioning automatically for disks with questionable partition maps. You can see that partitioning is ignored for a particular disk because the name of the disk maker appears instead of that of the volume.
• Auto-detect allocation blocks layout: The allocation blocks layout is a pair of parameters which must be known in order to recover files correctly. The meaning of these parameters is explained in the next section. If this option is set, Data Rescue will attempt to detect these parameters automatically. Otherwise, it will use the parameters you provide. If the ‘Fast’ box is checked, Data Rescue will use 10 files to make its calculations (otherwise, it will use 200 files). Note that the ‘manual’ allocation blocks layout values are not stored in the preferences file.
The recommanded setting is ‘Auto-detect’, ‘Fast’ box clear.
• Color for bad files: This option is meaningful only at recover-time. Files that have errors when recovered take the color you specify unless you set this menu to ‘Do not change’. The 7 colors actually correspond to the 7 Finder ‘families’.
• Replace missing data with zeros: This option is meaningful only at recover-time. If a read error occurs while a file is recovered (possibly because of a bad medium), and if this option is set, then the missing data are replaced with zeros and more data are read if possible. If this option is not set, no more data are read for this file, and the recovery goes on to the next file.
Click ‘OK’ once you have set appropriate options.
• About the allocation blocks layout
This section will discuss allocation blocks layout, an advanced topic. Unless you encounter troubles with the allocation blocks layout, you may skip this section, but there is at least one thing you must know:
important: before you start to recover files, you must look inside a few files and check that their content is what you expect. This will ensure that the allocation blocks layout is correct and that Data Rescue will recover your files, not random data.
-find a text file (a file with type ‘TEXT’), select ‘New Window With This Files’s DATA’ in the ‘Blocks’ menu, and check that the text in the rightmost column is what you expect.
-find a file which contains resources (e.g. an application, type ‘APPL’), select ‘New Window With This Files’s RSRC’. The name of the file is usually written in the fourth row (rightmost column).
You can also recover a few test files if you have the necessary applications to open them.
If files contain what you expect, then the allocation blocks layout is correct, and you can move to the next section. Otherwise, you should read the present section.
All macintosh volumes are made of 512-byte blocks called ‘logical blocks’. However, files are made of ‘allocation blocks’, whose size is a multiple of 512 bytes. The location of a file is written in the catalog in terms of allocation blocks. To find the corresponding logical blocks, the following formula is used:
logical block = allocation block ¥ a + b
Where a is the number of logical blocks per allocation blocks, and b is the logical block of the first allocation block. a and b are the allocation blocks layout. a and b take different values on different volumes.
Since Data Rescue finds allocation block numbers in the catalog but adresses disks in terms of logical blocks, it must know a and b to recover files. If either a or b has an incorrect value, the output files will contain random data, even if sizes and icons are correct! This is why you must check the content of a few files to be sure that a and b are correct.
To detect the allocation blocks layout automatically, Data Rescue picks 200 files in the volume, and finds which combination of a and b gives most files respecting the above formula. It can be long to find the 200 files, so there is a ‘Fast detection’ option to get only 10 files. If a fast detection yields questionable values, you should restart with a normal detection. Fortunately, the automatic detection of the allocation blocks layout rarely fails.
If the allocation blocks layout cannot be detected, Data Rescue shows an alert box. This may happen when not enough files have been found for calibration. If so, or if the values found by Data Rescue are incorrect, you’ll have to set a and b manually in the options window, where a is called ‘block size’, and b is called ‘base block’.
To set a and b manually, open the options window by selecting ‘Options…’ in the file menu. Then click the ‘Use this:’ button, and enter a and b in the lower and upper boxes, respectively. Once you have set values manually, check the contents of a few files, as explained at the beginning of this section, and change values again if the contents don’t match.
When the disk is scanned for files, Data Rescue tries to guess a and b according to the disk’s size. It also tries to find these values in the volume’s ‘Master Directory Block’ (MDB). These values are logged to the report. To read the report, select ‘Show Report’ in the ‘Report’ menu. Below is a sample report extract:
About the allocation blocks layout:
According to the volume information (MDB), base block=19, block size=8.
According to the alternate MDB, base block=19, block size=8.
Best guess according to the volume's size: base block=19, block size=8.
Note: a is the ‘block size’, b is the ‘base block’.
You should start from the values given in the report if you don’t know what to set as a and b. Also try other values around these. Sometimes, a is exactly twice what Data Rescue guessed.
