Media Tools Manual

(Updated: February 21, 2006)
RecoverSoft Media Tools Professional

Data Recovery and Computer Forensic Software

Table of Contents

Manual: You do not need to read the entire manual to use the program to recover
your data. Read Chapter 1 (one page) to determine which function(s) of the
program you need to use.

Chapter 1 What can RecoverSoft Media Tools Professional do for you? 3
1.1 Trial Version Capabilities
1.2 Registered Version Capabilities

Chapter 2 Registration and Support 4
2.1 Registration
2.2 Software Support
2.3 Program Developer

Chapter 3 Set-up Procedures 7
3.1 Items Needed to RecoverSoft Run Media Tools Professional
3.2 Desktop Set-up
3.3 Laptop Set-up
3.4 Drivers and Converters (SCSI, Iomega ZIP/J AZ, USB, SATA)

Chapter 4 Running RecoverSoft Media Tools Professional 10
4.1 Launch the Program
4.2 Select Drive
4.3 Select Operation:
Cycle-Clone (including Reverse-Clone) / Cycle Image (Ch. 5)
File Recovery Tree (Ch. 6)
Boot Partition Repair (Ch. 7)
Media Editor (Ch. 8)
Secure Wipe (Ch.9)

Chapter 5 Cycle-Clone / Cycle-Image 14
5.1 Cycle-Clone Clone Drive to Drive
5.2 Reverse-Clone (mechanically failing drives)
5.3 Cycle Image Create Image File
o Directions to format a Destination Drive FAT32
5.4 Span, Split or Compress Image File
5.5 Restore Image File
5.6 Restore a Portion of the Image File

Chapter 6 File Recovery Tree 27
6.1 (File) System Components Search
6.2 Select File System to Rebuild
6.3 Recover Files and Directories to a FAT32 destination drive
6.4 Restore Files and Directories Using WinZip or PKZIP
6.5 Use the Menus to look for and filter specific files
6.6 Mount the File System into Media Editor <View>, <Look For>and <Edit>raw data
Chapter 7 Boot Partition Repair 38
7.2 Select Valid File System to Rebuild
7.3 Create a Backup File
7.4 Access Repaired File Systems
7.5 How to Make the Drive Bootable

Chapter 8 Media Editor 43

Try Before You Buy Capabilities
8.1 Select Working Area (Mounted or Unmounted File System)
A. Unmounted File System
B. Mounted File System
1. (How to) Mount the File System
2. Recover Files and Directories Automatically

Registered Version Capabilities
8.2 View (the Sector) As
8.3 Look For (within a Sector)
8.4 Save Sectors / Restore Sectors of data to/from a file
8.5 Fill Current Sector

Chapter 9 Secure Wipe 60
9.1 Wipe the Drive
9.2 Department of Defense, Secure Wipe

Chapter 10 Save/Load Found Components 63
10.1 Save Found Components to a Bin File
10.2 Load Found Components from the Bin File

Chapter 11 FAQ (frequently asked questions) 70
11.1 Does RecoverSoft Media Tools Professional recover from viruses?
11.2 Does RecoverSoft Media Tools Professional recognize USB?
11.3 Can RecoverSoft Media Tools Professional recover from RAID?
11.4 Does RecoverSoft Media Tools Professional recover SATA drives?

Chapter 12 Problem Solving 71
12.1 Problem Launching the Progra
12.2 Program Freezes While Using it
12.3 No Valid File System Found
12.4 File System not Displayed (in Select File System screen)
12.5 File cannot be Located
12.6 Cannot Locate the Root Directory

Chapter 13 Advanced Data Recovery and Computer Forensic Procedures 74
13.1 Advanced User Set-up Window - <Ctrl S>
13.2 RAID Recovery
13.3 Compression on the Fly
13.4 MD5 Hash Mark
13.5 File System Types

License Agreement 79

Software Warranty, Guarantee and Discount Coupon 81
Chapter 1 What can RecoverSoft Media Tools Professional do for you?
2

The following explanation will give you an overview of RecoverSoft Media Tools Professional
and which functions you can run in the Trial Version and the Registered Version.

1.1 Trial Version Capabilities

The Trial Version of RecoverSoft Media Tools Professional allows you to perform the
following functions on any DOS and Windows drives to view which files and folders can be
recovered, before having to purchase the program:

If you are not sure whether to use File Recovery Tree or Boot Partition Repair,
use File Recovery Tree.

File Recovery Tree (Chapter 6) rebuilds any FAT or NTFS (DOS and Windows) file
system automatically from hard drives (IDE, SCSI, and SATA) and removable media (USB
Devices), including accidental format and deletion, corrupt or missing file systems, viruses and
worms, files located in slack space from previous formats, and even digital pictures, allowing you
to view which files and folders can be recovered.

Boot Partition Repair (Chapter 7) - rebuilds any FAT or NTFS (DOS and Windows) boot
sector and partition table automatically from hard drives (IDE, SCSI, and SATA) and removable
media (USB Devices), allowing you to view which files and folders can be repaired.

Media Editor (Chapter 8) mounts and rebuilds any FAT or NTFS (DOS and Windows)
file system through easy to follow screenshots and directions, allowing you to view which files and
folders can be recovered. (Note: This option is used if File Recovery Tree does not produce the
results you expect).

1.2 Registered Version Capabilities

The Registered Version, a purchased copy of RecoverSoft Media Tools Professional, gives
you all of the trial versions capabilities. Plus, it lets you perform the following operations on any
media type or operating system:

Cycle-Clone (including Reverse-Clone) /Cycle-Image (Chapter 5) - extracts raw data
from mechanically failing drives on any media or operating system, keeping drives out of the
clean room. It also creates an exact sector copy to another media or network for back up
protection.

Media Editor (Chapter 8) - In addition to its Try Before You Buy capabilities, the Media
Editor also lets you View, Look for, Edit, and Report anything within the file system on any
media or operating system much easier than other editors through custom designed editing
templates.

Secure Wipe (Chapter 9) quickly and permanently overwrites every bit on every sector on
any media or operating system to the level the U.S. Department of Defense requires and
authenticates it with MD5.
The MD5 Hash Mark can be used throughout program for computer forensic cases.

The Registered Version, a purchased copy of RecoverSoft Media Tools
Professional, allows you to recover files and folders to another destination to a
local network, hard drives, and USB Devices.
3
Chapter 2 Registration and Support

2.1 Registration / p. 5
A. Program Registration / p.5
B. Failing Copies / Lost Copies / p.5
2.2 Software Support / p.6

2.1 Registration
4

2.1.A. Program Registration

1. Purchase the program. If you forget where you downloaded the program, press the
<Software Support>button, once the program launches, for purchasing information.

2. A Program Key will be issued to you as soon as your order is verified.

3. Insert the RecoverSoft Media Tools Professional CD and turn on your computer.
It is self-booting and automatically launches the program.

4. Upon entering the program, you are prompted to register the program. Press <Alt Y>
or <Enter>.

5. Once the Registration Window appears, type in the Program Key sent to the email
submitted during the purchasing process.

6. Enter the Program Key in the Registration Window, and press <Enter>to register the
program.

2.1.B. Failing Copies / Lost Copies

Download the appropriate version at http://www.prosofteng.com.

5
2.2 Software Support

Frequently Asked Questions: www.prosofteng.com >Support button.
Manual: www.prosofteng.com >Support button.
Email: support@prosofteng.com

Phone: 1-925-426-6100
Fax: 1-925-426-6309
Email: support@prosofteng.com

Corporate Website: www.prosofteng.com

6
Chapter 3 Set-up Procedures

3.1 Items needed to Run RecoverSoft Media Tools Professional / p.8
3.2 Desktop Set-up / p.8
3.3 Laptop Set-up / p.8
3.4 Drivers and Converters / p.9
A. SCSI / p.9
B. Iomega ZIP/J AZ / p.9
C. SATA / p.9

7
3.1 Items Needed to Run RecoverSoft Media Tools Professional

Personal Computer (PC)
RecoverSoft Media Tools Professional CD.
Destination media, if using File Recovery Tree.
PKZIP 4.0 or greater (http://www.pkware.com/products/free_eval.html) or WinZip 9.0
or greater (http://www.winzip.com) to extract your recovered files and folders.
Destination media, if using Cycle-Clone / Reverse-Clone (hard drive of equal size or
larger); if using Cycle-Image (local network, hard drive, or removable media).

Work on your original problem media, or on a sector-by-sector
clone/image of the original problem media (see Chapter 5, Cycle-Clone
/Cycle-Image). Almost all software that clones/images does it file-by-file
(not sector-by-sector), which means it cannot clone/image deleted files,
files which have been overwritten, etc. In other words, you will not be able
to recover your data from a drive that has been cloned/imaged with a file-
by-file clone/ image software. Use our sector-by-sector clone (See Chapter
5, Cycle-Clone/Cycle-Image).

3.2 Desktop Set-up

Unhook any peripherals not used during the recovery process (Other hard drives
attached to the system, CD-ROM drive, burner, etc.), as these could interfere with the
program. Also, each hard drive must be on a separate IDE channel (not daisy-chained).

3.3 Laptop Set-up

Take the laptop drive out and connect it to a desktop system, as a Slave Drive, using a Laptop
Converter. You can get this converter from http://www.cabledepot.com (1-800-343-4597 toll free
or 1-770-564-2323) for approximately $15 Part Number: ADP3040IDE

8
3.4 Drivers and Converters (SCSI, Iomega ZIP/JAZ, SATA)

3.4.A. SCSI Drivers (RAID drives should not load any SCSI drivers.)

You will need to load DOS ASPI drivers if you are working with SCSI devices. DO NOT load
any memory managers, as they will cause RecoverSoft Media Tools Professional to freeze.

If you have SCSI devices, the DOS ASPI device drivers should be loaded from your config.sys
file. You need to modify the config.sys file to load the correct SCSI device driver. Example:
Device=A:\aspi8dos.sys /D

This command assumes you are loading the device driver for an Adaptec 2940UW. You can
download Adaptec SCSI Controller drivers from Adaptecs web site (http://www.adaptec.com). If
there are other SCSI driver websites that should be listed, please let us know.

3.4.B. Iomega ZIP/JAZ Drivers

If you have Zip or J az drivers, the Iomega DOS Guest program must be run prior to running
RecoverSoft Media Tools Professional. This is for the Parallel Port and SCSI Iomega drives.
The Guest program can be found on the original floppy diskette that came with the Iomega drive,
or you can download this DOS program from Iomegas web site (http://www.iomega.com).

