TIRAMISU - SOPHISTICATED DATA RECOVERY V2.01 (c) 1996 by Plug'n Play, Uwe Gissemann INTRODUCTION TIRAMISU is a software for reconstructing data from a crashed hard drive. It helps when the drive is - hit by a virus - formatted - 'fdisk'ed - zapped by a power failure - damaged by applications TIRAMISU scans the drive even when there are physical damages. The found data are analyzed and reconstructed. TIRAMISU can handle drives without readable boot sector, readable Fat or readable directories. It can handle drives that are not recognized by DOS anymore. TIRAMISU automatically creates a VIRTUAL DRIVE in memory. This virtual drive looks like a usual file manager. You can see the lost directories and files of your crashed drive. Now files and directories can be viewed and copied to a safe medium. The extensive use of our sophisticated pattern recognition technology enables TIRAMISU to put the right pieces of data together again. Even disks with very few administrative informations left can reach a high recovery quality. TIRAMISU recovers much more data than any other 'disk doctor'. TIRAMISU is NON DESTRUCTIVE and READ ONLY. It does not put any data onto your crashed drive. Recovered data are restored to another destination (disk, diskette, network, interlink). TIRAMISU works on DOS and Windows platforms. Better Windows95 support has been added in version 1.03. Multi partition recovery has been added in version 2.0. A version for NOVELL is available too. A version for HPFS is under development. SYSTEM REQUIREMENTS - 286 processor and up - 4 MB RAM and up Depending on the size of the drive to be recovered we recommend a 486 with 8 MB RAM. Installing 5 MB of EMS (Version 4) is recommended. GETTING STARTED 1) Boot diskette Create a boot diskette with a CONFIG.SYS similar to this: files=25 device=himem.sys device=emm386.exe Make sure you have specified the correct drive parameters in BIOS setup. Boot the computer and start the program TIRAMISU.EXE. 2) Specify swap area By default TIRAMISU uses EMS as swap area. If for some reason there is no or not enough EMS you can specify a swap area on disk. Select OPTION -> DATA RECOVERY, tag 'DISK ALLOWED', specify path. CAUTION: Do not swap to the drive you intend to recover. 3) Hit TIRAMISU! for the drive you want to recover. TIRAMISU starts processing. Depending on your system's speed and the size of your drive this can take 5 minutes or even up to 1 hour. 4) Copy some or all files to a safe medium using F7 Now you see the virtual drive and you can view and copy (registered version only) the files to any DOS-available destination. THAT'S IT! ISN'T IT EASY? RESTRICTIONS TIRAMISU handles only drives with 16-Bit Fats, which applies to most systems. Only old (10 MB) drives have another Fat (12-Bit). Since TIRAMISU is very memory hungry, your PC might run out of memory. If you face this problem, install a memory manager with as much RAM and EMS as possible. Watch the available memory displayed at the bottom line. The value displayed at the far right shows the free RAM. The E:XXX shows the free EMS and the F:XXX shows the fragmentation. The RAM should not go below 50000. OPTIONS There are several options you can change in the OPTIONS->DATA RECOVERY screen. - Swap Area By default TIRAMISU stores memory intensive data in EMS. If your have no or not enough EMS available you can allow swapping to a drive. Be sure to choose a drive you are not just recovering. - Excluded Main Directory Entries This option tells TIRAMISU to ignore files entries that have been created during a previous run of another disk doctor (Norton, Scandisk,...). - Logging Use this option to create a log file of TIRAMISU's processing. This might be interesting for debug purposes. - Automatic Identification The first thing TIRAMISU does is to retrieve the original structure of the file system: place of Fat1, Fat2, main directory, number of sectors per cluster, number of clusters. If you tag off this option TIRAMISU shows you what it thinks what kind of file system it found. Usually you confirm this by pressing OK. If you can not confirm the structure TIRAMISU found, you can continue the identification procedure by pressing SEARCH AGAIN. After a while TIRAMISU will make a new proposal. - Start Identification At Sector X By default TIRAMISU starts its identification procedure at sector 