In HFS volumes, b is often 19 or around (a depends on the size of the volume).
In HFS+ volumes, a is a power of 2 (often 8). Some tools let you choose a on initialization. A block size of 512 bytes (1/2 KB) means a=1, a block size of 1 KB means a=2, etc.
Please note that if the file(s) you want to recover were not found by Data Rescue, there is no point in determining the allocation blocks layout, as your files won’t be recovered anyway.
• using the ‘Recover’ window
After Data Rescue has scanned your volume for catalog fragments and, if required, detected the allocation blocks layout, it opens a new window entitled ‘Recover files’.
Files found by Data Rescue are presented in a list with their names, types, creators, size and modification date. As in the standard Macintosh ‘Open’ window, you can go down the folder tree by double-clicking folders, and up by using the hierarchy pop-up menu above the list.
There may be a folder named ‘Anonymous folders’ at the root of your file hierarchy. This folder contains folders whose information (name, location in the folder tree) could not be found in the catalog, but who are referenced as parent folder for other files or folders.
Files can be sorted by name, size, date, type or creator, as chosen with the ‘Sort by’ pop-up menu.
You can search for files having a particular name, size, date, type or creator. For instance, if you are looking for files that were modified since August 1, 1998, set the ‘Find’ menu to ‘Date ≥’ and enter ‘8/1/98’ in the ‘Find’ box. Then click ‘Search’. Data Rescue will jump to the folder containing the matching items. If several folders contain matching items, use the ‘next folder’ and ‘previous folder’ buttons to move to other folders.
You can hide files or folders from the list. Data Rescue will not recover the hidden items. Assuming that you want to recover your whole volume at once, you can hide undesirable items located in sub-folders before you recover, so that you don’t have to remove them after you have recovered. To hide files or folders, select them in the list, then click ‘Hide’. To revert all items in the volume to visible, click ‘Show All’.
Items you may want to hide include:
-Artefacts. These are pseudo-items that don’t really exist on your disk. They always have weird names. They are in the list because from Data Rescue’s point of view, they look like files or folders. Artefact files can be very large and could clutter your recovery medium.
-Duplicate items. A file or folder may be listed several times if Data Rescue finds several catalog entries for it on the disk. You should find the correct entry for each file and hide all others.
-Large files that you don’t really need to recover, for instance an application that you can reinstall from the original disk or CD-ROM. Use the “Search” feature to find large files.
-The system folder. You will probably want to reinstall a clean system from the Apple CD-ROM, so you don’t need the old folder. However, you may want to recover your ‘preferences folder’, or some files installed in your system folder by third party softwares.
-The trash, and temporary or system files like the ‘Desktop database’.
When you have located the file(s) or folder(s) that you want to recover, select them and click ‘Recover’. You will be asked for a place to save your files to. Needless to say, you must not select the volume that you are recovering. A folder named ‘Recovered #…’ will be created and your folders and files will be saved to it. You should try to open a few files to check that they were properly recovered. Also check the report by selecting ‘Show Report’ in the ‘Report’ menu.
Always check every file that has importance to you after is is recovered. Data Rescue never alters the original disk, so you can try other methods to recover your files if Data Rescue fails. After you reformat or initialize your disk, it is very likely that Data Rescue won’t be able to recover data anymore. In general, always try non-destructive methods like ‘Data Rescue’ before you attempt to ‘fix’ your disk.
• Block-level tools
Data Rescue features block-level tools to display and save raw disk blocks.
To display a block, select ‘New Window With Block#…’, and then enter the number of the logical block you want to display. The block is read in the currently selected volume. You can also read the first block of the data fork (resp. resource fork) of a file by selecting this file and selecting ‘New Window With This File’s DATA’ (resp. RSRC). In that case, the logical block read depends on the allocation blocks layout.
The first number in a row is the offset in the block (in hex). Then follow the block’s data in hex and ASCII. You can view the next (resp. previous) block by selecting ‘Next Block’ (resp. ‘Previous Block’) in the ‘Blocks’ menu. You can also jump to a particular block by selecting ‘Go To Block#…’ in the same menu.
If you wish to view your disk’s partition map, you must ignore partitioning, since the partition map does not belong to a volume. Also note that you can’t edit a block in the block display.