3.4.C. SATA Converter

To recover data from a Serial ATA Drive, you will need to get the Serial ATA-IDE/ATAPI
Converter from http://www.cabledepot.com (1-800-343-4597 toll free or 1-770-564-2323) for
approximately $50.00 Part Number: SATA-ATAPI
9
Chapter 4 Running RecoverSoft Media Tools Professional

4.1 Launch the Program / p.11
4.2 Select Drive / p.12
4.3 Select Operation / p.13

Cycle-Clone / Cycle-Image (Chapter 5)
File Recovery Tree (Chapter 6)
Boot Partition Repair (Chapter 7)
Media Editor (Chapter 8)
Secure Wipe (Chapter 9)

10
4.1 Launch the Program

Work on your original problem media, or on a sector-by-sector clone/image
of the original problem media (see Chapter 5, Cycle-Clone /Cycle-Image).
Almost all software that clones/images does it file-by-file (not sector-by-sector),
which means it cannot clone/image deleted files, files which have been
overwritten, etc. In other words, you will not be able to recover your data from a
drive that has been cloned/imaged with a file-by-file clone/ image software. Use
our sector-by-sector clone (See Chapter 5, Cycle-Clone/Cycle-Image).

Unhook any peripherals not used during the recovery process (Other hard
drives attached to the system, CD-ROM drive, burner, etc., as these could
interfere with the program.

1. Insert the RecoverSoft Media Tools Professional CD into your CD drive, turn on your
computer, and let it self-boot (Make sure the computer is set to boot from the CD drive).

Having problems launching the program? See Ch 12.1, Problem Launching the
Program.

2. Press <Alt C>to continue into the program.

Shortcut: When a RED letter is highlighted within any screen, this indicates a
shortcut can be used. For example, if you look at the Media Tools Professional
screen above, notice that the letters A, R, S, and D are in red. Hold down your
<Alt>key and press the <red letter>.

Screen Notes
Continue - Transferred to Select Drive
About - Copyright Information
Registration - Registration Procedures
Software Support - Technical Support, 1-925-426-6306

11
4.2 Select Drive

3. Using your <arrow keys >, select the drive to be recovered, and then press
<Alt O>or <Enter>. Select IDE or SCSIfor hard disk drives over EBIOS, if it is recognized.

Write Protected Mode is indicated by a checkmark. To make changes or to write to
disk, uncheck the appropriate drive by using the <spacebar>.

Drive Access Methods (Advanced explanation): How RecoverSoft Media Tools
Professional addresses and communicates with any drive.

IDE DRIVE - communicates with any IDE drive on the system. RecoverSoft Media Tools
Professional has direct access and does not rely on the system BIOS to communicate with any
media. This means, you can see the entire capacity of any IDE drive, regardless of whether the
system BIOS has the ability to see the entire drive. The media is displayed as IDE HDD 000,
001, 002, etc.. IDE HDD 000 always indicates your primary master.

BIOS DRIVE - communicates through the system BIOS with any media on the computer and is
typically unreliable. Most new systems have the ability to handle extended int13 calls. If so, the
media will be displayed as EBIOS Drive 80h, 81h, 82h, etc. and you will see the entire
capacity of any drive above the 8.4GB barrier of DOS. Otherwise, it will be displayed as BIOS
Drive 80h, 81h, 82h, etc and a maximum of 8.4GB will be accessible. Do not use the EBIOS
Access Method when getting read errors with mechanically failing drives.

SCSI DRIVE - communicates with any SCSI devices on the system (SCSI hard drive, USB
storage devices, Iomega ZIP/J AZ removable media). If you have SCSI hard drives on the system,
they will appear as BIOS HDD, but will only give access to 8.4GB of the drive. In SCSI Access,
you will be able to see the entire capacity of any SCSI drive that is above the 8.4GB DOS
barrier. You must have the SCSI device driver loaded to be able to see any media in SCSI
Access Method. This includes running the Iomega Guest program for Zip and J az drives before
running RecoverSoft Media Tools Professional. The media is displayed as SCSI device 0/0,
0/1, 0/2, etc.

12
4.3 Select Operation

4. Select (the desired) Operation by using your <arrow key>. Then press <Enter>
(Shortcut: Hold down your <Alt>key and press the <red letter>).

Follow the Table of Contents at the beginning of the manual for details about each
operation within Media Tools Professional.

Cycle-Clone (including Reverse-Clone) /Cycle-Image (Chapter 5) - extracts raw data
from mechanically failing drives on any media or operating system, keeping drives out of the
clean room. It also creates an exact sector copy for back up protection.

File Recovery Tree (Chapter 6) - rebuilds any FAT or NTFS (DOS and Windows) file
system automatically from hard drives and removable media, including accidental format and
deletion, corrupt or missing file systems, viruses and worms, files located in slack space from
previous formats, and even digital pictures, allowing you to recover data to another destination,
including network drives.

Boot Partition Repair (Chapter 7) - rebuilds any FAT or NTFS (DOS and Windows) boot
sector and partition table automatically from IDE or SCSI hard drives and removable media,
giving you access to all files and directories.

Media Editor (Chapter 8) - mounts DOS and Windows file systems (easy step-by-step
screenshots and directions). Then, once the file system is mounted, the file system can be rebuilt
automatically, so that you can see which files and directories can be recovered, before
purchasing the program. (Note: Use this option if File Recovery Tree does not produce the
results you expect).

Media Editor also lets you View, Look for, Edit, and Report anything within the file system on
any media or operating system, without knowing Hex, through custom designed editing
templates.

Secure Wipe (Chapter 9) - permanently deletes data on any media or operating system to the
level the US Department of Defense requires.
13
Chapter 5 Cycle-Clone (including Reverse-Clone) / Cycle-Image

5.1 Cycle-CloneClone Drive to Drive / p.15
5.2 Reverse-Clone (mechanically failing drives) / p.17
A. User Set-up Window / p.18
5.3 Cycle-ImageCreate Image File / p.20
5.4 Span, Split or Compress the Image File / p.23
A. Split or Span the Image File / p.23
B. Compress the Image File / p.23
5.5 Restore Image File / p.24
5.6 Restore a Portion of the Image File / p.26

Cycle-Clone / Cycle-Image - surpasses standard sector cloning and imaging
software and devices by not only creating an exact sector back up copy of any media
type to a like media; but, they also automatically Cycle into Reverse-Mode when
confronted with mechanical issues to extract data from unreadable sectors keeping
drives out of the clean room.
Reverse-Clone - What is it?, is the never-ending question. Reverse-Clone is the
process of cloning from the end of your media to the beginning of it. When your media
is mechanically failing, Reverse-Clone is often your last chance to extract raw data
from it, without having to take your drive into a clean room. This unique technology,
coupled with Cycle-Clone / Cycle-Image, surpasses other standard sector cloning
software and devices.

If you know your drive is mechanically failing use Reverse-Clone, a
function within Cycle-Clone. It is also necessary to clone mechanically
failing drives in IDE or SCSI Access.

14
5.1 Cycle-CloneClone Drive to Drive

NOTE: The Destination Drive must be the same size or larger when using Cycle-
Clone (Reverse-Clone) / Cycle-Image. If not, only a partial clone will be made.

1. To prepare to Clone Drive to Drive, complete 4.1 4.3 in Chapter 4.

2. Press <Alt D>to select Clone Drive to Drive.

Clone Drive to Drive screen shot notes:

Start - <Alt S>, starts the Systems Components Search.

Modify - <Alt M>, allows you to modify the Cylinder, Head, and Sector of the
Starting Position and Finishing Position. <Tab>or use the <Arrow Keys>on the
keyboard to move between the Position fields. When you have finished making
modifications press <Enter>.

Stop - <Alt S>, stops the System Components Search. <Esc>- stops the process at
any time, too.

Exit - <Alt E>, exits the process and redirects you to the Selection Operation
Screen.

Compare - <Alt C>, compares the source drive to the cloned destination drive.

See next page
15

3. Press <Alt N>to select the Destination Drive, or <Alt U>to change the Source Drive.

CAUTION: The problem media must be the Source Drive, and the good media must
be the Destination Drive. By default, the Source Drive is the drive you have chosen
in the Select Drive Screen. If the Source Drive you have chosen in the Select Drive
Screen is the good media, you must change it to become the Destination Drive.

4. After selecting the Source and Destination Drive, press <Alt S>to Start.

Save the report: First, if you stop the cloning process while cloning, you can
continue the cloning process where you previously finished, without loosing what you
have already cloned. When continuing, <Modify>the Starting Position within the
Clone Drive to Drive Screen to match the Finishing Position (where you finished
beforehand) from the report to complete the cloning process; second, the report will
help in case there are any technical support issues.

5. Press <Esc>to return to the Select Operation window.

16
5.2 Reverse-Clone (mechanically failing drives)

Drives are designed with advanced technologies to read quicker in standard-forward-cloning
mode. When a drive starts to mechanically fail, these advanced technologies cause a drive to
have problems reading correctly. Because drives are not designed to utilize these advanced
technologies when reading backwards, you have better control in accessing damaged sectors to
extract raw data through Reverse-Clone.

NOTE: The Destination Drive must be the same size or larger when using Reverse-
Clone. If not, only a partial clone will be made.

(File) System Components Search: Reverse-Clone does not simultaneously do a
System Components Search during Reverse-Clone, like Cycle-Clone and Cycle-
Image do. This means you must do a separate System Components Search after
running Reverse-Clone.

1. To prepare Reverse-Clone, complete 4.1 4.3 in Chapter 4.

2. Press <Alt D>to select Clone Drive to Drive.

Clone Drive to Drive screen notes:


Starting Position and Finishing Position. <Tab>or use the <arrow keys >on the

any time, too.

Screen.

Compare - <Alt C>, compares the source drive to the cloned destination drive.

See next page
17

3. Press <Alt N>to select the Destination Drive, or <Alt U>to change the Source Drive.

be the Destination Drive. By default, the Source Drive is the drive you have chosen
in the Select Drive Screen. If the Source Drive you have chosen in the Select Drive

4. Press <Alt R>to check the checkbox Reverse at the bottom left corner of the Clone Drive
to Drive Screen to enable the Reverse-Clone function.

5. After selecting the Source and Destination Drive, press <Alt S>to Start.

5.2.A User Setup Window

When you encounter sector read errors while using Reverse-Clone, pause the program by
pressing <Ctrl S>to access the User Setup window, so that you can change the Timeouts and
Read Parameters. This helps you communicate with your media to extract data from unreadable
sectors, keeping drives out of the clean room (see notes below).

18
Tip: Press <Ctrl S>any time, from anywhere in the program, to access this window.
This is the Control Center for working with Mechanically Failing media, meaning
you will refer to it often to make changes, such as changing the Timeouts variables
or the Read Parameters.

Note: Press the <tab key>to maneuver throughout the User Setup screen. Press
the <space bar>to select or deselect a checkbox while maneuvering. Press <Alt O>
or <Enter>, when all changes have been completed.

