Introduction

GetDataBack for FAT © 2001-2010 by Runtime Software LLC

75-5744 Alii Dr., Suite #256, Kailua Kona, HI 96740, USA
Phone (USA): 1-808-329-2202, Fax: 1-818-475-1741
Phone (Germany): +49-30-280 8008
Email: info@runtime.org, Web: http://www.runtime.org

GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, accidental deletion, formatting, fdisk or power failure.

GetDataBack can even recover your data when the drive is no longer recognized by Windows. It can likewise be used even if all directory information - not just the root directory - is missing.

Advanced algorithms will make sure that all files and directories are put together as they were. GetDataBack works on a partition level. It restores one partition at a time.

GetDataBack is safe. It is read-only, meaning the program will never attempt to write to the drive you are about to recover.
Note: If you are going to perform a recovery, DO NOT install the software on the drive you want to recover. Instead, install it on a different drive and connect this to the machine as the second drive!

GetDataBack enables the regular user to conduct his own data recovery by guiding him through three easy to understand steps, while giving the advanced user the possibility to interfere with the recovery and improve the results, by examining the scan log, the file system details, file and directory information, by selecting the sector range to be scanned in the option for partial scan, by choosing excessive search for file systems or search for lost files, by calling Runtime's DiskExplorer.

GetDataBack recovers data from

  • Hard Drives
  • USB and Firewire Drives
  • Partitions
  • Floppy Drives
  • Drive Images
  • Zip/Jaz Drives
  • Smart Media and Compact Flash Cards
  • USB Flash Drives
  • Remote drives through a serial cable or TCP/IP
  • RAID arrays using a virtual image

This version of GetDataBack recovers FAT file systems:

  • FAT12: usually associated with floppies and hard drives not larger than 16MB.
  • FAT16: used on hard drives in all DOS versions, Windows 2.xx, Windows 3.xx and early Windows 95 and NT versions. Maximal partition size is 2GB.
  • FAT32: usually used on hard drives larger than 512MB in Windows95 (OEM Rel. B), Windows 98, ME and FAT-formatted drives in W2K and XP.

This program runs under these operating systems: Windows 95/98/ME, Windows NT, 2000, XP.

If you want to recover a NTFS partition, please download GetDataBack for NTFS at http://www.runtime.org/gdb.htm.

If you want to recover a broken RAID, please use our RAID Reconstructor first.

Introduction Screen

On this first screen you will have the opportunity to inform the software about what has happened to your hard drive. This way you can optimize the options settings for this specific recovery. Please choose between the following scenarios:

  • I don't know, use default settings.

    Choose this if you are not exactly sure what happened to your drive, or if any of the situations below don't apply.
    The standard options (recover deleted files, allow duplicate file names) will be set.
    You would also choose this option if you want to designate the options yourself.
  • Systematic file system damage, e.g. Format or Fdisk.

    Select this button, if you data is inaccessible because

    • the drive was wrongly formatted, quick-formatted or fdisked, but no further data was written to it,
    • the drive became suddenly inaccessible, for example after a hardware or power problem,
    • the drive has some ''bad sectors''.

    This will uncheck all options to allow for a clean recovery.

  • Sustained file system damage, e.g. a new operating system was installed.

    Choose this, if a significant amount of data was copied to the drive after the data loss, for example by

    • re-installing the operating system,
    • partially wiping out the drive,
    • overwriting the drive with cloning software.

    This will turn on the standard options (recover deleted files, allow duplicate file names) and will also set a flag in the log file and snapshot for our technicians to see in case you contact them for technical support later.
  • I want to recover deleted files.
    Go with this option, if you want to recover accidentally deleted files or folders and the file system is otherwise undamaged..
    This will make sure that the options to recover deleted files and to allow duplicate file names will be checked.

You may manually set further options by going to Options on the main menu, or by clicking on "See current options" in Step1.

Do not - just in case - turn on every available option in the software. Instead go with the recommended settings. Having every option turned on - especially the ones for recover lost files and excessive search - will normally not improve the quality of your recover and will only slow down the process.

Do's and Don'ts when doing a data recovery

Do not write anything to the drive you want to recover the data from! This includes installing programs, surfing the Internet or even booting from that drive.

Instead, attach the drive as a second (slave) drive to a working system. Install and run GetDataBack on the healthy system. Read the page about how to do a data recovery right.

If you suspect that your drive may have a physical problem or if you get read errors during the scan with GetDataBack, consider making an image of the drive first.

If your drive has severe physical problems, we strongly recommend that you refrain from all do-it-yourself data recovery attempts and send the drive to a specialized lab.

Scanning an external drive can be very time consuming, especially when using USB1. If possible, remove the drive from its enclosure and attach it directly to the internal IDE cable of your computer. Please search the Internet for help on how to do this.

If you have any questions about this software, check out our F.A.Q. or contact technical support.

See also: Doing a recovery, F.A.Q., Support, Check List, License Agreement


Installation

Do not install GetDataBack to the drive you want to recover! It is strongly recommended to proceed as follows:

Install the program to another computer, which doesn't have any problems. If you have a choice, choose the computer which has the most RAM and is the fastest. Attach the drive you want to recover as a slave to this machine. Make sure the drive is jumpered correctly and is recognized by the BIOS.

After downloading GetDataBack run the setup.exe. The setup wizard will guide you through the installation process.

NT/XP users: You must have Administrator rights to run this program.

Language: You can select the program's language (currently English or German). Click Tools->Select language and choose the desired language. If you choose "default" the language will be determined by your Windows locale settings.

See also: Do a data recovery


System Requirements

  • Pentium processor
  • 32-128 MB RAM (depending on the capacity of the drive you want to recover)
  • Windows 95/98/ME, Windows NT, 2000, XP

For best results choose your fastest, most RAM-loaded computer and attach the drive you want to recover to this machine.

See also: Installation, Do a Data Recovery


GDB

GDB.INI

This file contains some definitions for GetDataBack's recovery engine:

  • The LostFiles section contains file definitions for the Recover Lost Files feature.
  • The Template section contains file system definitions for the Template feature in Step1.


Version Info

This windows displays version numbers and dates of the following program components:

  • Product name is this software's name.
  • Version is the current version number.
  • Program name is the name of the EXE file.
  • Program file date is the date of the EXE file.
  • DRV16 location is the directory where DRV16 is located. This file is the driver for accessing the hard drives and is required for Windows 95/98/ME.
  • DRV16 version is the hard drive driver's version number.
  • DRV16 date is the hard drive driver's date.
  • Help file is the name of this help file.
  • Installation dir is the directory this software is installed.
  • INI file is the name of this software's INI file.


Menu structure

File |  |
 | Load recovery | load a previous scan or recovery tree
 | Save recovery | save a scan or a recovery tree
 | Exit | quit this program
Recovery |  |
 | Copy... | copy recovered files or folders to a safe destination
 | Open | open a file with its native application
 | Open with... | select an application to open a file with
 | Show info... | show information about the recovery details of a file
 | View | view a file with the internal viewer
 | Rename | rename a file
Tools |  |
 | Search files... | search for files in the recovery tree
 | Search next | continue last search
 | Call DiskExplorer | call Runtime's DiskExplorer for the currently selected structure
 | Create Image File... | clone the currently selected drive or partition
 | Options... | change recovery settings
 | Select Language | change the language of this software
Help |  |
 | Content | call the integrated help (this)
 | Register | enter a license key to unleash the full power of this software
 | About | displays copyright, license and version information
 | Version info | displays more version information
 | Show data structures | show data structures used by GetDataBack (internal use)
 | Snapshot for customer support | Create a snapshot of the recovery for support purposes


Registration

Registering the software will enable you to copy your recovered files and folders to a safe location.

Register online on our website http://www.runtime.org and get the registration key immediately.

If you prefer not to order online give us a call at 1-808-329-2202 (USA) or +49-30-280 8008 (Germany).

Entering the License Key

When entering the license make sure you enter both, the name and the license key, exactly as spelled in the registration email we sent to you. Name and key are a matching pair and only entering both will successfully register GetDataBack. We recommend to copy and paste the information from the registration email.


License Agreement

License Agreement and Disclaimer

The following are the conditions under which Runtime Software software is sold, supported and may be used. By using or registering Runtime Software software, you are agreeing to these.
This document may be augmented or superseded by conditions included with specific applications.

Neither the author(s) nor Runtime Software assume responsibility for any expense, damage or loss caused by your use of this software, however it occurs.
All the registered trademarks used herein are registered to whoever it is that owns them. This notification is given in lieu of any specific list of trademarks and their owners.

If you register software by Runtime Software, we will assume that you are doing so having tested the shareware version and ascertained that it's suitable for your hardware and requirements. We cannot provide refunds for shareware registration if you subsequently change your mind.

No portion of the documentation for this software or any of its attendant files may be reproduced in whole or in part in any medium or form of transmission exclusive of the archive file for the software without the express written permission of Runtime Software. You may not modify or patch the software's executable files in any way, including but not limited to decompiling, disassembling, or otherwise reverse engineering the program.