You can save raw blocks to another medium by selecting ‘Save Blocks As…’ in the ‘Blocks’ menu. This brings the following window:
Select a location to save your blocks and enter the number of the first logical block to save and the number of logical blocks to save. You can also set a particular type or creator for the file. Click ‘Save’ to save the blocks.
• Data Rescue report
Data Rescue reports comments and errors in a window entitled ‘Report’ which you can view by selecting ‘Show Report’ in the ‘Report’ menu. This window cannot be edited, but you can save its content to a text file by selecting ‘Save Report As…’ in the ‘Report’ menu. You can also log the report continously to a file by selecting ‘Log Report To…’ in the ‘Report’ menu. These files can be edited or printed with a basic text editor like ‘SimpleText’.
• You can get useful information about your computer’s configuration by selecting ‘Report Configuration’ in the ‘Report’ menu. This includes Data Rescue configuration, hardware configuration, system software configuration and a list of active system extensions and control panels.
• You can list all files and folders in the current folder by selecting ‘List Files/Folders’ in the ‘Report’ menu.
• You can get more information about the selected file(s) or folder(s) by selecting ‘Report File/Folder Info’ in the ‘Report’ menu. This includes file/folder ID, type & creator, data and resource forks sizes, creation & modification dates, and allocation block numbers.
• You can clear the report window by selecting ‘Clear Report’ in the ‘Report’ menu.
The report window contains 500 lines at most. When it reaches 500 lines, the first lines are removed as new lines are added. However, you can record longer reports by logging them to a file with the ‘Log Report To…’ command.
-Logical unit numbers (LUN) other than 0 are not supported yet. This may be a problem for disk arrays.
-Balloon help is not implemented.
Registering and other issues
• Registering Data Rescue
You have 3 good reasons to register Data Rescue:
-When you register, you will receive a personal registration code that will allow you to recover as many files as you want.
-When you register, you can get free technical support by e-mail (see next section).
-When you register, you are entitled to all future versions of Data Rescue for free.
Data Rescue has the following pricing:
-Single user license: $39 per user.
-A Site License costs $390 (equal to 10 users) and covers all locations for your organization within a 160 kilometer radius of your site (100 miles). One big advantage of a Site License is that you do not need to keep track of how many people at your site are using the software.
-A World-Wide License costs $3900 and it covers all locations for your organization on the planet earth.
Payments are handled by Kagi Software. You can register through Kagi’s online registration service at <http://order.kagi.com/?9YO > (card payment only). SSL (secured) payment is also available . Online payments are usually processed within 24 hours.
You can also use the Register program that accompanies Data Rescue. Open it, then enter your name, your e-mail address, and the number of single user licenses you desire for each program you wish to purchase (or Site or Word-Wide licenses). Save or Copy or Print the data from the Register program and send the data and payment to Kagi.
If paying with Credit Card or First Virtual, you can e-mail or fax the data to Kagi. Their e-mail address is sales@kagi.com and their fax number is +1 510 652-6589. You can either Copy the data from Register and paste into the body of an e-mail message or you can Save the data to a file and you can attach that file to an e-mail message. There is no need to compress the data file, it's already pretty small. If you have a fax modem, just Print the data to the Kagi fax number.
Payments sent via e-mail are processed within 1 or 2 days. You will receive an e-mail acknowledgement when it is processed. Payments sent via fax take up to 10 days and if you provide a correct internet e-mail address you will receive an e-mail acknowledgement.
If you are paying with Cash or USD Check you should print the data using the Register application and send it to the address shown on the form, which is:
Kagi
1442-A Walnut Street #392-9YO
Berkeley, California 94709-1405
USA
You can pay with a wide variety of cash from different countries but at present if you pay via check, it must be a check drawn in US Dollars. Kagi cannot accept checks in other currencies, the conversion rate for non-USD checks is around USD 15 per check and that is just not practical.
If you have a purchasing department, you can enter all the data into the Register program and then select Invoice as your payment method. Print three copies of the form and send it to your accounts payable people. You might want to highlight the line that mentions that they must include a copy of the form with their payment.
When your payment is processed, you will receive a personal registration code that will allow you to recover as many files as you want. If you do not have an e-mail address you should consider selecting the Postcard Receipt so that Kagi can inform you of your registration code. Kagi transmits the registration codes via e-mail and paid postcard receipt only.
• Technical support
When you register, you can get free technical support by e-mail at <support@wildbits.com>.