6. Change the Timeouts and Read Parameters

Increasing the Timeouts variable is sometimes the only change needed to communicate
effectively with the drive. Increase the IDE Devices or SCSI Devices at 250,000ms. If this does
not work, the next step would be to change the Process Delay within Read Parameters.

Changing the Read Parameters is another method to effectively communicate with the drive.
Increase the Process Delay at 50ms. If this does not read the drive, increase the Process Delay
to 100ms. If you can read the drive, every few minutes accelerate the process by decreasing the
Process Delay in increments of 5ms. This gives you the greatest control combined with maximum
speed in cloning your data. If you cannot read the drive, the next step would be to change the
Read Retries within Read Parameters.

Changing the Read Retries within Read Parameters gives the program more chances to read
the damaged sector before moving on to the next sector. Increase the Read Retries to 50. If you
cannot read the drive, decrease the Read Retries to 0. This is called Skip Mode, meaning the
program will not attempt any Read Retries.

7. After the cloning report has been generated, press <Alt S>to save it.

Save the report: first, if you stop the cloning process, you can continue the cloning
process where you previously finished, without loosing what you have already cloned.
When completing the cloning process, <Modify>the Starting Position within the Clone
Drive to Drive Screen, so that it matches the Finishing Position (where you finished
beforehand) from the report; second, the report will help in case there are any
technical support issues.

19
5.3 Cycle-ImageCreate Image File

Note: To Cycle-Image the Destination Media must be the same size or larger. If not,
only a partial image will be made. It must also have a partition formatted FAT32, or be
mapped network drive (See Chapter 12 Problem Solving, Quick Start Directions to
create a DOS partition to format FAT32). If this sounds too difficult, Cycle-Clone
because it does not require a FAT32 partition, just a drive that is the same size or
larger.

Directions to format the Destination Drive FAT32:
Step 1 If running RecoverSoft Media Tools Professional, press ALT + X to exit.
Step 2 Press ALT + Y (Save Found Components Ch. 10, if you have not already).
Step 3 Power off the computer, detach all drives, and then attach only the
Destination Drive you want to format (unless you know exactly what you are doing).
Step 4 Turn on the computer again with the RecoverSoft Media Tools
Professional CD inserted into the CD drive.
Step 5 Continue, and choose the Source Drive (the problem drive).
Step 6 Select RecoverSoft Media Tools Professional. Within the System
Components Search screen, press the Config button, and the Format FAT32 choice
appears. Follow the directions. (The choice to Format FAT32 is also available within
the Select Action window, right after you select the Source Drive).
Step 7 After formatting the Destination Drive FAT 32, you are instructed to turn off
the computer system. Then, attach the Source Drive (the problem drive) and the
Destination Drive (the drive formatted FAT32).
Step 8 Reboot the computer with the RecoverSoft Media Tools Professional
CD inserted and choose to Load with or without USB Drivers (other drivers need to be
loaded before running RecoverSoft Media Tools Professional. See section 3.5).
Step 9 Select and run RecoverSoft Media Tools Professional to the file and
folder listing.
Step 10 Follow the directions below.

CAUTION: If the media worsens while using Cycle-Image, you want to stop and
Reverse-Clone the media (a function within Cycle-Clone) to another Destination
Media. We recommend first to Cycle-Clone the media to another like media; then to
Cycle-Image it to a compressed or uncompressed file.

1. To prepare to create an Image File, complete 4.1 4.3 in Chapter 4.

20
2. Press <Alt I>to select Create Image File.

Create Image File screen shot notes:


Starting Position and Finishing Position. <Tab>or use the <arrow keys >on the

any time, too.

Screen.

Compare - <Alt C>, compares the source drive to the imaged destination.

File - <Alt F>, selects the destination to write the file.

3. Press <Alt F>to select File.

be the Destination Drive. By default, the Source Drive is the drive you have chosen in
the Select Drive Screen. If the Source Drive you have chosen in the Select Drive

NOTE: You can create a single file volume or multiple file volumes. Multiple file
volumes are automatically created if there is not enough available space on
whatever Destination Drive.

When the Destination Drive becomes full, the program will ask you to locate
another Destination Drive or to insert new media, if you are writing to a removable
drive, such as an Iomega J az drive. The program could possibly choose to create
multiple file volumes on its own, even if there is plenty of space on the Destination
Drive.
21

4. Press <Alt B>to Browse to your Destination Drive or Folder.

Note: Press <Alt V>to change the volume spanning sizes. For detailed
information, see Chapter 5.4 Span , Split or Compress the Image File.

5. Press <Alt D>to select drives. Then, using the <arrow key >choose a Destination Drive
letter.

6. Press <Alt F>to select File Name. Then, type a file name, no more than eight characters.

7. Press <Alt O>to select OK. Press <Alt O>to select OK on the next screen again.

8. After selecting your Destination Drive or Folder, press <Alt S>to Start.

NOTE: A report will be generated after Image File has been created. We suggest you
save this report in case there are any technical support issues.

22
5.4 Span , Split or Compress the Image File

5.4.A. Span or Split the Image File

Imaged files are either archived into Split files on another local or network media, or Spanned
onto removable, such as a Zip, for later restoration.

For example, when writing to a media that is smaller than the Image file, the Image function
automatically prompts you for additional media, breaking down the Image file into individual
"Spanned" volumes. If you want to write to a Zip disk, simply change the default volume size
(2GB or 2097MB) of the Image file to 100MB. At each 100MB interval, you are automatically
prompted for additional media to store the Image files. In this case, you would continually swap
Zip disks until the process is finished.

The main advantage of Imaging is to archive and restore media, just in case the original or cloned
media fails. Another advantage is that a portion of an Image file can be easily restored, without
having to wait for the entire Image to be restored. For example, if your attempt to edit the Boot
Sector has dismal results, simply restore just the Boot Record to edit again.

CAUTION: To Span or Split the File Volumes size, you must change the MB size
NO LARGER than the maximum media size. If the spanning size is larger than the
media, the Image file will FAIL.

Spanning/Splitting the file extension begins with *.v00 and then the next file volume will be *.v01,
*.v02, etc. It is important that you predetermine the size of the file volume you want to create. By
default, File Volumes are a maximum of 2GB (2097MB). Change the size of the file volume in the
Volume File Size field.

5.4.B. Compress the Image File

Creating Compressed file volumes will save you space on your destination media. When
Compression is used on the media, the more time the process will take.

In the top field, type the path and file name that is to be written. You can record information about
this Image file by pressing the Input Image File Description button. Writing a paragraph about
the Image file can be very useful when restoring the Image file, because you can view it making
sure it is the correct Image file. This information is imbedded into a special Header file, which
records other basic information about the Image file and media.

If you are not sure of the path, press the browse button to pull up the Select File window. Use the
<tab key>to jump between the fields and buttons. Press the Drive button <ALT D>to select a
different logical drive letter. Press <Enter>on a directory name to enter that directory. If the
directory does not exist, press<Alt M>or the <MkDir>button to enter the name of the directory
you want to create. Now enter the name of the file you want to create in the File Name field and
press <Alt O>or <Enter>.
23
5.5 Restore Image File

1. To prepare for creating an Image file, complete 4.1 4.3 in Chapter 4.

2. Press <Alt F>to select Restore Image File.

3. Press <Alt F>to select File.

4. Press <Alt B>to Browse to your Destination Drive or folder.
24

5. Press <Alt D>to select Drives. Then, using the <arrow key >choose a Destination Drive
letter.

6. Press the <Tab>key. Then, select the file you want to restore (*.VOO) using the
<arrow key >, and press <Enter>

7. Press <Alt O>to select OK, and then press <Alt O>to select OK again.

8. Press <Alt S>to select Start.

9. Press <Alt Y>to select Yes.

25
5.6 Restore a Portion of the Image File

By default, the entire Image will be restored to the original LBA that it came from. However, a
portion of an Image file can be easily restored, without having to wait for the entire Image to be
restored. For example, if your attempt to edit the Boot Sector has dismal results, simply restore
just the Boot Record to edit again.

Example:

To restore only part of the Image file, select the Starting or Finishing CHS within the Image to
restore. Then, select the Destination - where to restore the Image to the media. For example,
Lets restore only the Boot Sector for the FAT file system at LBA sector 63 (CHS =0,1,1). Being
unsatisfied with the results, I want to restore the original Boot Sector to the media. Press
<Modify>, make the Starting and Finishing CHS 0,1,1, and the original Boot Sector will be
restored.

Example:

Another example would be, restoring LBA sectors 315-566 from Image file volume, but restoring
them to the media starting at LBA 64. Press <Modify>and make the Starting LBA 64 and the
Finishing LBA 314. Then, press the <Starting Position in Volume>button. Notice, that it defaults
to the same starting LBA 64 as on the media. Now, change the starting LBA to 315. This type of
procedure is useful for working in the Media Editor and different parts of the file system.

26
Chapter 6 File Recovery Tree

6.1 (File) System Components Search / p.28
6.2 Select File System to Rebuild / p.28
6.3 Recover Files and Directories to a FAT32 destination drive / p.31
6.4 Restore Files and Directories using WinZip or PKZIP / p.32
6.5 Use the Menus to look for and filter specific files / p.33
A. <Utils>Menu / p.33
B. <Look for>Menu / p.35
C. <File>Menu / p.36
6.7 Mount the file system into Media Editor to <View>, <Look For>, <Report>and <Edit>
raw data at the sector level / p.37

File Recovery Tree rebuilds any FAT or NTFS (DOS and Windows) file system
automatically from hard drives (IDE, SCSI, and SATA) and removable media (USB
Devices), including accidental format and deletion, corrupt or missing file systems,
viruses and worms, files located in slack space from previous formats, and even digital
pictures, allowing you to recover files and folders to another destination to a local
network, hard drives, and USB Devices.

You have the ability to Look For and Filter specific files once the file system has been
rebuilt (For more details, see 6.6, Use the Menus to look for and filter specific files).

You can also Mount the file system into Media Editor to help you View, Look For,
Report and Edit raw data within the file system at the sector level.
27

1. To prepare the System Components Search, complete 4.1 4.3 in Chapter 4.


Starting Position and Finishing Position. <Tab>or use the <Arrow Keys>on the

any time, too.

Screen.

Config - <Alt C>, directs you to <Analyze>, <Save>, <Load>, <Show>, or
<Restore>all found components during the Systems Components Search.

2. Press <Alt S>to <Start>the System Component Search.

After the System Component Search is complete, the Select File System Screen
automatically appears, showing you the file systems that can be rebuilt on this drive.
If not, which one of these messages appears?

Error: No Valid File System Found? See Chapter 12.3.
Warning: Cannot Locate the Root Directory? See Chapter 12.6.