Registering this software buys you a named single-user license to use it in perpetuity, subject to the terms discussed herein. With a named single-user license you are the only user of the license, installed on one computer owned or controlled by you. If you want to have the software installed on more than one computer at the same time, you need to purchase additional licenses. If you want the software to be used by additional users, you need to purchase additional licenses. A single-user license does not permit you to make the registered software available over a network for multiple users to access, to distribute it in any form or to provide it in conjunction with any other product without the express written permission of Runtime Software. The license is not transferable to another party without written permission of Runtime Software. If you have any questions about the software license, feel free to get in touch with us.

If you have downloaded this software or had it given to you on disk to try out, you are allowed to use the limited version of the software for free, in order to use the full version you have to register the software immediately.

You may distribute the software (on CD-ROMs, Books, Catalogs, Internet etc.) as long as you follow each and every one of the following:

1. You distribute only exact, unmodified copies of the original unregistered shareware version of the software incl. the DISCLAIMER.
2. You do not monetarily charge or otherwise request any compensation for any copy, however made, without prior permission from Runtime Software.
3. You include the phrase "Copyright by Runtime Software" with any copy of the software.


Glossary

Attributes

Attributes are usually referring to the DOS attributes Archive, Read/Only, Directory, Hidden, System, Volume. See: Step 3.
In NTFS attributes are structures entirely describing a file.

Boot record

A Boot record is a special sector describing the file system following this sector.

Cloning a drive

Making an exact sector-by-sector image of a drive. This is recommended when you want to perform a data recovery on a drive that has physical damage (bad sectors). With the image you can work as you could work with the original drive.

Cluster

A cluster is the smallest unit addressable by the file system. A cluster is always a multiple of a sector. Typical cluster sizes are 1, 2, 4, 8, 16, 32, 64, 128 sectors.

Cluster region

This term is meant to refer to the area of the file system that is addressable by a cluster number. These are - in a FAT file system - the sectors following the Boot record, the FATs and the Root Directory (FAT12, FAT16 only).

Data recovery

The process of retrieving files from a drive that cannot be accessed from its operating system anymore.

Deleted file

A file is deleted in a FAT file system by overwriting the 1st character of its directory entry with xE5 and by releasing the FAT entries of the clusters it used. In NTFS a file is deleted by marking its reference in the MFT as unused. Change the Options if you want to include deleted files in the recovery. See also: Deleted files.

Directory

In a FAT file system a directory is a list of directory entries. In NTFS a directory is a list of Index Entries.

Directory Entry

In a FAT file system a directory entry is a 32 bytes area containing file information such as file name, date, size, first cluster.

FAT

The FAT (File Allocation Table) contains the allocation information of the files in a FAT file system. There are three kinds of FATs:

12 bit FAT (FAT12) | can address up to 4096 clusters
16 bit FAT (FAT16) | can address up to 65536 clusters
32 bit FAT (FAT32) | can address up to 4294967296 clusters

The file system maintains two copies of the FAT: FAT1 and FAT2.

FAT file system

Name of a file system using a "file allocation table". Introduced with DOS and used in all Windows versions.

File system

The file system (such as FAT or NTFS) is the scheme how a file is store on a disk. Do not confuse it with the operating system (such as Windows95 or WindowsNT).

Hexadecimal

The hexadecimal system is based on the number 16, other than the decimal system which is based on 10. The supplemental digits are A, B, C, D, E and F. Example: hex AA = dec 170. (10*16 + 10*1).

Image File

An image file is a sector-by-sector copy of a drive. It can be used as a source for GetDataBack.

LFN

A LFN (Long file name) was first introduced in a FAT file system with Windows95. A LFN uses several directory entries making up the long file name used in Windows95.
NTFS uses attributes to store the LFN.

Logical Drive

Logical drives are drive like A:, B:, C:, ... They are accessed using the according operation system routines.

Lost File

Lost files are files without any directory information left.

Media Descriptor

Flag byte in the boot record and the beginning of a FAT describing the kind of drive. Usually xF8 for hard drives.

NTFS

File system introduced with WindowsNT, used by Windows NT, Windows 2000 and Windows XP. If you want to recover an NTFS partition, check out our GetDataBack for NTFS at http://www.runtime.org/gdb.htm.

Partition

A partition is a continuous region on a physical drive. It is usually interpreted by the operating system as a logical drive.

Partition Entry

A partition entry describes type, location and size of a partition.

Partition Table

The partition table is a list of partition entries located in sector 0 of a drive. If a drive contains "extended partitions", there is a linked list of several partition tables on the drive.

Physical Drive

Physical drives are tangible media like hard drives and diskettes. They are accessed through low-level BIOS functions.

Recovery Tree

Explorer-style view displaying all recovered files and folders. See Step 3, Load and Save Recovery.

Root Directory

A file system's root directory constitutes the root of the directory tree.
In FAT12 and FAT16 the root directory is located in the region that follows the second FAT. In FAT32 the root directory begins with the cluster specified in the boot record.
In NTFS the root directory is described by the index buffer of MFT entry #5.

Scan

A scan is the process of examining every single sector of a drive. See Step 1, Load and Save Recovery.

Sector

A Sector is the smallest unit that can be accessed on a drive. The size of a sector is always 512 bytes. Multiple sectors are grouped to "clusters".

Sectors Per Cluster

This term describes the cluster size the file system is using. It is essential for translating a cluster number into a physical sector number.

Template

A template is a file system definition that can be used on known file system structures, such as floppies, Zip drives, etc.


Prepare a Recovery

Doing a Data Recovery

The following describes a typical data recovery:

  1. Install GetDataBack on a healthy Windows machine without the drive attached you want to recover from. Make sure you have sufficient space on the "good drive" for storing the recovered data. You also can copy the recovered data to an LAN if you have access to one. The machine you are running GetDataBack on can have any of the following operating systems: Windows95/98/ME, Windows NT, W2K, Windows XP.

  2. Shut down the computer and attach the drive you want to recover from ("bad drive") as a 2nd drive. You might need to jumper it differently. Make sure it is recognized correctly by the BIOS when starting up the computer.

  3. Start GetDataBack and verify that HD128: is the "good drive" and HD129: is the "bad drive". Perform Steps 1 to 3 of the recovery process for the "bad drive" HD129:. Please follow the instructions provided with the particular steps.

  4. When Step3 completed and you are ready to copy the recovered files over to the "good drive", you need to purchase a license key if you have not already done so. Do not quit GetDataBack for purchasing or entering the license code, just enter the code and continue with copying the files. It is a good idea to start with the files you need most.

  5. After copying all desired files, shut down the computer and remove the "bad drive". Store the "bad drive" in a safe place.

  6. It is recommended to build a brand new system now. Use components other than the "bad drive". Install the operating system. Install the programs from their installation cd-roms. Finally import the recovered data to the new drive.

  7. Verify you got back all the data you need. Do not recycle the "bad drive" before you are absolutely sure about this. It is a good idea to wait 4 weeks before re-using the "bad drive". If the "bad drive" had any mechanical problems you definitely must not use it again.

If you notice any mechanical problems with the drive, such as bad sectors or unusual noise, you should stop the recovery and make a drive image first. When successfully created, you can recover from this drive image as you would recover from the original drive. A mechanically damaged drive can fail entirely every second. It must be your primary goal to pull all raw data off such a drive as fast as possible. Making an image also reduces the load on the drive because each sector is read only once. Professional data recovery companies always make an image of the drive before trying to retrieve any files.

If you divert from the process described above, make always sure you

  • never install GetDataBack on the "bad drive",
  • never use the "bad drive" as the boot-up system drive (C:),
  • do not have temporary files and folders use the "bad drive",
  • never copy the recovered files to the "bad drive",
  • make an image first if the "bad drive" has mechanical problems.

GetDataBack gives you lots of options: You can recover from the actual hard drive, from image files or even from remote drives over a serial cable or TCP/IP. You even can recover over the Internet or by creating a WinPE/BartPE boot disk.

See also: F.A.Q., Support, Check List


Step 1

Step 1: Select Drive

In Step 1 you will now select the drive you want to recover the data from. All accessible drives and devices will be displayed under available drives on the left hand side. When you select a drive or partition you'll be given additional information (e.g. the geometry and the number of sectors) about the you drive you selected below under Details.

Which entry to choose?

Since oftentimes the original partitioning is not consistent anymore, it's normally best to scan the whole physical drive.

You should prefer physical drives over logical drives, because logical drives are already interpreted by the operating system. Very often you don't even see a logical drive that might contain the data you want to recover. Physical drives provide the most undisturbed low-level access to the raw data of the drive.

When recovering deleted files, you may choose the partition which contained these files before they where deleted instead of the whole drive - but only if the original partitioning is still intact.

Physical Drives

All available physical drives will be listed with all their partitions underneath - click on the plus sign to see the partitions. The physical drives are named by their BIOS number: FD0 is the 1st floppy drive, FD1 is the 2nd floppy drive, HD128: is the 1st hard drive, HD129: is the 2nd hard drive etc.