0. However you might be interested in recovering another but the first partition. Then you can enter a value in this field. Example: Let's suppose you have a 600 MB drive with two partions (400 MB and 200 MB). You want to recover the second (200 MB) partition. The first partition uses 400 MB space on the hard drive. These are approximately 800000 sectors (one sector has 512 bytes). Consequently you should enter the value 800000 in this field. You should tag the "Automatic Identifation" off. So you can verify if TIRAMISU retrieved the correct file system structure. - Bad File Entry Acceptance TIRAMISU uses statistical algorithms to decide if file entries are included into the recovery process. If you set this option to 0 TIRAMISU is very strict. If you set it to 100 TIRAMISU is very loose. 50 is a good value. Increase it if you miss some files in the resulting virtual drive. Decrease it if you get scrambled results. TROUBLE SHOOTING Sometimes you might think the computer is frozen and TIRAMISU is crashed. Be patient! Some procedures might take up to one hour. If TIRAMISU crashes you usually get an error code. If you get only scrambled results this could be due to the TIRAMISU drive structure recognition routine. Try this: Select OPTION -> DATA RECOVERY, tag 'AUTOMATIC IDENTIFICATION' off. Press TIRAMISU!. After a while you get a window that proposes a certain drive structure. If you are not satisfied with what you see you can press 'Search Again'. TIRAMISU tries to retrieve another structure. Finally press 'Ok'. You can change the Option "Bad file entry acceptance". 0% means a very strong directory recognition routine. Use only if TIRAMISU crashes. 100% means a very loose directory recognition routine. Use if TIRAMISU goes through but you miss some directories. 50% is a good standard value. You should not use any other 'disk doctor' before running TIRAMISU. If you did so, please 'undo'. If you cannot 'undo' you can tell TIRAMISU to ignore the file entries the 'disk doctor' created (something like FILE0000.CHK...). Select OPTION -> DATA RECOVERY, modify the field 'Exclude Main Directory Entries'. Upload a new version from our Internet site (address below). If you find any bugs, please send a description to one of the addresses below. REGISTRATION TIRAMISU IS DISTRIBUTED AS SHAREWARE. FEEL FREE TO COPY, DISTRIBUTE OR UPLOAD IT TO ANY MEDIUM. The unregistered version has all functions for recovering your crashed hard drive. But only the registered version of TIRAMISU allows you to COPY files from your recovered drive. The registration fee is DM 145. (Equal to US $99) The registration allows you to COPY recovered files for a PERIOD OF ONE WEEK. In effect this is a PAY PER USE registration. The procedure is this: - Run TIRAMISU and check if it can restore your data (VIEW your files) - Select HELP -> REGISTRATION. You see a 16- or 17-letter code. - Submit this code to the TIRAMISU registration service (preferably by fax, use the form you can find in REGISTER.TXT): Tel. 49-30-292 00 99 (Germany) Fax 49-30-292 60 63 Email 101457.1447@compuserve.com http://ourworld.compuserve.com/homepages/data_recovery Address: Plug 'n Play Uwe Gissemann Scharnweberstr. 43 D-10247 Berlin Germany - Send DM 145 (or US $99) or credit card information (VISA or DINERS). - The registration key will be forwarded to you immediately by fax or email. - After receiving the registration key, enter it in the registration screen. - Now you can use COPY to save your data. IMPORTANT: The registration allows you to recover data only from your computer. It is not valid for other systems. After registration do not move the program to another drive. This is a copy protection. The registration automatically expires after 7 days. DISCLAIMER PLUG'N PLAY DOES NOT WARRANT THAT THE SOFTWARE IS ERROR FREE. PLUG'N PLAY DISCLAIMS ALL WARRANTIES WITH RESPECT TO THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. NO LIABILITY FOR CONSEQUENTIAL DAMAGES. IN NO EVENT SHALL PLUG'N PLAY BE LIABLE FOR CONSEQUENTIAL, INCIDENTAL OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE DELIVERY, PERFORMANCE OR USE OF THE SOFTWARE, EVEN IF PLUG'N PLAY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL PLUG'N PLAY'S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT OR ANY OTHER THEORY OF LIABILITY, EXCEED THE LICENSE FEE PAID BY THE BUYER.