File System not Displayed? See Chapter 12.3

6.2 Select File System to Rebuild
28

3. Press <Alt L>to select the file system in question. Then, press <Alt O>.

Scanning Found Components to create a file and folder listing

see next page
29

Use <Page Down>from any root directory to go to the next set of root directories.
Use <Page Down>from any file to go to the next set of files. Use <Tab>and the
<arrow keys >to move between the directories and files.

Use the Menus to look for and filter specific files: <File>, <Look for>, <Utils>
allow you to do specific searches, filter files, recover selected files, etc. from the
Directory and File Structure Tree (See Ch. 6.5, Use the Menus to look for and filter
specific files).
File Status Explanation (color-coding explanation):
Excellent - indicates a file that should have a successful recovery. Technically, the file has valid
file chains, and is part of the existing file system.
Good - indicates a file that should have a successful recovery a majority of the time. Technically,
the file may have valid file chains, but is either not part of the existing file system, or has
corruption within the file system.

Possible - indicates a file that could have a successful recovery. Technically, "Possible" and
"Good" are equal. However, a Possible file is less likely to be a valid file compared to a "Good"
file, because of possible corruption to the file.

Poor - indicates a file that has a poor chance of recovery. Technically, the file has invalid file
chains.
WHITE - indicates a sub-directory. This does not mean the files in that directory are valid, only
that it is a sub-directory.

YELLOW - indicates a file or directory that has been tagged for recovery.

Important Note: If a folder also has been renamed "Found", the original name no longer exists.
To determine if a file within a folder can be recovered, refer to the color-coding of the file.
Technically, if a folder has been renamed "Found", it has been found during the scan, but is not
part of the existing file system. You may want to rename the folders to their original state after
you have recovered them.

30
6.3 Recover Files and Directories to a FAT32 Destination Drive

Why FAT32 ? You must recover data to a destination drive with a partition formatted
FAT32 (or to a mapped network drive). The reason you must recover your files to a
drive formatted FAT32 is, RecoverSoft Media Tools Professional is a DOS
program (that can work with multiple file systems). However, DOS can only write
(recover data) to a FAT Destination. Once you recover data to a FAT32 Destination
Drive, you can easily transfer it to another file system.

Directions to format the Destination Drive FAT32:
Step 1 If the Destination Drive is not already attached, press ALT +X to exit and
follow Steps 1-3. If it is attached, go directly to Step 6.
Step 2 Press ALT +Y (Save Found Components Ch. 10, if necessary).
Step 3 Power off the computer, and then attach the Destination Drive you want to
format (unless it is already attached).
Step 4 Turn on the computer again with the RecoverSoft Media Tools
Professional CD inserted into the CD
Step 5 Select Continue, and choose the Source Drive (the problem drive).
Step 6 Select File Recovery Tree. Within the System Components Search
screen, press the Config button. Choose Format Drive and follow the directions
(The choice to Format Drive is also available within the Select Action window, right
after you select the Source Drive).
Step 7 After formatting the Destination Drive, you are instructed to turn off the
computer system. Attach the Source Drive (the problem drive) if necessary.
Step 8 Repeat Step 4, and then continue to Step 9.
Step 9 Select Continue, File Recovery Tree, Config button to Load Saved
Components, Analyze Found Components, and choose the appropriate File
System to build a listing of your files and folders.
Step 10 Follow the directions below.

4. After the Directory and File Structure Tree is generated, use <Tab>and the <arrow keys
>to select the directories and files that you want to recover. Highlight <ROOT>if you want
to recover all directories and the files within them. Selected files will turn Yellow. Press the
<spacebar>to activate the desired files.

5. Press <Alt R>to recover selected files and directories.

6. Press <Alt B>to <Browse> to choose the Destination Drive.

31
NOTE: Press <Alt U>to activate the compression on the fly. Press <Alt L>
to change the compression level and <Alt M>to activate MD5. These
functions are mainly used for Computer Forensics (For details, see Chapter
13.4, MD5 Hash Mark).

7. Press <Alt D>to select <Drives>. Then, using the <arrow key >choose a Destination
Drive letter (i.e. A:\ , B:\ , etc).

TIP: Use <arrow keys>to locate your Destination Drive. Use <Tab>to select a
Destination folder. Press<Enter>on the folder of choice. After the Destination
point has been determined, press <Alt D>again to highlight the drive location.
Then, press <Enter>.

8. Press <Alt O>to transfer files from one media to another.

NOTE: A report will be generated after the files have been transferred. We suggest
you save this report in case there are any technical support issues.

9. Press <Esc>to return to the Select Operation Screen.

6.4 Restore Files and Directories using WinZip 9.0 or PKZIP 4.0

To RESTORE or EXTRACT your recovered data to another destination drive (formatted FAT32),
use PKZIP 4.0 or greater or WinZip 9.0 or greater. Previous versions will create errors:

WinZip - (http://www.winzip.com)
PKZIP - (http://www.pkware.com/products/free_eval.html)

Once PKZIP or WinZip has been installed, copy every file into a single directory on your hard
drive. Then, unzip these files from this directory (By default, the entire contents of the zip files are
extracted to your hard drive. However, you can choose to extract individual files from the list).

CAUTION: DO NOT restore your recovered data to the root directory, because you
run a high probability of corrupting your hard drive. Extract the data to into the single
directory on your hard drive. This will keep the original directory structure.

CAUTION: Make sure to test the validity of the Zip files from which you are
recovering data, before discarding the Source Drive.
32
6.5 Use the Menus to look for and filter specific files:

6.5.A. <Utils>Menu

The <Utils>, or Utilities window provides extra searching power. The most popular functions are
the <Files/Directories Display Filter>and <Recover Selected Files>.

Files / Directories Information <Alt I>- Launches a report screen detailing total files
and folders.
Files / Directories Display Filter <Alt D>- Allows the customer to locate specific types
of files.
Recover Selected Files <Alt R>- Prompts customer to locate a destination drive to
save information.
Expand / Contract Directories <Alt E>- Expands all directories.
Create Structure Report <Alt C>- Creates a structured report of drive information.
Show Directory Map <Alt M>- Creates a mapping of all files and folders including
condition status.
Visit Media Editor - <F10>- Opens Media Editor.

Example: <Alt D>: The File/Directories Display filter finds specific files: Good files, Found
Files, Deleted Files, System Files, Invalid Files, etc.

If a file cannot be located, use the filter to show everything [---]. Once you have applied the filters,
press <Alt C>to create a structure report.

Hold down your <Alt>key and press the <red letter>. Then, use the
<arrow key >to open the drop. Then, use the <arrow keys >to choose
Hide, Only, or [---] which shows everything.

See next page
33

Once you have applied the filters, press <Alt C>to create a structure report.

File Status Explanation (Technical explanations are given in section 6.3):
Excellent - indicates a file that should have a successful recovery.
Good - indicates a file that should have a successful recovery a majority of the time.
Possible - indicates a file that could have a successful recovery.

Poor - indicates a file that has a poor chance of recovery.
White - indicates a sub-directory. This does not mean the files in that directory are valid, only that
it is a sub-directory.
Yellow - indicates a file or directory that has been tagged for recovery.
Important Note: If a folder also has been renamed "Found", the original name no longer exists.
To determine if a file within a folder can be recovered, refer to the color-coding of the file.
Technically, if a folder has been renamed "Found", it has been found during the scan, but is not
part of the existing file system. You may want to rename the folders to their original state after
you have recovered them.

34
6.5.B. <Look for>Menu:

The <Look For>window provides the capability to search for specific files such as Microsoft
Word, Excel, Photoshop, or any other type of document.

Look For File <F7>- Searches for a file by exact name.
Select By Mask <Alt S>- Searches for files by using wildcards (read below).
Look For Next <Alt N>- Continues searching the previous wildcard with a similar name
or extension.

Example: <F7>and <Alt N>: Look For File searches for specific files.

If you cannot find a file, search using a wildcard*. Type the name of the file, followed by an
asterisk, a period and then the file extension with no spaces. For example, if I want to look for a
file called health., but I cannot remember the exact name, I would type *health*.* (Another
method to look for a specific file would be to include the extension as in health*.doc ) Assuming
there is another related file with the title health, I would simply press <Alt N>to search for the
next document that contains the above context.

Press <Alt O>or <Enter>to select OK.
35
6.5.C. <File> Menu:

The <File>menu allows you to change Timeout Settings, Read Parameters, and Additional
Parameters within the <User Setup>Screen; or to open a <Report File>.

For User Setup instruction see Chapter 13.1, Advanced User Setup Window.

<File>- Accesses 3 screens:

User Setup <Ctrl S>- Launches the User Setup window
Report Files <Ctrl R>- Opens reports and .txt file
Close Window - Redirects to Select File System Screen

36
6.7 Mount the File System into Media Editor to <View>, <Look for>,
<Report> and <Edit> raw data at the sector level

Once the Directory and File Structure Tree is generated (the screen that shows all the files and
directories), press <F10>to Mount the file system into Media Editor to <View>, <Look For>,
<Report>, and <Edit>raw data within the file system at the sector level (For more details, see
Ch.8, Media Editor).

Select Working Area (Mounted File System)

37
Chapter 7 Boot Partition Repair

7.1 (File) System Components Search / p.39
7.2 Create a Backup Fle / p.40
7.3 Access Repaired File Systems / p.42
7.4 How to Make the Drive Bootable / p.42

Misconception

The common misconception most people have about using a boot sector and partition repair
software program is, they think the purpose of the program is to make their computer bootable
again. In reality, the function of Boot Partition Repair (and any other boot sector and partition
table repair program) should be to give you access to your data, so that you can copy it off to
another destination (See section 7.6, How to Make the Drive Bootable, for a detailed explanation
as to why you should not make your drive bootable).

Boot Partition Repair rebuilds any FAT or NTFS (DOS and Windows) boot sector and
partition table automatically from hard drives (IDE, SCSI, and SATA) and removable media
(USB Devices), giving you access to all files and directories.

You have the ability to Create a Backup File to restore your original data in case you would like
to reverse the repair process.

You can also View Components of any Partition / File System to understand more detailed
information.

38

1. To prepare for running Boot Partition Repair, complete 4.1 4.3 in Chapter 4.


Modify - <Alt M>, allows you to modify the Cylinder, Head, and Sector of the Starting
Position and Finishing Position. <Tab>or use the <Arrow Keys>on the keyboard to
move between the Position fields. When you have finished making modifications
press <Enter>.

any time, too.

Exit - <Alt E>, exits the process and redirects you to the Selection Operation Screen.

Config - <Alt C>, directs you to <Analyze>, <Save>, <Load>, <Show>, or <Restore>
all found components during the Systems Components Search

2. Press <Alt S>to Start the System Component Search.

After the System Component Search is complete, the Select File System Screen
automatically appears, showing you the file systems that can be rebuilt on this drive.
If not, which one of these messages appears?