Logical Drives

All logical drives in your system will be shown with their assigned drive letters (A:, B:, C:, ...).

Image files and remote drives

You can also load an image file or a remote drive by pressing the corresponding buttons.

If the image file is an image of a physical drive all partitions will be shown too and you can treat it like a physical drive.

Remote drives are physical drives on another computer, accessed through a serial cable or TCP/IP. They are treated like physical drives.

Virtual Images (RAIDs)

You will probably load a virtual image if you want to recover a broken RAID array. Virtual images are simple text files describing the RAID. If you know the specifics of your RAID you can create this file yourself. Usually you would use the virtual image file generated by Runtime's RAID Reconstructor.

Now select the drive or partition you want to recover and press Next.

GetDataBack will now scan the drive and the recovery process will be in full swing.

Depending on the size of the drive this process can take from a few minutes to several hours. Don' t interrupt this process unless you have to - you would have to do the scan all over again.

Doing a multi-partition recovery

When you have to recover data from a drive that had more than one partition on it and you need the data from all of those partitions, please read the following.

Since GetDataBack performs recovery on a partition level the general rule is:

Select an entry that completely contains the partition you want to recover. The chosen entry must not be a subset of this partition. It must be a superset instead.

Examples:

You want to recover: Select this entry:
2nd drive that contained one partition 2nd hard drive (HD129:)
1st partition of 2nd drive (40GB) containing 4 partitions with 10GB each. The tree is looking like this:

(1) 2nd hard drive 40000MB (HD129:)
(2) + 1st partition (FAT32) 10000MB
(3) + 2nd partition (DOS Extended) 30000MB
(4) + 1st partition (FAT32) 10000MB
(5) + 2nd partition (DOS Extended) 10000MB
(6) + 1st partition (FAT32) 10000MB
(7) + 2nd partition (DOS Extended) 10000MB
(8) + 1st partition (FAT32) 10000MB

Entry (2) is the entry you should choose.

If you want to recover other partitions as well, select entry (4) for the 2nd partition, entry (6) for the 3rd partition and entry (8) for the 4th partition.

You also can select entry (1) and all 4 partitions will show up in Step2. However, it is recommended to recover the partitions one by one, if possible.

Same example as above, but the tree is looking like this:

(1) 2nd hard drive 40000MB (HD129:)

The partition table is obviously damaged. Therefore you must choose entry (1) and all 4 partitions will show up in Step2.

You can manually apply a sector range in Partial Scan on the right side in order to make the selected range fit more. Experts only!

Usually you should pick the FAT partition as the source to perform the data recovery on. Only if the right partition (with the approx. right size and position) is not shown, use the DOS extended partition or the whole drive.

Note: Choosing a certain partition is nothing more than choosing a certain start and end sector to be scanned on the particular drive.

Partial Scan

Click on Partial Scan on the right side of the screen if you want to restrict the area of the drive that GetDataBack will include in the scan.

Please understand that you should change the sector range only if you exactly know what you're doing.

Normally the range is already set correctly and you don' t have to change anything.

Narrowing the sector range to be scanned to the area the file system was located will speed up the recovery and will enhance the recovery results.

However, do not alter the sector range to be searched unless

  • the partition you need to recover wasn't shown correctly in Step1 and you therefore had to check the whole drive,
  • or if the preset sector range doesn't seem right and you know where the partition approximately was located.

To do so, select "Search partial drive" and insert the starting and the ending sector of the drive or partition. In case you don' t know the exact range rather enter a wider than a smaller range: The selected range must completely contain the partition you want to recover.

File System

Normally the software doesn't have a problem detecting the right file system, but just to be sure, check that the right file system of the drive you want to recover is selected. If it's not, choose the right file system type from the pull-down list:

  • FAT12 is usually associated with floppies and hard drives not larger than 16MB.
  • FAT16 is used on hard drives in all DOS versions, Windows 2.xx, Windows 3.xx and early Windows 95 and NT versions. Maximal partition size is 2GB.
  • FAT32 is usually used on hard drives larger than 512MB in Windows95 (OEM Rel. B), Windows 98, ME and FAT-formatted drives in W2K and XP.

Template

If you know exactly the file system parameters you can provide a Template to support the recognition of the file system. Otherwise, select "none".

See Current Options

Open this tab to see the currently set options.

Load Scan

Press the Load button below if instead of scanning a drive or partition you want to load a previously performed scan or data recovery.

See also: Drives, Scanning the drive


Drives

Besides physical and logical drives, floppy drives, Jaz and Zip drives, GetDataBack accepts image files and virtual images as a data sources to perform a recovery on. GetDataBack accepts five different kinds of data sources to select from:

  • Physical drives
  • Logical drives
  • Image files
  • Remote drives
  • Virtual images

See also: Step 1


Physical drives

Physical drives are tangible media like hard drives and diskettes. They have specific names:

FD0 | 1st diskette drive
FD1 | 2nd diskette drive
HD128 | 1st hard drive
HD129 | 2nd hard drive

These drives can have partitions you may select. If you do so only the part of the drive ("window") that constitutes that partition is visible for GetDataBack. If possible, you should select such a partition as the entity GetDataBack's scan is performed on. If you do not see any partition entries you should select the entry with the [image] Symbol.

See also: Drives, Step1


Logical drives

Logical drives are volumes known to the operation system as A:, B:, C: etc..

You may choose this in order to explore such a volume. An alternative access to these drives is selecting a partition in a physical drive.

See also: Drives


Image Files

Image files are files containing raw images of a drive. You can recover from an image file as you can from a physical or logical drive. Click Image file (Load more) in Step1 to open an image file as a drive.

Even partitions you can see within physical drives are displayed when contained in the image file.

Clone an entire drive

You can create image files using the Tools->Create image file command. You may use the image file instead of the original drive. You also can use image files created with other software, such as Runtime's DiskExplorer.

Multiple Files

Image files can consist of:

  • one file (e.g. 'drive128.img')

  • multiple files (e.g. 'drive128.img', 'drive128.001', 'drive128.002', ...)

This is helpful when imaging a drive larger than the maximum file size (2GB or 4GB, depending on the operating system). Fragments of a multiple file image are about 656MB in size. A smaller size indicated the end of the file set.

Compression

You can use compressed image files (e.g. 'drive128.imc') by selecting 'Compressed image data files (*.imc)' as file type in the file open dialog. This feature enables you to create drive images much smaller than the original.

Compressed files can be multiple file images too.

See also: Drives, File Open and File Create


File open and file create

This dialog requires a file name to open or create.

You can choose between the following File types:

  • Image files (IMG) are raw copies of drives.
  • Compressed image files (IMC) are compressed raw copies of drives.
  • Virtual images (VIM) (read/only) are scripts describing an arrangement of several other kinds of drives.

Image files and compressed image files come in two flavors:

  • Multiple file unchecked stores the data in one single file.
  • Multiple file checked stores the data in multiple files with 656MB each. This makes the image more handsome and helps to overcome restrictions on file sizes.

See also: Drives


Virtual images

Virtual Image

*

Virtual Images are short text files describing the data to be loaded. Thus, you can "glue" together different data sources. This is especially helpful if you want to recover RAID arrays. For example, Runtime's RAID Reconstructor creates virtual images that you can use here.

Virtual images always use the extension "vim".

You can also create your own virtual images. Virtual images are XML files with just a couple of commands ("tags"). You can put together any number of drives, as long as the total capacity does not exceed 2 TB.

<virtualimage>

This is the root tag that encloses all other tags.

Example:

<virtualimage>
:
:(other tags)
:
</virtualimage>

<sector>

This tag sets the sector number of the virtual image to a new value. Any gaps you create by that will be filled with 0's.

Example:

<virtualimage>
:
  <sector>1000</sector>
:
</virtualimage>

<drive>

This tag describes a drive that is being used. You can also specify a certain area inside that drive.

Example:

<virtualimage>
  <drive>HD128:</drive>
</virtualimage>

This example of a virtual image uses your first hard drive (HD128:). Make sure you always append a colon to the drive's name.

Another example:

<virtualimage>
  <drive>HD128:0-999</drive>
  <drive>c:\images\myimage.img:1000-</drive>
</virtualimage>

This example maps the first 1000 sectors of HD128 to your virtual image. Sector 1000 and up of your virtual image will come from sector 1000 and up of the image file "c:\images\myimage.img". The ranges are specified by appending two numbers, separated by a dash. If you leave out the second number, the range will extend to the end of the respective drive.

Possible drives names are:

HD128:, HD129:, etc | 1st, 2nd physical drive etc.
FD0:, FD1: | 1st, 2nd floppy drive
C:, D:, etc. | Logical volume C:, D:, etc.
myfile.img, myfile.imc | Image files
NULL: | Virtual drive, delivers empty sectors. Must be followed by a range.

<loop>

Use the <loop> tag to define RAID arrays.