The purpose of technical support is to help you to get the maximum out of Data Rescue, but I cannot guarantee that Data Rescue will succeed in recovering your data. Therefore, you should check that Data Rescue fits your particular situation before you register Data Rescue.
The only channel of communication for technical support to Data Rescue is by e-mail at <support@wildbits.com>. Other technical support requests will be ignored.
Please check Data Rescue's frequently asked questions at <http://www.wildbits.com/rescue/faq.html> before you send e-mail, as your question me already be answered there.
-Please send your name and registration code with any technical support request.
-Please send as many details as possible about your configuration and problem.
-Please include a copy of Data Rescue’s report in your message.
-Please give your message a subject that is specific to your problem. For instance: “registration: my code is rejected” is better than “Data Rescue problem”.
More guidelines for requesting technical support can be found at: <http://www.wildbits.com/rescue/support.html>.
I will try to reply to technical support requests as fast as possible. However, I cannot guarantee any reply delay.
Suggestions and bug reports from registered or unregistered users are welcome at <report@wildbits.com>
Data Rescue 2.1.1 and this documentation can be distributed freely for non-profit purposes in the form of the original archive. Data Rescue may not be distributed for profit purposes without the author’s permission.
Many thanks to Vincent Berville and Paul Kühn for all their suggestions, testing and help.
The ‘about box’ helmet is a modified picture of an antique fireman’s helmet found in the ‘R1Antiques Cybermall’. My thanks go to Ron Clapp for letting me use the image. The fireman’s helmet is probably not for sale anymore, but there are many fine antiques to see in this site, so visit them at <http://www.r-one.com/antiques/>
I recommend ‘Sedit’ by David Shayer, a remarkable block-level disk editing tool. The latest version of Sedit can be found at: <ftp://members.aol.com/sentientsw/>
Check for new versions at <http://www.wildbits.com/rescue/>
Technical support (for registered users): support@wildbits.com
Bug reports & suggestions: report@wildbits.com
Information: info@wildbits.com
Snail-mail: Sylvain Demongeot, 34 Chemin Latéral, 94140 Alfortville, France (not for payments!)
• Version history
• 2.1.1 (november 1998)
Corrected a bug that caused version 2.1 FAT not to launch on PPC systems with MacOS 7.x or 8.0.
• 2.1 (november 1998)
Added Support for non-Roman-script (e.g. Japanese) names in HFS+ volumes.
Windows use the system font on non-Roman-script systems.
Fixed a bug that caused date shift on some systems.
Added support for files with empty names.
Improved detection of ‘SoftRAID’ or similar volumes.
Added ‘Report Configuration’ command.
Added ‘Log Report To…’ command.
Improved information reporting.
Cmd-Up & Cmd-down may be used to move in the file hierarchy.
Closed folder is selected when returning to higher level.
Sizes also given in octets in ‘Report File/Folder Info’.
Changed allocation blocks layout options labels for consistancy.
• 2.0.2 (august 1998)
Fixed a bug that caused out-of-memory conditions when scanning very fragmented volumes.
• 2.0.1 (august 1998)
Fixed a bug that caused the program to crash when closing the options window on some systems.
• 2.0 (august 1998) - first international release as a shareware
Added support for HFS+ (MacOS extended) volume format.
Optimized for PowerPC (‘FAT’ version).
Improved volume detections: fewer volumes appear twice in the volume list.
Block numbers entered as decimal, not hex, in the ‘Go To Block…’ and ‘Save Blocks…’ dialogs.
Added ‘Report File/Folder Info’ command.
Added warning when user wants to save to original volume.
Improved information/error reporting and appearance.
• 1.0.1 (september 1997)
Added support for devices with block size greater than 512 (CD-ROM, magneto-optical…)
• 1.0 (september 1997) - initial release (France only) as a commercial product, under the name ‘Find All’
• Disclaimer of warranty
In using this software, you understand and agree that this software is provided "as is" without warranty of any kind. The entire risk as to the results and performance of using this software lies entirely with you, the user. The author does not make any warranties, either expressed or implied, including but not limited to implied warranties of merchantability and fitness for a particular purpose, with respect to this software. In no event shall the author be liable for any consequential, incidental, or special damages whatsoever (including without limitation damages for loss of critical data, loss of profits, interruption of business, and the like) arising out of the use or inability to use this software.
Although the author would appreciate any feedback and bug reports, the author shall not be responsible for correcting any problems which you discover. Furthermore, the author may at any time replace, modify, alter, improve, enhance or change this software.