Error: No Valid File System Found? See Chapter 12.4.
Warning: Cannot Locate the Root Directory? See Chapter 12.6.

File System not Displayed? See Chapter 12.3.

39

3. Use the <spacebar>to select ALL file systems that you want to access. A checkmark will
signify that the file system has been selected.

CAUTION: A common mistake is to select only the file system(s) that have not been
accessible. You MUST select ALL file systems that you want to access. A
<checkmark>will appear next to each file system that has been selected.

4. Press <ALT N>, for Next.

File System Components Information: At this point, the program is not actually
changing or creating the Partition Table. It is showing what the Partition Table will be
changed to, when you continue the repair process.

Want to review your files and directories? You can also review files and
directories within all File System(s) through the RecoverSoft Media Tools
Professional operation. Press <Esc>to return to the Select Operation screen.
Choose File Recovery Tree. Select the File System you want to see. Press
<Enter>(see Chapter 6, File Recovery Tree).
7.2 Create a Backup File

40
Creating a Backup File will allow you to have a back up copy in case you would like to reverse the
repair process. The program will not continue until a backup has been completed.

5. Press <ALT N>for Next to Create a Backup File.

6. Press <Alt D>to select drives. Then, using the <arrow key >choose a Destination Drive
letter.

7. Name the Backup File by pressing <Alt F>. Then, press <ALT O>, or <Tab>to OK and
press <Enter>.

8. Press <Alt Y>for Yes, or <Enter>, when presented with the option to write the changes to
the drive.

NOTE: A report will be generated after the repairs have been made. We suggest you
save this report in case there are any technical support issues.

9. Press <Esc>to return to the Select Operation Screen.

41
7.5 Access Repaired File Systems

CAUTION: If you automatically reboot back into Windows once a program has made
the necessary repairs, you risk permanently damaging your data to the point of being
unrecoverable.

You should:

1. Exit and turn off the computer once the necessary repairs are accomplished.

2. Next slave the repaired drive, as a secondary drive, behind a working bootable Windows
drive.

3. Reboot the working drive into Windows (not the secondary or repaired drive).

4. Finally, go into Windows Explorer and copy your data from the repaired drive to the
working drive.

7.6 How to Make the Drive Bootable

CAUTION: When you do not have another drive to Slave the repaired drive to (after
Boot Partition Repair makes necessary repairs have been made), then you will
have to use FDISK and SYS to be able to boot back into Windows.

Proceed at your own risk!

Follow these steps exactly to make the drive bootable:

1. Use RecoverSoft Media Tools Professional to repair the boot sector and partition table.

2. After your system boot record has been repaired, locate a boot disk for the same version of
your OS that is being repaired. For example, if you are using Windows 98/SE, you must
find a boot disk for Windows 98/SE. If you have Windows 2000 or Windows XP, boot
with the CD and use the repair console instead of following the rest of these instructions.

3. Make sure FDISK.EXE and SYS.COM are located on the boot floppy. Again, as noted, make
sure you are using the exact same version as the OS being recovered.

4. Once the system has been rebooted, type <FDISK >at the DOS prompt (A:\). Then you
will be presented with 4-5 options within Fdisk. Choose the option that makes a Partition
Tables Active. It will usually be the first Partition Table that is set as active. Once this is done
press <ESC>to exit Fdisk.

5. We will use Fdisk again, but will use a command line option this time. At the DOS prompt
(A:\) type: <FDISK /MBR >. It will write information to the drive and then go back to the
DOS prompt (A:\).

CAUTION: If running Windows NT/Windows 2000/Windows XP on NTFS
partition DO NOT perform Step 5. This could severely damage to the OS, resulting in
lost data.

6. Type <SYS C: >. It should tell you that the system was successfully transferred.

7. Remove the boot floppy and reboot the system. Pray that there is not any corruption to the
FATs, MFT or Directory Structure.
42
Chapter 8 Media Editor

8.1 Select Working Area (Mounted or Unmounted File System) / p.46
A. Unmounted File System / p.46
B. Mounted File System / p.46
a. (How to) Mount the File System / p.47
b. Rebuild Files and Directories Automatically / p.50
8.2 View (the Sector) As / p.51
A. Hex / ASCII View / p.51
B. Text View / p.51
C. Partition View / p.52
D. Boot Sector View / p.53
E. File Allocation Table (FAT) View / p.54
F. Directory View / p.55
8.3 Look For (within a Sector) / p.56
A. Look for Hex / ASCII / p.56
B. Look for Boot Sectors / p.56
C. Look for Partition / p.57
D. Look for File Allocation Table (FAT) / p.57
E. Look for Directory Entries / p.58
F. Look for Files / p.58
8.4 Save Sectors / Restore Sectors of data to/from a file (i.e. instead of having to use
Cycle-Clone/Cycle-Image to create an entire file volume of the media) / p.59
8.5 Fill Current Sector (i.e. when you have a virus that will not go away) / p.59

Media Editor is not like any other Hex Editor. Without knowing Hex, Media Editor can
mount and rebuild any FAT and NTFS (DOS and Windows) file system automatically, and
when necessary, it can help you Look For, View, Report and Edit sectors of raw data through
custom-made editing templates on any operating system.

Mount the File System

First, the Media Editor can mount any FAT or NTFS (DOS and Windows) file system at
the sector level. This means, without knowing Hex, the Media Editor can calculate the
geometric location of each component of the file system (Partition Table, Boot Sector, File
Allocation Table, Root Directory, etc.) and automatically link them together. This lets you easily
navigate from sector to sector throughout the file system to edit and recover data - simply follow
the links within the Mounted File System.

Select Working Area (Mounted File System)

43

Rebuild files and directories automatically

Second, if the file system is mounted, press <F10>and the Media Editor will automatically
rebuild any FAT or NTFS (DOS and Windows) file system. Once rebuilt, you can Look For
and Filter specific files using the menus <File>, <Look For>, and <Utils>. This option is used if
the File Recovery Tree operation does not produce the results you expect.

File and Directory Tree Structure

Look For / View / Report / Edit / sectors of raw data on any media or operating system,
through custom made editing templates.

Next, through custom-designed editing templates, Media Editor lets you to <Look For>,
<View>, <Report>, and <Edit>anything within the file system on any media or operating system,
without knowing Hex. This lets anyone, who is familiar with the file system, edit raw data much
easier than ever possible.

Look For (i.e. Partition Table Search Attributes)

continued

44

View As (i.e. Partition Table View in ASCII format)

Edit any media on any operating system

Finally, Media Editor can be used independently as a Hex Editor on any media or operating
system. This function allows you to bypass the mounting process to edit raw data through
custom designed editing templates, or directly with the raw sectors of data.

Save Sectors / Restore Sectors

You can save a range of sectors to a file within Media Editor, instead of having to use Cycle-
Clone/Cycle-Image. When making changes to any sector, you can make a quick backup of
the sector to a file.

Fill Current Sector

You can fill any sector to clear out viruses and corrupted data before reconstructing any data. It
defaults to writing zeros to the sector, but you have over a 100 different choices.

45
8.1 Select Working Area (Mounted or Unmounted File System)

Select Working Area Screen (Mounted or Unmounted File System) is considered
the Control Center within Media Editor, meaning you will refer to it often to make
changes to the Starting Position and Finishing Position (and to Jump To different
components of the file system, once the file system has been mounted). Press
<Alt C>anytime from a mounted or unmounted file system while in Media Editor
to access the Select Working Area window.

Read-Only Mode: As you enter Media Editor, you will be in Read-Only Mode and
will be asked to define the working area Starting Position (it defaults to the entire
capacity of the drive until you change the values). If you know where the Boot Sector
is, you can set the Starting Position to that location, and press <Enter>. Then, (go
to step 5) and Mount the drive under the <Mount>menu.

8.1.A. Select Working Area (Unmounted File System)

8.1.B. Select Working Area (Mounted File System)

46
8.1.B.1. (How to) Mount the File System

1. To prepare for entering the Media Editor, complete 4.1 4.3 in Chapter 4.

2. If you do not know the Starting Position of the file system, press <Alt O>or <Enter>.

NOTE: As you enter Media Editor, you will be in Read-Only Mode and will be
asked to define the Working Area Starting Position (it will be defaulted to the
entire capacity of the media until you change the Working Parameters). If you know
where the Boot Sector is, you can set the Starting Position to that location, and
press <Enter>. Then, (go to step 5) and Mount the drive under the <Mount>menu.

3. Under the <Look For>menu at the top of the page, chose <Boot Sector>.

47

4. Press <Alt O>or <Enter>(do not change any Attributes or Values).

5. Under the <Alt M>for Mount menu at the top of the page, choose your file system.

Note: Chose from the following File Systems:
FAT =Windows 95, 98, ME
NTFS =Windows NT4.0, 2000, XP (2000 and XP could be FAT or NTFS, but the
default is NTFS).

6. Press <Alt Y>, or <Enter>.

7. Press <Alt O>, or <Enter>(do not change any Parameters).

NOTE: What if there is not a valid Boot Sector to give these values? Press <ATL O>
or <Enter>to accept these values and to return to the Select Working Area window
(Unmounted File System). You will have to calculate these values manually and
input them into the appropriate fields.

48

8. Press <Alt O>, or <Enter>(takes you to the Boot Sector)

(You have mounted the file system successfully. To recover files and directories automatically,
see section 8.3, Recover Files and Directories Automatically.)

49
8.1.B.2. Rebuild Files and Directories Automatically

4. Once the drive has been mounted, press <F10>to rebuild the file system through File
Recovery Tree.

NOTE: The Directory and File Structure Tree window appears for file systems that
have been successfully mounted. Unmounted File Systems will default to the
Select Working Area (Unmounted File System) window when using <Alt C>. You
have to calculate these values manually and input them into the appropriate fields.

(See Chapter 6.4, Recover Files and Directories to a FAT32 destination drive)

50
8.2 View (the Sector) As

8.2.A. Hex / ASCII View

The Hex screen is laid out in three columns. The left most column is the Line Address, or offset,
within the sector. The middle column is the Hex Values of the sector; the right column is the
corresponding ASCII Values of the sector. Each two characters in the Hex (middle) column make
one byte. In the above example (ii) the first byte is 33h. Whenever you are referring to Hex you
put a lowercase h at the end of the Hex value.

Notice at the bottom left corner in the above image (ii) you see (0;0;1;LBA=0). This will always tell
the exact CHS/LBA location you currently are on. As you search for file system components,
often refer to the LBA. Use the <Page Up/Down keys>on the keyboard to move up or down the
sector to move to the next sector or previous sector. Use the combination <CTRL-Page Up>or
<CTRL-Page Down>to move to the Starting or Finishing sector of the Working Area.

Press the <ESC>key to leave Media Editor and to return to the Select Operation window at
anytime.