Example definition of a 3 drive RAID-5 with a block size of 128, backward rotation:

<virtualimage>
  <loop>
    <drive>c:\img\raid5\r1.img:</drive>
    <drive>c:\img\raid5\r2.img:</drive>
    <drive>c:\img\raid5\r3.img:</drive>
    <cycle blocksize="128">
      <stripe>1,2</stripe>
      <stripe>1,3</stripe>
      <stripe>2,3</stripe>
    </cycle>
  </loop>
</virtualimage>

After the introducing <loop> tag, specify the drives you will use in the RAID. On the syntax of the <drive> tag see the specification above.

In the <cycle> tag, define the stripes making up the RAID. Each stripe is a sequence of data taken from the previous defined drives. Define the block size as an attribute for the <cycle> tag. You would read the example above as:

  1. Take 128 sectors from the 1st drive (sectors 0-127).

  2. Take 128 sectors from the 2nd drive (sectors 0-127).

  3. Take 128 sectors from the 1st drive (sectors 128-255).

  4. Take 128 sectors from the 3rd drive (sectors 128-255).

  5. Take 128 sectors from the 2nd drive (sectors 256-383).

  6. Take 128 sectors from the 3rd drive (sectors 256-383).

This continues until the end of one drive has be reached. The smallest drive determines the size of the loop. If the smallest drive is 10000 sectors, the total size is 20000 rounded up to a full cycle, which is 20736. You can change the size of the loop in two ways:

1) Specify the number of times the loop should be repeated. You can do this by adding an attribute with the name "repeat" to the <loop> tag, e.g.: <loop repeat="27">. In the RAID example, repeating the cycle 27 times will yield 6*128*27 sectors, which is 20736.

2) Specify a range. Do this by adding the attribute "range" to the <loop> tag, e.g.: <loop range="10-20".

The "repeat" takes precedence over the implicit size as determined by the drives. The "range" takes precedence over the "repeat".

You can even define incomplete RAID-5 arrays. If, in the example above, the 3rd drive would be missing, you could describe the array like that:

<virtualimage>
  <loop>
    <drive>c:\img\raid5\r1.img:</drive>
    <drive>c:\img\raid5\r2.img:</drive>
    <cycle blocksize="128">
      <stripe>1,2</stripe>
      <stripe>1,1x2</stripe>
      <stripe>2,1x2</stripe>
    </cycle>
  </loop>
</virtualimage>

The expression 1x2 will calculate the missing sector, originally on the 3rd drive.

See also: Drives


Remote Drive Access

Remote Drives

This feature enables you to run the GetDataBack on one computer ("remote") while accessing the drives of another computer ("host").

The "remote" computer runs GetDataBack, the "host" computer runs HDHost. HDHost is a program available for download at http://www.runtime.org.

On the host side call the program HDHOST.EXE and configure the desired connection. When done click Wait for connection.

On the GetDataBack side click on Remote Physical Drives (Load more...) in Step1. A new window will pop up requesting you to select and configure the kind of connection. When done click Connect and another window will pop up displaying the available physical drives on the host computer. Select one and you are back in the drive selection screen. Click Ok and the remote drive is loaded.

You can establish a two different kinds of connections:

  • Serial communication through RS232 (Com port)
  • TCP/IP communication through a network interface card (NIC)

Serial communication is quite slow, therefore you will probably prefer TCP/IP. However, serial communication is easier to setup and every computer is equipped with a serial port.

Serial Communication

Serial communication requires a Null-Modem Cable connecting both computers through the COM port. On both sides select the port number this cable is connected to. Both sides must use the same Baud rate.

TCP/IP Communication

TCP/IP communication in a LAN requires a network interface card (NIC).

As the Connection choose the IP that is associated with your NIC. If this computer does not get an IP address assigned by a DHCP server you might need to assign a static IP address in the Windows network configuration. A typical address is 192.168.1.51 for this machine and 192.168.1.50 for the host.

As the IP of host choose the IP of the host's connection. You might need to specify a static IP address (e.g. 192.168.1.50) in the Windows network configuration of the host computer.

Tips:

  • If you have problems connecting try to PING between host and remote. Go to the command prompt and type ping 192.168.1.50 on this computer. Try ping 192.168.1.51 on the host computer. (This assumes that 192.168.1.50 is the host's IP and 192.168.1.51 this computer's IP). The ping must be successful on both sides.
  • Disable all Firewalls.

See also: Drives


Templates

The use of templates is usually not necessary, because GetDataBack is supposed to detect the file system automatically. In rare circumstances - such as floppies containing only a couple of files - the automatic detection can fail and the use of a template might be recommended.

In case you know exactly the file system parameters of the drive you want to recover, you can provide a Template to support the recognition of the file system.

A few templates (for 1.44 MB floppy drives and a couple of Jaz and Zip drives) are already available in GetDataBack.

To create new templates open the GDB.INI file. The location of the GDB.INI is stated in Help->Version Info.

Go to the Templates section of the GDB.INI and enter the file system parameters in the following order (separated by comma):

  • Name of the template (free choice)
  • Location of the file system (Sector Number of the boot record)
  • File system (FAT12, 16 or 32)
  • Number of reserved sectors (this value can be obtained from the boot record)
  • Cluster size (this value can be obtained from the boot record)
  • Number of total sectors (this value can be obtained from the boot record)
  • FAT Length (this value can be obtained from the boot record)
  • 1st root directory cluster (this value can be obtained from the boot record), applies only to FAT32, for FAT12 or 16 enter 0
  • Number of root directory entries (this value can be obtained from the boot record), applies only to FAT12 and 16, for FAT32 enter 0

Example:

1GB-Jaz w/Fat16 as physical drive=32,16,1,32,2088928,255,0,512

The creation of templates requires some experience and a good disk editor such as Runtime's DiskExplorer.


Scanning the Drive

The "Scanning drive" window will give you information about the recovery process.

You can see:

  • the current process
  • the source of the recovery with the sector range to be scanned
  • the number of already identified directories and files
  • the number of boot records found
  • the sector which is currently examined
  • the remaining time the scan will take and a progress bar indicating the percentage of the drive already scanned.

Press Escape or click Stop if you want to abort this process. If you abort this process you are offered the option to go back to Step 1 or to continue the recovery with a partial scan. It is not recommended to continue the recovery with a partial scan because GetDataBack yields the best results if the whole drive was examined.


Step 2

Step 2: Select File System

After the scan is complete, the file systems GetDataBack has found are displayed on the left side of the window.

You'll see the recommended entry (the one that the software thinks represents the file system you want to recover best) on top and underneath in most cases a list of more possible file system entries.

Try the topmost (recommended) enty first, and go back to Step2 and try more file system entries only

  • if this file system doesn't come close in size or geometry to the original partitioning on you drive,
  • or you don't see your data in Step3 of the software,
  • or the files won't open correctly,
  • or if you need to recover more than one partition on the same drive.

Don't be confused, if you see a whole bunch of file systems! GetDataBack conducts a very thorough scan of your drive, and particularly when you have scanned a large drive with more than one partition, or a drive which was re-partitioned, the software can find many possible file system starts.

By default the most accurate file system is displayed on top of the list. The sort order of this list is determined by the data matches of each file system. The higher the position the more recoverable files can be expected.

Another value to look for is the quality of a certain file system. You can interpret this number as how the files inside are covered by this certain file system structure.

  • A green dot usually indicates a good file system with potentially high quality recovery results,
  • the file systems with a yellow dot can also produce very satisfactory results (especially if no green dot file systems show up),
  • the file systems with a red dot are not very promising, unless you are recovering from a drive that was nearly empty.

But take a closer look! Which of the file systems in the list comes closest - in terms of the size of the partition, the cluster size and the file system type - to the file system you want to recover? Pick this one.

The file system details on the right side of the screen can give you additional information about the quality of the file system.

Now select the file system you want to get displayed in the recovery tree and press Next.

GetDataBack now will create the tree of the recovered directories and files. Depending on the size of your drive, this can take its time, but will be much faster than the scan. Do not stop this process unless you have to.

Pressing Back in Step2 will take you back to Step1. You would have to do the scan all over again when you resume the recovery from Step1 unless you save the scan while in Step2.

See also: File System Details, Check List


File System Details

The right windows in Step2 gives you additional information about the structure and quality of the detected file systems.

The file system details are structured as follows:

  • Name: The file system type (FAT12, 16 or 32).
  • Cluster0: The position of cluster 0 in the file system.
  • Cluster size: The number of sectors in one cluster. Possible values are:
    for FAT12: 1, 2, 4, 8,
    for FAT16: size of the volume/number of max. possible FAT entries (65535) rounded to the next possible value,
    for FAT32: 8 for 512MB-8191MB, 16 for 8192MB-16383MB, 32 for 16384MB-32767MB, 64 for >32768MB.
  • Total sectors: The total number of sectors in the file system.
  • FAT1: If any: the start sector of FAT1, (the quality of the FAT, defined by the selected file system's range the FAT covers),
  • FAT2: If any: the start sector of FAT2, (the quality of the FAT, defined by the selected file system's range the FAT covers),
  • FAT length: If any, the FAT's length in sectors.
  • 1st root cluster: If any, the start cluster of the root directory (only available for FAT32 file systems).
  • Root dir start: If any, the first sector of the root directory.
  • # root entries: The max. possible number of root directory entries in this file system (FAT12 and 16 only).
  • Total clusters: The total number of clusters in the file system.
  • Min clusters used: The min. cluster range where data was found by the scan.
  • Max cluster used: The max. cluster range where data was found by the scan.
  • Data matches:
  • Total number of matches of dir starts with file starts. This number determines the order of the file system list in Step2. The higher this value, the larger is the number of probably recoverable files.
  • Debug info: B stands for boot record found, B0 for example means, that at least one boot record was found. D stands for directories found, the following number states the number of directory structures found.