8.2.B. Text View

Using Text View is good for reading text within a sector. After searching for a keyword, phrase or
a string of text, put the sector into text view to be able to read it easier. When viewing a sector
that has no visible text, it will look like nothing more than a screen full of garbage.
51
8.2.C. Partition View

You will typically find a Partition Table at 0;0;1;LBA=0. The Partition Table defines the area on the
drive that will make up the File System. View this sector as a Partition Table with the menu item
or <Alt P>. You can repair the Partition Values, without having to translate Hex. You will need to
change from <Read Only Mode>to <Edit Mode>. Use the shortcut CTRL-S to get to the User
Setup window and to check Edit Mode at the bottom of the window <Ctrl F1>. The top right
corner will change from <Read Mode>to <Edit Mode>. Then you can press the <numbers 1-4>
to modify each Partition line. The Partition Table has a distinct signature aa55h. This value must
be here or your system will not recognize the Partition Table.

Partition View continued

When you have chosen 1-4 as in the previous screen, the Edit Partition Table Entry window will
appear. This is where you will actually enter the values for each line of the Partition Table. Check
the Sync CHS and LBA field before entering any values. The program will then do calculations
for you. You are able to enter certain values without knowing other values. Lets say in the above
entry that we know the Starting Position of the Partition Table is at CHS (0;1;1;LBA=63). We also
know the total sectors for the Partition Table, but we do not know the Finishing Position. You can
enter LBA63 into the Starting Position and the total sectors into the Sectors field. The program
will calculate the Finishing Position for you. You will also need to choose the File System Code
and whether the Partition Table is a Boot Partition Table. There can only be one Boot Partition in
a Partition Table.
52
8.2.B. Boot Sector View

View a sector as a Boot Sector with the View As menu item or the shortcut keys <Alt 1><Alt 3>,
or <Alt-B>, depending if you will be looking at a FAT16, FAT32 or NTFS Boot Sector. You will be
able to enter the appropriate values without having to translate Hex. The Boot Sector is the next
critical component, following the Partition Table.

1. J ump Code You will be safe if entering ebh 3eh 90h as the default value. These
values are the first three bytes of the boot sector.
2. OEM Name the name of the file system.
3. Bytes per Sector this will usually be 512 for the FAT file system. It can be different for
other file systems.
4. Sectors per Cluster How many sectors make up a cluster?
5. Reserved Sectors FAT16=1, FAT32=32. There are some Partition resizing utilities that
can alter this standard.
6. Number of FATs always 2 for FAT File System.
7. Root Entries Using the Microsoft standard, the value is 512 for Fat16. The value is 0 for
Fat32. There are some Partition resizing utilities that can alter this standard.
8. Total Sectors (16) 16 bit. For DOS6.X/Win9.X this will be 0.
9. Media Descriptor default f8h
10. Sectors per FAT (16) How many sectors are in the FAT table? Count the number of
sectors between the first FAT and the second FAT to determine this number.
11. Sector per Track the number of sectors. Look at the drives CHS
12. Number of Heads - the number of heads. Look at the drives CHS in BIOS Access.
13. Hidden Sectors This is typically the same as the sectors per track.
14. Total Sectors (32) 32 bit. This value will be the same as in the partition table.
15. Drive Number Default 80h
16. Extended Signature Default 29h
17. Volume Serial Number It is not necessary to have anymore than 0 in this field. This is
not critical to gain access.
18. Volume Label Give it any name you want. The volume label is created when you format
the drive.
19. File System ID What type of file system? FAT16, FAT32
20. Sector Signature as the partition table, the boot sector also requires the signature
aa55h as the ending value to the sector.

There are other variables in the FAT32 and NTFS Boot Sectors. Also there is another part to the
FAT32 Boot Sector called the Info Sector. The Info Sector is the next sector following the FAT32
53
Boot Sector. So if the FAT32 Boot Sector is located at CHS 0,1,1;LBA=63, then the FAT32 Info
Sector would be located at CHS 0,1,2;LBA=64. You can view this sector as an Info Sector with
the menu item under the View As Boot Sector FAT32 FS Info Sector.

8.2.E. File Allocation Table (FAT) View

The File Allocation Tables give the address to all Directories and Files within a particular Partition
Table. When you find a FAT table, use ALT-C to make the Starting Position of the working area at
the beginning of the FAT table. In the above example the Starting Position would be set to
(0;1;33;LBA=95). A FAT16 Fat Table is usually the first sector following the Boot Sector. Locating
file system components will allow you to find where other File System Components should be. If
the FAT16 Fat Table starts at (0,1,2;LBA=64) then the Boot Sector would be located at
(0,1,1;LBA=63). A FAT32 fat table will start 32 sectors after the FAT32 Boot Sector, as in the
above screen. This is where the Reserved Sector in the Boot Sector comes from. In FAT16 the
reserved sectors will be 1 and for FAT32 it will usually be 32.

In <Edit mode>you are able to change these values.

Follow the FAT chain by placing the cursor on one of the entries. The bottom left corner of the
screen will tell you what cluster you are on in the FAT table. The entry on the screen will tell you
where the next chain points. If you are on cluster 48, the value says that the next entry is 49.
Keep following this chain until you hit an EOF (End of File) entry.

54
8.2.F. Directory View

When you locate a Directory, change the view with the shortcut <Alt D>. You will see individual
File entries, one per line. Place the cursor on one of the entries and press enter. This will bring up
the above window with more detailed information on the File or Directory entry. In <Edit Mode>,
you can make changes directly to the Directory View screen or press <Enter>on a File/Directory
to edit in the more detailed window.

55
8.3. Look For (within a Sector)

8.3.A. Look For Hex / ASCII

Use the HEX/ASCII <Look for>option to search the entire media for any Hex or ASCII pattern.
You will be able to investigate the media looking for a phrase or text string as an example. For
example, <Look For>any patterns that have the words bank account. This will find any entries
from any sector with this phrase. The search will stop every time a match is found unless you run
the search in <Report Mode>. This will find all matches and write it to a report. When searching
in <non-report mode>, use the Find Next shortcut <Alt N>to continue searching the media for
other matches.

8.3.B. Look For Boot Sector

There is some flexibility when searching for Boot Sectors. All Boot Sectors have the signature
aa55h. As you search and are not finding what you are looking for, start by eliminating the
attributes from the bottom up. Take off the media descriptor first etc. Try different variations. You
can even change the values.

56
8.3.C. Look For Partitions

Search for many different Partition Table types at the same time or narrow down to just one type.
Use the <check boxes>on the left to eliminate search choices. Press the <numbers 1-6>to
bring up the file system type window and choose a different file system that is not on the default
list. Search for a Linux or Netware partition. Refer to Advanced Data Recovery and
Computer Forensic Procedures for a list of different File System types.

8.3.D. Look For File Allocation Table (FAT)

Depending on the type of FAT you are searching for will depend on what variants will be used in
the search. It is usually the first 4 bytes of the sector that make the distinction that it is a FAT
table. By default, the FAT search attributes are only for the first 2 bytes. There are different
variations to the first 4 bytes, depending on what specific flavor of the operating system it is. A
few variations are: (f8h ffh ffh ffh), (f8h ffh ffh 0h), (F8h ffh ffh 7h). We give 6 bytes to search for
even though all of them will usually never be used. To search for more than the default values,
change the Number of bytes. to 3, 4, etc. Then change the byte values. If you only change the
0h byte values without changing the number of bytes to search for, it will still only search for the
default values. You will notice that the fewer bytes used in the search will also cause more false
matches to be found.

57
8.3.E. Look For Directory Entries

Looking for Directories is very simple with no variations. When the search finds a Directory, make
sure you are in Directory View <ALT D>.

8.3.F. Look For Files

RecoverSoft Media Tools Professional will search for File names. When it finds a file match,
make sure you are in Directory View <ALT-D>to be able to view the File Entry. You can search
for exact names or use the asterisk (*) to add a wildcard in the search. The more wildcard
asterisks that are used in the search will cause more garbage to show up in the search results.
An extreme example would to use (* . *) in the search. This would cause every single line item to
show up in the results. Lets say you want to locate all MS-Word documents. Enter the wildcard
asterisk (*) into the first field and doc into the extension field, (*. doc). Another example would
be where you are not sure of the exact file name but know part of it. Lets say the part you know
is bank. So put (*bank*) in the first field and (doc) in the extension field. This means the program
will look for files that have the extension of doc and have the word bank somewhere in the first
part of the file name.
58
8.4 Save Sectors / Restore Sectors of data to/from a file (i.e. instead of having
to use Cycle-Clone / Cycle-Image to create an entire file volume of the media)

There is the ability to save a range of sectors to a file within Media Editor, instead of having to
use Cycle-Clone/Cycle-Image. When you make changes to any sector, you can make a
quick backup of the sector to a file (We recommend creating an Image File Volume of the entire
media before making any changes). Save Sectors will default to backup whatever sector you are
currently on or you can select a range. If you save a range of sectors, make sure there is enough
space on the destination. Restoring the file works in reverse. It will restore whatever sector file
you choose to whatever sector you are currently on.

8.5 Fill Current Sector (i.e. when you have a virus that will not go away)

The <Fill Current Sector>option fills whatever sector you currently are on. If the Boot Sector is
corrupt and full of garbage, use the <Fill Current Sector>option to clear it out before
reconstructing. It defaults to writing zeros to the sector. You can choose a different symbol to be
written to the sector. Make sure you have a backup of the sector first, whether it is an image file
volume or a sector save from the Utils menu. Clearing the sector eliminates every byte in the
sector. As an example, if you have a virus that just wont go away, clearing the sector and then
rebuilding the Partition Table or Boot Sector is very helpful.

59
Chapter 9 Secure Wipe

Department of Defense security level

If you think formatting your hard drive or removing the MBR is good enough, think again.
Secure Wipe quickly and permanently overwrites every bit on every sector on any media or
operating system to the level the U.S. Department of Defense requires and authenticates it with
MD5. This means every physical sector, chain and cluster, will be overwritten, so that it can
NEVER be recovered. Better yet, this process takes just minutes to complete.

CAUTION: Running Secure Wipe will completely destroy all data on your hard
drive. Once run, data will be lost forever. Please be sure you wish to destroy all data
before running the program.

Wipe the Drive / p.61
Department of Defense, Secure Wipe / p.62

60
9.1 Wipe the Drive

1. To prepare to wipe the drive, complete 4.1 4.3 in Chapter 4.

Secure Wipe screen notes:


Modify - <Alt M>, modifies the Cylinder, Head, and Sector of the Starting Position
and Finishing Position. <Tab>or use the <Arrow Keys>on the keyboard to move
between the Position fields. When you have finished making modifications press
<Enter>.

any time, too.

Screen.

Verify - <Alt V>, verifies that all sectors have been wiped with the symbol you have
selected.