Should one of these values seem to be absolutely unreasonable, this could indicate that the quality of this file system is not very good and you might want to have a look at other file systems in the list (if there are any other).

File System Quality: The little bar-code-like graphic in the right bottom half can tell you even more about the quality of each file system:

Displayed are:

  • Dir starts: Cluster areas where found directory entries are pointing to.
  • File starts: Cluster areas identified to be a start of a file.
  • FAT1 starts: Cluster areas where a beginning of a chain in FAT1 is pointing to.
  • FAT2 starts: Cluster areas where a beginning of a chain in FAT2 is pointing to.

The more the marks in these rows are in correspondence, the "better" the file system is. The percentage of corresponding file starts to MFT starts is indicated beneath those rows. Don' t be disappointed, if this doesn't come near to 100%. It never does, due to the fact that GetDataBack conducts a very thorough scan of the drive and always finds some kind of orphan data which could be associated with a file or MFT start.

The percentage is defined as:

100 * Matching_File_Starts / Dir_Starts

where

Matching_File_Starts is the number of sectors identified as a file start AND a sector a directory entry points to,
Dir_Starts is the number of sectors a directory entry points to.

There are always file starts that cannot be identified, therefore this value will usually not reach 100%. Even a low value like 30% can generate a perfect data recovery.

See also: Step2, Check List


Step 3

Step 3: Recovery Tree

On the left side of the screen you see the recovery tree, consisting of the recovered directories and folders and a "lost files" folder created by the program, containing the files without directory information.

When you open a folder on the left side, the files in this folder are displayed on the right side - much as you know it from the Windows Explorer.

Copy

Now tag the files or directories you want to copy. Push the copy button and a window will pop up where you can choose the destination to copy the files to. This destination can either be another hard drive, a local network drive, a Zip or Jaz drive, or a floppy drive. Never copy the files to the drive or partition you recovered the data from.

You can copy the entire directory tree by selecting the entry [FAT] on left side. If you want to copy selected directories or files you can select them in the right window. In the right windows you can hold the CTRL key to choose multiple files or directories.

Duplicate entries: When you copy duplicate file entries (previously enabled in Options), you will be be asked to either overwrite, skip or rename these files. If you choose "skip" or "overwrite" you can end up with file versions that are not necessarily the ones you wish to recover. You should choose "rename" instead and later sort out which files are the most current versions. Alternatively you can switch off "duplicate files" in the Options menu.

While you can see all your recovered files, use the viewer, the search function and the file information feature in the unregistered version. Copying files to a safe medium requires that you register the software. Registering is very quick and very easy. You don' t have to conduct the recovery process all over again, just enter the registration key while you are in Step3 and the copying will be enabled.

Quality of the Recovery

Don' t feel insecure about the recovery results after copying the files. In most cases what you see in the recovery tree is what you get after copying the files. That means, if you can see your files in the recovery tree and they look alright, they most likely will be alright after saving them.

However, it is recommended to check several files. Use the following features of GetDataBack to verify the quality of the recovery:

  • View the file (F3)
  • Open the file with its native application
  • Investigate the file information for the file

It can happen, that you have folders in the recovery tree which look similar to this one: (1229BD). This means that the root directory entry for this directory was lost and the directory name could not be retrieved. The subdirectories (if there are any) and the files in the directory should nevertheless be in order.

Particularly in the "lost files" folder you will find files which look like this: #345HD33.doc This is due to the fact that these files were recovered without any directory information. Therefore the original file name could not be restored. The file extension though should be correct and can give you at least some information about the file.

If you have problems opening the recovered files please see our check list .

Save a recovery

To save your recovery for further use click File->Save Recovery and choose a file name. Never save this file to the drive or partition you recovered the data from.

This feature does not save the recovered files. It saves the structure of the recovery tree only. To save the recovered files see Copy .

Sort

Sort the files on the right side by size, name, attributes, creation date and so on by clicking on the corresponding column header.

Open

Open files by double-clicking the file, clicking the open button or pressing Enter. When possible the file will be opened in its native application. Otherwise you can choose the application to open the file with.

Clicking the Open with button or pressing Ctrl-Enter will allow you to choose the application to open the file with.

View

Use the viewer to have a first look at the files you recovered. Select the file you want to examine and press the view button or F3. The viewer is able to display the file content for various file types (.txt, .doc, .bmp). Where the file type is not supported the file content will be shown in hexadecimal format.

Rename

If the right file names didn't come up (for instance because the root directory information was destroyed), the rename property lets you rename these files before copying them. Select the file or folder you wish to rename and press F2. Of course you can also rename the files after you have copied them to a safe location.

Search

GetDataBack includes a file search function. Hit the search button and give in the search term.

Appearance of the file names - Attributes

Appearance | Meaning
filename.ext | normal file or directory
filename.ext | read/only
filename.ext | system
filename.ext | hidden
filename.ext | compressed
filename.ext | deleted

Deleted files

Recovered deleted files can be found in the directory where they were originally located. They are marked by a crossed-out file name. If you are looking for files from an emptied recycle bin you should look below the RECYCLE folder. Note that files inside the recycle bin do not longer have their original file names. However, they still have their original extension.

File information

Should you wish to dive deeper into your recovery you can have a look at the file information. Select the file you are interested in and click the file info button or CTRL-I.

Runtime's DiskExplorer

Select a file or folder and call Runtime's DiskExplorer. This program will give you low-level access to the directory entry of the selected file or folder.

Pressing Back in Step3 will take you back to Step2. You would have to do the creation of the recovery tree all over again when you resume the recovery from Step2 unless you save the recovery while in Step3.


File

File information

View detailed information about a file or folder displayed in the recovery tree by selecting the file or folder and clicking Recovery->Show info or the info button.

Information provided are:

  • Name: The display name of the file or folder.
  • Short name: The short name of the file or folder.
  • Long name: The long name of the file or folder.
  • Type: The type (directory or file).
  • Attributes: The attributes (a = archive flag, r = read only, h = hidden, s = system, l = volume name, d = directory, c = compressed).
  • Size: For files= the size of the file in bytes, for directories= the number of directories and files in this directory, the size of the directory.
  • First cluster: The first cluster of the file or folder.
  • Last modified: The date/time the file was last modified.
  • Created: The date/time the file or folder was created.
  • Last accessed: The date the file was last accessed.
  • Allocation by: Internal debug info.
  • Found at cluster: The cluster where the file or folder entry was found.
  • ID: Internal debug info.
  • Clusters used: The cluster(s) where the data of the file or folder are located. The number in parentheses shows the number of continuous clusters used. For example: 00E6(3), 00EA(6) means that the data was allocated by using cluster 00E6 and the following two cluster and cluster 00EA and the following five clusters.
  • Sectors used: The sectors(s) where the data of the file or folder are located. The number in parentheses shows the number of continuous sectors used. For example: 1102(4), 1166(4) means that the data was allocated by using sector 1102 and the following three sectors and sector 1166 and the following three sectors.

See also: Runtime's DiskExplorer for FAT


View File

The View File feature is able to display many text files (.txt, .doc, .rtf, .wri), many graphic files (.htm, .jpg, .bmp, .ico, .wmf). Binary and unknown formats will be displayed in a hex viewer.

Highlight the file you want to view in the recovery tree and click Recovery->View in the Main Menu.

See also: Step3


Save and Load Recovery

Note: Never save any files to the drive you are about to recover!

Save and Load a Scan

After the scan of the drive is complete you can save this scan in Step2 for future use. Just click File->Save Recovery and choose a destination. The resulting file will have the extension .ST2.

To load a scan proceed to Step1 and select the drive like you did in the previous run, but click the "Load" button in the bottom left of the screen. That way you don't have to do the scan all over again. This might be useful in case you are not satisfied with the recovery results and want for example choose another file system from the list in Step2.

After clicking Load, select the first option if you want to load a drive scan and rebuilt the file system list. Hit Ok and select the Step1 results file ~GDBSAVE.ST1. This file is created by the program in the default temp directory and contains the most recent scan. You cannot save the Step1 results directly from within GetDataBack, but you can always rename this file to save it for further use.

Select the second option if you want to load a file system list and go directly to Step2. Hit Ok and select the right .ST2 file.

Save and Load a Recovery

After the recovery tree is complete you can save your recovery for further use in Step3. Just click File->Save Recovery and choose a destination. The resulting file will have the extension .ST3.