Options - <Alt O>, gives options to choose what character you want to write to all
sectors of the media and how many times that this character is written to each sector
(even to the level the Department of Defense requires).

2. By default, the drive is Wiped with 0000000. If this is suitable for your needs,
press <Alt S>to select Start.

To select one of the other 256 Hex characters
To change the number of times the drive is Wiped
To choose The Department of Defense Security Wipe

Press <Alt O>to select Option. Then, go to 9.2, The Department of Defense Wipe.

61
9.2 Department of Defense, Secure Wipe

To prepare for the Department of Defense, Secure Wipe, begin at 9.1, Wipe the Drive.

3. To select the DOD Security Wipe, press <Alt D>. Then, press <Alt O>.
To change the number of times the drive is Wiped, press <Alt N>and chose a number.
To change the Hex character, press <Alt G>and chose a character. Then, press <Alt O>.

The DOD Security Wipe is in progress

4. Press <Alt S>to select Save As File, if necessary. Choose your destination.

62
Chapter 10 Save / Load Found Components

10.1 Save Found Components to a Bin File / p.63
A. Save Found Components while exiting the program / p.63
B. Save Found Components while working within the program / p.65
10.2 Load Found Components from the Bin File / p.67
A. Load Found Components while entering the program / p.67
B. Load Found Components while working within the program / p.68

63
10.1 Save Found Components to a BIN FILE

There are 2 ways to Save Found Components to the Bin File: While exiting the
program or while working within the program. If you are trying to Save the Bin File
while working within the program go to 10.1.B., Save Found Components while
working within the program.

10.1.A. Save Found Components while exiting the program

1. Exit the program <Alt X>.

2. A Question Box will be invoked: Do you want to quit the program? Press <Enter>or <Alt Y>
for <Yes>.

3. Another Question Box will be invoked: Would you like to save all found components to a file
for future use? Press <Alt Y>, so that you do not have to scan the drive again.

4. Name the Bin File. The Bin File naming convention is (FileName.bin).

5. Press <Alt F>to enter a file name. Then, press <Alt O>. (The program will exit).

6. Press <Alt Y>for Yes to write to floppy.
64
10.1.B. Save Found Components while working within the program

1. Press <Esc>, and the Systems Components Screen will appear.

2. Press <Alt C>to select Config.

3. Press <Alt S>to select Save Found Components.
65

4. Name the Bin File. The Bin File naming convention is (FileName.bin).

5. Press <Alt F>to enter a file name. Then, press <Alt O>.

6. Press <Alt Y>for Yes to write to floppy.

7. Press <Alt A>to select Analyze Found Components.

(Continue working within File Recovery Tree, Chapter 6; or Boot Partition Repair, Chapter 7.)
66
10.2 Load Found Components from the BIN File

There are 2 ways to Load Found Components to the Bin File: While entering the
program or while working within the program. If you are trying to Reload the Bin File
while working within the program go to 10.2.B. Load Found Components while
working within the program.

10.2.A. Load Found Components while entering the program

1. Press <Alt C>to continue into the program.

4. Using your <arrow keys >, select the drive to be recovered. Then, press
<Alt O>or <Enter>.

4. Select File Recovery Tree or Boot Partition Repair by using your <arrow key >. Then,
press <Enter>(Shortcut: Hold down your <Alt>key and press the <red letter>).
67
Once the System Components Search screen has appeared continue by starting at
Step 2, 5.2.B., Load Found Components while working within the program (Ignore
Step 1 if you have started from 5.2.A. Load Found Components while entering the
program).

10.2.B. Load Found Components while working within the program

1. Press <Esc>to access the System Components Search screen.

5. Press <Alt C>to select Config.

3. Press <Alt L>to select Load Found Components.

68

4. <Tab>to highlight the Saved BIN File, and then press <Enter>.

5. Press <Alt A>to select Analyze Found Components, and then press <Enter>.

(Continue working within File Recovery Tree, Chapter 6; or Boot Partition Repair, Chapter 7.)
69
Chapter 11 FAQ (frequently asked questions)

11.1 Does RecoverSoft Media Tools Professional recover from viruses? / p.70
11.2 Does RecoverSoft Media Tools Professional recognize USB? / p.70
11.3 Does RecoverSoft Media Tools Professional recover from RAID? / p.70
11.4 Does RecoverSoft Media Tools Professional recover from SATA drives? / p.70

11.1 Does RecoverSoft Media Tools Professional recover from
viruses?

INVALID DRIVE SPECIFICATION or MISSING OPERATING SYSTEM

YES. If you have one of these error messages when booting your system, a virus has probably
infected the Boot Sector and Partition Table, while leaving the rest of your file system intact.
Power up Boot Partition Repair or File Recovery Tree, let it make the necessary repairs, and
then go get your directories and files.

11.2 Does RecoverSoft Media Tools Professional recognize USB?

YES. When booting the software you can choose to load USB drivers.

11.3 Does RecoverSoft Media Tools Professional recover from RAID?

YES. If the full capacity of the RAID appears within the Drive Geometry box below RecoverSoft
Media Tools Professional can work. The drive will always appear as BIOS HDD. If the RAID
appears as a 8.2GB it will not work. Refer to the Data Recovery Services button at the beginning
of the program to call us for further solutions.

11.4 Does RecoverSoft Media Tools Professional recover from SATA
drives?

YES. To recover data from a Serial ATA Drive, you will need to get the Serial ATA-IDE/ATAPI
Converter from http://www.cabledepot.com (1-800-343-4597 toll free or 1-770-564-2323) for
approximately $50.00 Part Number: SATA-ATAPI
70
Chapter 12 Problem Solving

12.1 Problem Launching the Program / p.71
12.2 Program Freezes while using it / p.72
12.3 File System not Displayed (in Select File System screen) / p.72
12.4 No Valid File System Found / p.72
12.5 File cannot be Located / p.73
12.6 Cannot Locate the Root Directory / p.73

12.1 Problem Launching the Program?

If your desktop or laptop computer system hangs while booting, follow the directions
below:

1. Try using a Windows 95/98 boot diskette instead of letting the program boot automatically. At
the DOS prompt (A:\), type: MTL(space)-F.

12.2 Program Freezes while using it?

If the computer freezes while using one of the functions within the program, reboot the system.
You will automatically be taken back into the program. Then, press <ALT-X>to exit the program
to the DOS prompt (A:\). At the DOS prompt, type: MTL(space)-F. This will restart the
program in a more conservative manner, which should keep the program from freezing in the
future.

12.3 File System not Displayed (in Select File System screen)?

1. At any point within the program, press <Alt X>to Exit. Then, press <Alt Y>to select Yes.

Make sure you save the found components from the scan to a file on the Media
Tools Professional floppy diskette, if you have not already done so. Refer to:
Chapter 10, Save/Load Found Components.

2. You should be at a DOS prompt (A:\). At the DOS prompt, type: MTL(space)-P and press
<Enter>.

3. Upon entering the program, Load Found Components from the Bin File (See Chapter 10.2.A,
Load Found Components while entering the program).

4. At the Select File System screen, you should see all possible file systems found during the
System Component Search, even the invalid file systems. Choose a file system and then press
<Alt O>to select OK.

The color coding system to verify if your files and directories are valid is not
applicable for file systems that previously did not appear in the Select File System
Screen, which now do because of using MTL(space)P.

12.4 No Valid File System Found?

71

No Valid System Found?: If NO Valid File System was found, exit File Recovery
Tree or Boot Partition Repair. Then, enter the Media Editor and do the
following: Chapter 8.2, Mount the File System within the Media Editor; and
Chapter 8.3, Recover Files and Directories Automatically.

If TREEing the file system through the Media Editor does not work, this
indicates severe damage to the file system.

1. Press <Alt O>for <OK>, and then <Esc>.

2. Press <Alt E>for <Media Editor>.

3. Follow the step-by-step directions in Ch.8, Media Editor, for:

Mounting the file system (step-by-step directions, Ch 8.2)
Automatically Recovering Files and Directories, Ch 8.3)

12.5 File cannot be Located?

Use the Menus to look for and filter specific files within the File Recovery Tree operation (See
Chapter 6.5, Use the Menus to look for and filter specific files). Pay close attention to the
examples given.

12.6 Cannot locate the Root Directory?

72
Scenario 1: If you know that your Root Directory does not exist, then press <No>. The program
will automatically create a Root Directory with the information available. The results will appear as
Found within the File and Directory Structure Tree (now, return to File Recovery Tree or Boot
Partition Repair section within the manual).

Scenario 2: If you are not sure if the Root Directory is intact, then press <Yes>.

Then, use the <arrow keys>to move up and down until you find what looks like the Root
Directory. The Root Directory typically contains folders such as Windows, My Documents and
files such as IO.SYS or MSDOS.SYS. Once you have located the Root Directory, press <Alt S>
for <Select>and the program will redirect you to the Select File System window.

Scenario 3: If you could not locate the Root Directory in Scenario 2, then press <Cancel>. The
program will automatically create a Root Directory. The results will appear as Found within the
File and Directory Structure Tree (now, return to File Recovery Tree or Boot Partition Repair
section within the manual).
73
Chapter 13 Advanced Data Recovery and Computer Forensic Procedures

13.1 Advanced User Set-up Screen - <Ctrl S>/ p.74
13.2 RAID Recovery / p.75
13.3 MD5 Hash Mark / p.75
13.4 Compression on the Fly / p.76
13.5 File System Types / p.77

13.1 Advanced User Setup Screen - <Ctrl S>

Mechanically Failing Drives need Reverse-Clone, a function from within
RecoverSoft Media Tools Professional, to extract raw data before the drive
totally fails. It is necessary to Reverse-Clone mechanically failing drives in IDE or
SCSI Access (see Chapter 5.2 Reverse Clone (mechanically failing drives).

When you are encounter sector read errors, you need to Reverse-Clone your drive. If you
encounter sector read errors while using Reverse-Clone, you need to pause the program by
pressing <Ctrl S>to change the Timeouts and Read Parameters within the User Setup window.
This helps you to communicate with the drive to extract data in bad sectors (see notes below).

Tip: Press <Ctrl S>: at any time, from anywhere in the program, to access this
window. This is the Control Center for working with Mechanically Failing media,
meaning you will refer to it often to make changes (such as changing the Timeouts
variables or the Read Parameters).

Shortcut: When a RED letter is highlighted within any screen, this indicates a
shortcut can be used. For example, if you look at the File Recovery Tree
screen above, notice that the letters A, R, S, and D are in red. Hold down your
<Alt>key and press the <red letter>.

Drive Access Methods (Advanced explanation): How RecoverSoft Media Tools
Professional addresses and communicates with any drive (see Ch.4.2, Select Drive for details).