To load a recovery proceed to Step1 like you did in the previous run, click the "Load" button in Step1, choose the third option, hit Ok and select the .ST3 file.


Options

The Options menu has two tabs, Recovery and Environment.

In the Environment tab you can define

  • the default save directory, that is the directory where the recovered files will be copied to,
  • the default temp directory, that is the directory where files necessary for the recovery, the scan file and the log file will be saved,
  • a file name for the log file, if you want the software to create one,
  • the location of Runtime's DiskExplorer, if you have downloaded it and want to call it during the recovery process.

Never specify a directory that is located on the drive you are going to recover!

In the Recovery tab you'll see the options that were preset (recommended) by the selection you made regarding your data recovery scenario in the Intro screen. You may also set/change the following options manually.

Checking "Allow duplicate file names" will cause the program to accept more than one file with the same file name in one directory. These file names might be different versions of the same file. If this option is not checked, GetDataBack will use the most recent entry. To be effective, this option must be set in or before Step2.

Check "Recover deleted files" if you want to include deleted files and directories in the recovery. Note: If you check this option, but uncheck the "Allow duplicate file names" option, GetDataBack will choose the most recent entry - regardless if it is deleted or not - if it encounters duplicates. To be effective, this option must be set in or before Step2.

Check "Recover lost files" if you expect to have files without any directory information at all on your disk. By default don't check this box, because especially when recovering a large or repartitioned drive you might get a lot of rubbish you probably won't need. To be effective, this option must be set in or before Step1.

Using the "Excessive search" feature will slow down the recovery process, so check it only if the desired file system is not displayed in Step2 - especially on media with very few data or directory information on it - like floppies. Checking this feature will yield more entries in Step2.

To insure a high quality of recovery results GetDataBack is designed to kick out information which might look like directories, but most likely aren't. So check "Allow bad directories" if you have the feeling that files or directories are missing in the recovery tree or if you want the program to interpret even less promising directory information. To be effective, this option must be set in or before Step1.

Checking "Ignore Fat" will cause GetDataBack to allocate files without using an eventually found FAT. This can be useful when the found FAT does not reflect the file system you are currently recovering. It is better to use no FAT than using a FAT containing false information. Check this box only if you are not satisfied with the results in the recovery tree (Step3). To be effective, this option must be set in or before Step1.

In addition you can decide how you want the software handle bad sectors - if it encounters any during the scan. Bad sectors are spots on your drive that are physically damaged and cannot be read or interpreted by software means anymore. Sectors are read in chunks of 16 sectors. If this operation fails this might be because of a single bad sector or of several bad sectors.

You have the choice:
Skip block - all 16 sectors are considered bad. No attempt is made to retrieve possibly good sectors.
Retry each sector - the program retries reading the sectors one by one. This gives the chance to retrieve possibly good sectors in the neighborhood of a bad one. However, this can be very time consuming, especially if there are not good sectors at all.

The "Excluded files" field allows you to exclude specified files from the recovery. Usually, you should leave this field empty. Only special circumstances, such as memory problems, justify the exclusion of certain file type. If, for example, you want to exclude TMP and BAK files you would specify:

*.tmp;*.bak

Set this option in or before Step2.

Pressing Reset to default will reinstate the recommended settings for the scenario you specified in the Intro screen.


Search

GetDataBack provides a comfortable file search function. To search for files or folders click Tools->Search files.

The File mask field expects a file name mask, such as *.* or *.doc.

Three different kinds of filters are available:

  • Date: Specify a start and end date and only files or folders with a modification date within this range will show up.
  • Size: Specify a size range and only fitting files will show up.
  • Type: Specify if you want to search for deleted files, not deleted files or both. Note: you must have included deleted files in the Options before the recovery tree was build.

The Search depth field determines how deep GetDataBack will search inside the directory structure. A value of 8 means it will search up to 8 sub-directories.

Clicking Start will search the whole recovery tree according to your settings.

You can Stop the search at any time.

On completion of the search you can inspect the found files and folders in the lower window. You can do pretty much the same things you can do in the recovery tree: view, open, info, sort, copy, etc.

The Sync button brings you to the position of the file in the recovery tree.

The New button clears the current results.


Bad sector

Bad Sectors Handling

An error was encountered during a sector block read operation.

Sectors are read in chunks of 16 sectors. If this operation fails this might be because of a single bad sector or of several bad sectors. Depending on the settings in options the program will:

Skip sector block

All 16 sectors are considered bad. No attempt is made to retrieve possibly good sectors.

Retry accessing single sectors

The program retries reading the sectors one by one. This gives the chance to retrieve possibly good sectors in the neighborhood of a bad one. However, this can be very time consuming, especially if there are not good sectors at all.

See also: Options


Runtime

Runtime's DiskExplorer

Runtime's DiskExplorer for FAT is a powerful disk editor, which enables you to

  • navigate through your drive by using browser-style back and forth arrows, by going directly to the partition table, boot record, FAT or root directory, by jumping to a certain sector etc.,
  • switch between several views, such as hex, text, directory, FAT, partition table and boot record view,
  • search your drive for text, boot records, partition tables and subdirectories,
  • investigate the volume' s boot record by looking at the volume information,
  • edit your drive by using the direct read/write mode (not recommended) or the virtual write mode,
  • view and recover even deleted files,
  • create a virtual volume when you boot record is lost or corrupted,
  • conduct your own data recovery by taking advantage of all these features.

In order to call Runtime's DiskExplorer for FAT directly from GetDataBack download the program from our website at http://www.runtime.org. Install it - however never install it to the drive you want to recover -, then click Tools->Options and specify the location of the DiskExplorer.

Calling DiskExplorer in Step1 will bring you to the start sector of your master drive. As soon as you select a drive or partition in Step1 and run DiskExplorer, it'll take you to the start of the selected drive. In Step2 calling DiskExplorer will bring up the root directory and in Step3 the root directory entry of the selected file or folder.

Registering GetDataBack will not cover a registration key for Runtime's DiskExplorer, this product must be purchased separately.

For more information on Runtime's DiskExplorer please refer to the program's help or to our website.


Lost Files

GetDataBack is able to recover files even when all ttheir directory information is lost. This is possible on condition that the program can recognize those files by their file signature and file extension.

GetDataBack already can recognize a couple of file types, such as DOC-files, BMP-files, RIFF-files, ZIP-files, Help-files.

If you need to recover a lost file with a different file format, define the file format in the GDB.INI file. The location of the GDB.INI is stated in Help->Version Info.

Go to the LostFiles section of the GDB.INI and enter the file parameters in the following order (separated by comma):

  • Name of the file (free choice)
  • File extension
  • File signature length (between 2 and 8 bytes length)
  • File signature (in hex, located at the beginning of the file)
  • Type (reserved for further enhancement, enter 1)
  • Size of the file (if this information is not available in the file header, specify a length large enough to cover the size of the files you want to recover)

Example: Help files

Help files start with the signature $3F,$5F,$03,$00.
Found lost Help files will get the extension HLP in the recovery tree
The size will be determined by the double word found at position 12 in the first sector [12,4]

Help-File= HLP,4, $3F,$5F,$03,$00, 1, [12,4]

For further help refer to the GDB.INI.

The definition of files requires some experience, some research and a good disk editor such as Runtime's DiskExplorer.


Log File

The log file gives you the opportunity to relive what happened to your drive during the recovery process. Every step the program takes is recorded in the log file: the scan for available drives, selection of the source, the selection of the file system and sector range, the scan of the drive, the selection of file systems found and the creation of the recovery tree.

The file states information about the geometry of the selected drive and/or partition, the quality of the file systems found by the program, the sector number and first 8 bytes of found files, the file names associated with located files, the location of directory starts, and the copy process.

In a large recovery the log file can consume quite an amount of storage space. Should you decide to keep a log file of the recovery choose a log file name in the Options while in the Intro Screen.

You can create a short version of this log file with the snapshot feature.

See also: Snapshot, Support


Troubleshooting

These are the most common warnings or errors you might run into:

Access denied

COMCTRL32 outdated

Could not lock drive

DRV16 not found

I/O Error

Bad sector handling

If you get a runtime error, please submit a screenshot to: support@runtime.org.

See also: F.A.Q., Support, Doing a Data Recovery, Check List


Access Denied

Error: Access Denied

This message is displayed if you are trying to

  • open a file that is already in exclusive use by another process or
  • open a file in read/write mode that is write-protected.

See also: Image files


Outdated COMCTRL32

Outdated COMCTRL32.DLL

Your Windows version is using an outdated version of 'COMCTL32.DLL'. This component is an extension of the Windows operating system and comes usually with the MS Internet Explorer.

You will most probably have problems with this program's visual controls (you won't see the buttons). But you should still be able run this software.

It is recommended to download a new version at http://www.microsoft.com/msdownload/ieplatform/ie/comctrlx86.asp or to install a recent version of MS Internet Explorer.


Drive Locking Failed

Warning: Could Not Lock Drive

Locking a drive is a low-level feature for preventing several processes from accessing a physical or logical drive at the same time. You should verify no other processes are accessing the drive. If you Ignore the warning your process will possibly continue, but may cause damage to the data on the drive. Therefore, ignoring is not recommended.

See also: Drives


DRV16.DLL not found

Warning: DRV16.DLL not Found

This message is displayed on startup if the program runs on a Windows95/98/ME system and does not find the file DRV16.DLL.

This component provides physical drive access and is required by this program. You should quit the program and re-install this software.

See also: Physical drives


Read Error

Error: I/O Error

This message is displayed if the program encounters an error reading from a drive. This error is not recoverable, but you can ignore it.

You have the following choices:

Click Yes: the error is ignored and the operation continues.

Click Yes to all: the error is ignored and the operation continues. Future errors will be suppressed and ignored as well; you won't be prompted this message again. This condition is cancelled at the next regular prompt for a user input.

The strategy used when handling bad sectors is set in Options.

See also: Bad Sector Handling, Options


F.A.Q.

GetDataBack for Windows 95/98/ME/NT/2000/XP for NTFS & Fat

Q. Can fragmentation of the disc affect the result of the recovery?

Q. Can I investigate the quality of my recovered files before I buy the software?

Q. Can I use GetDataBack to recover data from CD's, CDR's and DVD's?

Q. Can I use GetDataBack to recover data if my hard drive is not recognized by the BIOS of my computer?

Q. During the scan with GetDataBack I receive a disk error, what does this mean?

Q. How can I optimize the quality of the recovery?

Q. I do not find certain files in the recovery, how do I get these?

Q. I cannot open the recovered files. Why?

Q. I don't know which file system I had on my drive before it crashed. What shall I do?

Q. Is it safe to run GetDataBack on my crashed hard drive?

Q. How do I recover data from a Laptop or Notebook drive?.

Q. Will GetDataBack work on a hard drive larger than 8.2 gigabyte?

Q. How do I recover files I deleted with Windows Explorer?

Q. Can fragmentation of the disc affect the result of the recovery?

A. GetDataBack is searching your hard drive to find one of the FAT (File Allocation Table). If no FAT is found GetDataBack will attempt the recovery without this information. In this case the possibility of bringing fragmented parts from all over the drive together gets smaller.

Top

Q. Can I investigate the quality of my recovered files before I buy the software?

A. Yes, GetDataBack contains a build-in viewer which lets you investigate the quality of your files and you can also open the files with their original application before you have to register the program.

Top

Q. Can I use GetDataBack to recover data from CD's, CDR's and DVD's?

A. No, GetDataBack recovers from hard drives, floppy drives, Jaz drives and Zip drives, USB and Firewire drives, Smart Media cards and Compact Flash cards, but it's not suitable for restoring data from CDs, CDRs and DVDs.

Top

Q. Can I use GetDataBack to recover data if my hard drive is not recognized by the BIOS of my computer?

A. No, if the BIOS is not recognizing the hard drive, our software is not able to perform a recovery. Please make sure that the connections, jumper settings and controllers are ok. If the hard drive is still not recognized, try to connect it to another computer and see if it gets recognized there.

Top

Q. During the scan with GetDataBack I receive a disk error, what does this mean?

A. GetDataBack is a solution for software related problems, it cannot help you with failed hardware. A disk error is a sign for a hardware problem. We recommend to stop working with the corrupted drive until you make a disk image. (Every try to access data can increase corruption !) After successfully creating an image you can use the image file as an input for GetDataBack.

Top

Q. How can I optimize the quality of the recovery?

A. What did you choose in Step1? We recommend choosing the physical drive for your recovery.
In Step2 be sure to choose the file system which contains the most applicable information to perform the recovery on. You can compare the file system quality by viewing the details in the right window. Another indicator for better file system quality is the percentage rating on the right side of the graphic below. Before you register, please test enough files to be sure you are satisfied with the results of the recovery.
Try checking "Allow duplicate file names" in the options. This might bring up different versions of certain files.

See also our comprehensive Check List.

Top

Q. I do not find certain files in the recovery, how do I get these?

A. First please check the recommendations in How can I optimize the quality of the recovery.

Try the "Allow duplicate file names" option. This might bring up different versions of some files.

Try the "Recover lost files" feature.

See also our comprehensive Check List.

Top

Q. I cannot open the recovered files. Why?

A. There are three possible reasons for the inability to open the recovered files.

  1. GetDataBack is searching your hard drive to find one of the FATs (File Allocation Tables). If no FAT is found GetDataBack will attempt the recovery without this information. In case of fragmented files, the chances of bringing all parts together gets smaller. However, only a fraction of the recovered file is usually affected by this problem. Another FAT related problem can occur if GetDataBack find a FAT that is not the file system's FAT. In this case GetDataBack uses misleading allocation information.

  2. Another possible reason is that your files were overwritten by other data. In this case there is no way to retrieve the data.

  3. The third possible reason is that you have chosen the wrong file system entry in Step 2 of the recovery. Be sure to choose the file system that contains the most applicable information to perform the recovery on. You can compare the file system quality by viewing the details in the right window. Another indicator for better file system quality is the percentage rating on the right side of the graphic below.

Recommendations:

Regarding point 1 you should check the beginnings of the bad files with a hex viewer (you can use GetDataBack's build-in F3-Viewer). Compare these file starts with the starts of the same type of files that are readable. The file starts should look "similar". If they do there is a chance of putting together the files manually using a disk editor, e.g. Runtime's DiskExplorer. The file info option in GetDataBack shows you the clusters it uses for the recovery of the certain file.

If GetDataBack was using a false FAT, check the "Ignore Fat" options in the options dialog and re-run the scan.

Check point 3. Re-run GetDataBack and proceed to Step 2. Try other entries, that come close in size and position to the partition you want to recover. We will gladly assist you in determining which entry to choose (see: Support).

See also our comprehensive Check List.

Top

Q. I don't know which file system I had on my drive before it crashed. What shall I do?

A. If you don't know which file system you had on your drive before the crash, you can use both of our demo versions of GetDataBack to explore your drive. First of all, you have to download the demos to a working Windows computer and install the software, than connect the crashed drive as the second hard drive and make sure that the BIOS is recognizing the drive. Now you can use the Fat and the NTFS demos to explore your drive. You cannot destroy anything, as long as the drive is not physically damaged, because GetDataBack is a read-only software.
After you followed the instructions, with the right version you will receive a recovery tree with your files and folders. You can evaluate the quality of the recovery by clicking 'recovery->open' in the main menu. If your files look ok, you can copy them to a safe location on another drive. (full version only)
A little hint if you are inexperienced with different Windows versions:
Win 3.11, Win 95, Win 98, Win ME use a FAT based file system.
Win NT, Win 2000, XP can have both file systems: NTFS or FAT.

Top

Q. Is it safe to run GetDataBack on my crashed hard drive?

A. Yes, as long as your drive doesn't have a physical problem, it is safe to use GetDataBack, because the program will not change anything on the crashed drive, it is a read- only software. Install the software on a working Windows computer and attach the hard drive which contains the lost files as a second hard drive to this computer. Make sure that the second hard drive is recognized by the BIOS. Then run GetDataBack and in Step1 select your bad drive (usually this is HD129). Press ' next '. The program now will scan your drive. Depending on the size of the drive this will take some time. As soon as the scan is ready you will see a list of possible file systems the program has found. Usually you should select the first (recommended) file system on the list. Press 'next '. Now the program will create the tree of the recovered files. After a while you will see a tree with you recovered files and folders. Now you can see whether GetDataBack has found the files. If the files are found you can evaluate the quality of the recovered files. Just select a file you are interested in and click ' Recovery->View' or ' Recovery->Open' in the main menu. If the files looks okay, they most likely will be ok after you have copied the recovered files to a safe location on another drive.

Top

Q. How do I recover data from a Laptop or Notebook drive?

A. One option is to remove the drive and connect it to the IDE-cable of a Desktop computer via a Notebook-to-IDE-adaptor and run GetDataBack from the Desktop computer. Or consider creating a WinPE/BartPE boot disk and running the recovery software from the boot CD-ROM. Instructions on how to create such a boot disk and how to integrate the required plug-ins for GetDataBack can be found on our website at http://www.runtime.org/peb.htm. Keep in mind that you will still need enough space on a different drive to copy the recovered files to.

Top

Q. Will GetDataBack work on a hard drive larger than 8.2 gigabyte?

A. Yes, GetDataBack will work on any size of hard drive, but huge hard drives can take a while to be scanned and recovered.

Top

Q. How do I recover files I deleted with Windows Explorer?

A. First, check "Recover deleted files" in the Options screen. Then run GetDataBack as usual until it has build the Recovery tree. "Permanently deleted" files can be found in their original folder (if still available). Files from "emptied recycle bins" can be found below the RECYCLE directory. Note that these files have lost their original file names, but still have their original extensions.
It is also a good idea to use the Search feature.