Timeouts and Read Parameters

Increasing the Timeouts variable is sometimes the only change needed to communicate with the
74
drive effectively. Increase the IDE Devices or SCSI Devices at 250,000ms. If this does not work,
the next step would be to change the Process Delay within Read Parameters.
Changing the Read Parameters is another method to effectively communicate with the drive.
Increase the Process Delay at 50ms. If this does not read the drive, increase the Process Delay
to 100ms. If you can read the drive, every few minutes accelerate the process by decreasing the
Process Delay in increments of 5ms. This gives you the greatest control combined with maximum
speed in cloning your data. If you cannot read the drive, the next step would be to change the
Read Retries within Read Parameters.

Changing the Read Retries within Read Parameters gives the program more chances to read
the damaged sector before moving on to the next sector. Increase the Read Retries to 50. If you
cannot be read the drive, decrease the Read Retries to 0. This is called Skip Mode, meaning the
program will not attempt any Read Retries.

13.2 RAID Recovery

If the full capacity of the RAID appears within the Drive Geometry box below RecoverSoft
Media Tools Professional can work. The drive will always appear as BIOS HDD. If the RAID
appears as a 8.2GB it will not work. Refer to the Data Recovery Services button at the beginning
of the program call us for further options.

13.3 MD5 Hash Mark (Message Digest 5)

Most all processes that are performed in the program create a report automatically. Each report
records a MD5 fingerprint.

Developed in 1994 by Professor Ronald L. Rivest of MIT, MD5 (Message Digest 5) is a one-way
hash algorithm that takes any length of binary data and produces a 128 bit "fingerprint" or
"message digest". This fingerprint is "non-reversible". In other words, it is impossible to compute
the binary data based on the fingerprint. This means someone cannot figure out your data based
on its MD5 fingerprint. Every time you run the MD5 hash algorithm on the binary data, you should
get the exact same fingerprint. If you get a different fingerprint, then the binary data has been
changed.

75
MD5 is an industry standard in the world of forensics. As an example, it is imperative that any
copy (Clone) of the media is identical to the original media. The program records the MD5
fingerprint in a report, and enables you to compare the fingerprint against any copy of the original
media to show that it is an exact copy. To date, the MD5 standard has not been cracked and is
accepted in our legal system as a valid authentication process.

13.4 Compression on the Fly

Compression on the Fly is used in two different formats within RecoverSoft Media Tools
Professional:

1. To compress files to be recovered in ZIP format.

2. To compress an Image when using the Cycle-Image operation. Computer Forensics requires
no Compression on the Fly.

76

13.5 File System Types

Hex Value Type Description
00h Unused Empty
01h FAT 12 DOS 12-bit FAT
02h XenixR XENIX /
03h XenixU XENIX /usr
04h FAT 16 DOS 16-bit FAT <32M
05h Extend DOS Extended
06h BigDOS DOS 16-bit FAT >=32M
07h NTFS HPFS / NTFS
08h AIXbt AIX boot or SplitDrive
09h AIXdt AIX data or Coherent
0ah OS/2BM OS/2 Boot Manager
0bh FAT32 Win95 FAT32
0ch FAT32X Win95 FAT32 (LBA)
0eh FAT16X Win95 FAT16 (LBA)
0fh Win95X Win95 Extended (LBA)
10h OPUS OPUS
11h FAT12h Hidden DOS FAT12
12h Compaq Compaq diagnostics
14h FAT16h Hidden DOS FAT16
16h FAT16h Hidden DOS FAT16 (big)
17h NTFSh Hidden HPFS/NTFS
18h AstWin AST Windows swapfile
24h NecDOS NEC DOS
3ch PQrcv PartitionMagic recovery
40h Venix Venix 80286
41h DR_Mnx Linux/MINIX (sharing disk with DRDOS)
42h DR_SFS SFS or Linux swap (sharing disk with DRDOS)
43h DR_Lin Linux native (sharing disk with DRDOS)
50h DskMng DM (disk manager)
51h Nvl1 DM6 Aux1 (or Novell)
52h CP/M CP/M or Microport SysV/AT
53h DMAux3 DM6 Aux3
54h DM6 DM6
55h EzDrv EZ-Drive (disk manager)
56h GldnBw Golden Bow (disk manager)
5ch Priam Priam Edisk (disk manager)
61h SpdStr SpeedStor
61h HURD GNU HURD or Mach or Sys V/386 (such as ISC UNIX)
61h DSKSec DiskSecure Multi-Boot
64h Nvl286 Novell Netware 286
65h Nvl386 Novell Netware 386
75h PC/IX PC/IX
77h QNX4.x QNX4.x
78h QNX4x2 QNX4.x 2nd part
79h QNX4x3 QNX4.x 3rd part
80h Mnx14a MINIX until 1.4a
81h MnxOld MINIX / old Linux
82h LinSwp Linux swap
83h Linux Linux native
84h OS/2h OS/2 hidden C: drive
85h LinExt Linux extended
77
86h NTFSv NTFS volume set
87h NTFSV NTFS volume set
Hex Value Type Description (Continued)

93h Ameoba Amoeba
94h AmbBBT Amoeba BBT
a0h IBMPad IBM Thinkpad hibernation
a5h BSD386 BSD/386
a6h OpnBSD OpenBSD
a7h NeXT NeXTSTEP 486
b7h BSDI BSDI fs
b8h BSDIsw BSDI swap
c1h DRDOS1 DRDOS/sec (FAT-12)
c4h DRDOS2 DRDOS/sec (FAT-16, <32M)
c6h DRDOS3 DRDOS/sec (FAT-16, >=32M)
c7h Syrinx Syrinx
dbh CP/M CP/M or Concurrent CP/M or Concurrent DOS or CTOS
e1h SpdStr DOS access or SpeedStor 12-bit FAT extended partition
e3h DOS RO DOS R/O or SpeedStor
e4h SpdS16 SpeedStor 16-bit FAT extended partition <1024 cyl.
Ebh BeOS BeOS fs
f1h SpdStr SpeedStor
f2h DOS3.3 DOS 3.3+secondary
f4h SpdStr SpeedStor large partition
feh SpdStr SpeedStor >1024 cyl. or LANstep
ffh XnxBBT Xenix Bad Block Table
78
RecoverSoft Media Tools Professional License Agreement

READ THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT CAREFULLY
BEFORE RUNNING THE COMPUTER SOFTWARE HEREIN, AND THE ACCOMPANYING
USER DOCUMENTATION (THE "PROGRAM"). THE PROGRAM IS COPYRIGHTED AND
LICENSED (NOT SOLD). BY RUNNING THE PROGRAM, YOU ARE ACCEPTING AND
AGREEING TO THE TERMS OF THIS LICENSE AGREEMENT. IF YOU ARE NOT WILLING TO
BE BOUND BY THE TERMS OF THIS LICENSE AGREEMENT, YOU SHOULD PROMPTLY
DELETE THE SOFTWARE AND ACCOMPANYING FILES. THIS LICENSE AGREEMENT
REPRESENTS THE ENTIRE AGREEMENT CONCERNING THE PROGRAM BETWEEN YOU
AND PROSOFT ENGINEERING, INC. (REFERRED TO AS "LICENSOR"), AND IT
SUPERSEDES ANY PRIOR PROPOSAL, REPRESENTATION, OR UNDERSTANDING
BETWEEN THE PARTIES.

1. License Grant. Licensor hereby grants to you, and you accept, a nonexclusive license
to use the Program Diskettes and the computer programs contained therein in machine-readable,
object code form only (collectively referred to as the "Software"), and the accompanying User
Documentation, only as authorized in this License Agreement. You agree that you may not
reverse assemble, reverse compile, or otherwise translate the Software.

2. Licensor's Rights. You acknowledge and agree that the Software and the User's
Manual are proprietary products of Licensor protected under U.S. and International copyright law.
You further acknowledge and agree that all right, title, and interest in and to the Program,
including associated intellectual property rights, are and shall remain with Licensor. This License
Agreement does not convey to you an interest in or to the Program, but only a limited right of use
revocable in accordance with the terms of this License Agreement.

3. License Fees. The license fees paid by you are paid in consideration of the licenses
granted under this License Agreement. If you received the software for demonstration purposes
and/or no fee was charged, this in no way effects the terms of this agreement.

4. Term. This License Agreement is effective upon your receiving the software, either on
disk or by electronic transfer of any type and shall continue until all copies of the software have
been returned to Licensor. You may terminate this License Agreement at any time by returning
the Program and all copies thereof and extracts therefrom. Licensor may terminate this License
Agreement upon the breach by you of any term hereof. Upon such termination by Licensor, you
agree to return to Licensor the Program and all copies and portions thereof.

5. No Warranty. The software is supplied without any warranty. THE PROGRAM, AND
THE SOFTWARE CONTAINED THEREIN, ARE LICENSED "AS IS," AND LICENSOR
DISCLAIMS ANY AND ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED,
INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY
OR FITNESS FOR A PARTICULAR PURPOSE.

6. Limitation of Liability. Licensor's cumulative liability to you or any other party for any
loss or damages resulting from any claims, demands, or actions arising out of or relating to this
Agreement shall not exceed the license fee paid to Licensor for the use of the Program. In no
event shall Licensor be liable for any indirect, incidental, consequential, special, or exemplary
damages or lost profits, even if Licensor has been advised of the possibility of such damages.
SOME STATES DO NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY FOR
INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE LIMITATION OR
EXCLUSION MAY NOT APPLY TO YOU.

7. Trademark. Media Tools and RecoverSoft Media Tools Professional are
registered trademarks of Licensor. No right, license, or interest to such trademark is granted
79
hereunder, and you agree that no such right, license, or interest shall be asserted by you with
respect to such trademark.

8. Governing Law. This License Agreement shall be construed and governed in
accordance with the laws of the State of CALIFORNIA USA.

9. Costs of Litigation. If any action is brought by either party to this License Agreement
against the other party regarding the subject matter hereof, the prevailing party shall be entitled to
recover, in addition to any other relief granted, reasonable attorney fees and expenses of
litigation.

10. Severability. Should any term of this License Agreement be declared void or
unenforceable by any court of competent jurisdiction, such declaration shall have no effect on the
remaining terms hereof.

11. No Waiver. The failure of either party to enforce any rights granted hereunder or to
take action against the other party in the event of any breach hereunder shall not be deemed a
waiver by that party as to subsequent enforcement of rights or subsequent actions in the event of
future breaches.

2005 Prosoft Engineering, Inc.
2002 2005 ACR Data Recovery, Inc.
2000 2001 ACR Data Recovery Software, Inc.
1994 1999 Atlanta Computer Resources, Inc.
All rights reserved.

80

Media Tools Manual

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Media Tools Manual

Uploaded by

Copyright:

Available Formats

(Updated: February 21, 2006)

RecoverSoft Media Tools Professional

You might also like