Top

See also: Support, Doing a Data Recovery, Check List


Support

You can contact us for support:

USA

Phone | 1-808-329-2202
Fax | 1-818-475-1741
Email | support@runtime.org
Website | http://www.runtime.org

Europe (Germany)

Phone | +49-30-280 8008
Fax | +49-30-690 88 444
Email | support_europe@runtime.org
Website | http://www.runtime.org

If you have any questions related to the use of this software, please call us or send us an email.

It is a good idea to include a snapshot of the recovery with your support request.

See also: F.A.Q., Doing a Data Recovery, Check List, Snapshot, Log file


Check List

Use this comprehensive check list only if you cannot open your recovered files before or after copying (corrupted files). It is intended to verify and discuss the various choices you made during the recovery process.

We assume that are already familiar with the article Doing a Data Recovery and followed its guidelines. We also assume you have read the descriptions and explanations in the articles about the Intro Screen, Step1, Step2 and Step3.

If the recovery results are unsatisfactory check:

  • Always use a "Physical drive" in Step1. Use "Logical drives" only if you have to, e.g. your drive does not show up as a "physical drive".

  • Check that the capacity of the "2nd physical drive" (or whatever drive you want to recover) shown in Step1 matches the real capacity of this drive. If it does not match there might be an issue with your BIOS settings.

  • Top level entry vs. partition sub entry:

    1. If the drive had one partition using the whole drive, select the top level entry (e.g. "2nd physical drive") in Step1. Do not modify the range settings in the Partial Scan tab in Step1.

    2. If the drive had multiple partitions, choose a corresponding partition sub entry in Step1 IF AND ONLY IF the partition entries are shown AND they reflect the original partitioning you want to recover.

      If you had put a new partition structure over the drive this information is useless and you should go with the top level entry.

      Only if you have more than one partition (as in the example in Step1) and you KNOW it is the first partition of 10GB that needs to be recovered it makes sense to change the range settings under Partial Scan in Step1 (in this example set the range to 0-22000000). But remember, you can always also go with the top level entry, it might take some more time.

      NOTE: THE SELECTED RANGE MUST BE A SUPER SET OF THE PARTITION YOU WANT TO RECOVER! (That's why we chose 22instead of 20 million in the example. This makes sure the 10GB partition that might have been 11GB is completely inside the range.)

  • In Step2 you have to choose the entry that matches the partition you want to recover BEST. These entries are not necessarily real file systems, they merely describe POSSIBLE file systems. The entries at the top have a higher chance of being correct than entries in lower rows. BUT, THIS DETERMINATION WAS MADE FROM GETDATABACK AND IS NOT ALWAYS TRUE. If GDB would be able to determine the correct entry safely there would be no Step2 (at least in cases with one partition on the drive)!

    You MUST make the correct choice here, otherwise the recovery tree will show only unusable information. An entry is either right or wrong for a certain partition you want to recover.

    Usually you go with the first (recommended) entry. We will demonstrate a selection procedure below for cases where the first one is wrong.

  • In Step3 make sure to check that the files are ok. Use the internal viewer (F3) or open the files with their associated applications (double-click). The primary purpose of this check is to verify the selection in Step2. Use files that are easy to check, e.g. text files, JPG files, EXE files or DLL files. EXE and DLL files are easily recognized by their beginning "MZ" signature. IMPORTANT FOR NTFS: the files you check MUST be larger than 2KB.

    Interpretation of the file check: If many checks are positive, the Step2 selection was correct. If no check was positive the Step2 selection was wrong and you have to go back to Step2 and choose another entry. If no Step2 entry passes the test you should go back to Step1 and select "Excessive Search" in the Options. This will yield additional Step2 entries that you can test.

  • How to evaluate entries in Step2?

    A list entry has the format:

    <FILESYSTEM> at sector XXX, cluster size YYY (ZZZZ MB)

    Example:

    FAT32 at sector 20000, cluster size 64 (20000MB)

    Check this:

    • Check the file system type (FAT32 in the example above) is correct. FAT file systems show up as FAT12, FAT16 or FAT32. It must show up in the correct category. Rules: Partitions > 2GB are always FAT32. Partitions > 12MB are never FAT12. You force the file system type to look for in Step1. THE FILE SYSTEM TYPE MUST BE CORRECT.

    • Check the location (at sector 20000 in the example above). In GDB for FAT this number is not the exact location. It is the location where the cluster 0 starts. You can consider this to be an approximation of the start of the FAT file system. 10 MB is a number near 0 when you consider the total size of the drive (40000 MB) or partition (20000 MB). If the location does not match the remembered location of the partition by a margin of less than 5% (rel. to the drive size) this is not the correct entry.

    • The cluster size is usually not helpful because nobody knows the cluster size of a partition he once formatted.

    • Check the size (20000 MB above). This number should approximate the remembered size of the lost partition within a 10% margin. If it doesn't this is not the correct entry.

    Further information can be obtained by the "File system detail" on the right window in Step2:

    • File System Details in GDB for FAT

      • Name: The file system type (FAT12, 16 or 32).

      • Cluster0: The position of cluster 0 in the file system.

      • Cluster size: The number of sectors in one cluster. Possible values are:

        for FAT12: 1, 2, 4, 8,

        for FAT16: size of the volume/number of max. possible FAT entries (65535) rounded to the next possible value,

        for FAT32: 8 for 512MB-8191MB, 16 for 8192MB-16383MB, 32 for 16384MB-32767MB, 64 for >32768MB.

      • Total sectors: The total number of sectors in the file system.

      • FAT1: If any: the start sector of FAT1, (the quality of the FAT, defined by the selected file system's range the FAT covers),

      • FAT2: If any: the start sector of FAT2, (the quality of the FAT, defined by the selected file system's range the FAT covers),

      • FAT length: If any, the FAT's length in sectors.

      • 1st root cluster: If any, the start cluster of the root directory (only available for FAT32 file systems).

      • Root dir start: If any, the first sector of the root directory.

      • # root entries: The max. possible number of root directory entries in this file system (FAT12 and 16 only).

      • Total clusters: The total number of clusters in the file system.

      • Min clusters used: The min. cluster range where data was found by the scan.

      • Max cluster used: The max. cluster range where data was found by the scan.

      • Data matches: Total number of matches of dir starts with file starts. This number determines the order of the file system list in Step2. The higher this value, the larger is the number of probably recoverable files.

      • Debug info: B stands for boot record found, B1 for example means, that one boot record was found. D stands for directories found, the following number states the number of directory structures found.

      Check this:

    • Check the value of the cluster size according to the table above.

    • Check the Data matches: This value tells you the min. number of probably recoverable files. These are files that could be confirmed by directory entries pointing to them and by the content of an actual location on the drive.

    • Check the "Debug Info". This info tells you HOW GetDataBack came to proposing this entry. There are three different methods:

      • B1 or B2- by one or two boot records

      • Dnnnn - by a directory structure consisting of nnnn sub directories

      • Cnnnn - by matches of file start signatures against found file entries

      Entries with a C are only available if you used "Excessive Search".

      D and C entries might be combined to one entry if they describe the same file system (e.g. D2112C8933). B entries are not combined. That's why you often see duplicates in the first two rows.

      B entries are usually the best. However they might be misleading especially when a drive was reformatted. They should always be confirmed by the existence of a D entry with a high number. E.g. D2111 describes a file system that contains 2111 subdirectories. If you have to choose between two equal entries, one is a B and one is a D, choose the B.

      A D entry with a high number is the most significant entry because there are really many directories in it.

      A C entry - available only with "Excessive Search" checked - helps especially in cases with little directory information and no or useless boot record information. It also might help confirming or excluding B or D entries.

    • The "Bar code" on the right bottom can give you further information about a certain entry. The more the marks in these rows are in correspondence, the better the file system is (HOWEVER, finally there is only a YES or a NO for choosing this file system):

      Displayed are:

      • Dir starts: Cluster areas where found directory entries are pointing to.

      • File starts: Cluster areas identified to be a start of a file.

      • FAT1 starts: Cluster areas where a beginning of a chain in FAT1 is pointing to.

      • FAT2 starts: Cluster areas where a beginning of a chain in FAT2 is pointing to.

      The percentage of corresponding file starts to directory starts is indicated right of those rows. Don' t be disappointed, if this doesn't come near to 100%. It never does, due to the fact that GetDataBack conducts a very thorough scan of the drive and always finds some kind of orphan data which could be associated with a file or directory start.

      The percentage is defined as:

      100 * Matching_File_Starts / Dir_Starts

      where

      Matching_File_Starts is the number of sectors identified as a file start AND a sector a directory entry points to,

      Dir_Starts is the number of sectors a directory entry points to.

      There are always file starts that cannot be identified, therefore this value will usually not reach 100%. Even a low value like 30% can generate a perfect data recovery.

  • Other means to improve the quality of the recovery:

    • Check "Allow duplicate file names" in or before Step2. This might bring up different versions of files with the same file name, possibly a desired one that otherwise is suppressed.

    • Check "Recover deleted files" ONLY if you want to recover files deleted with Windows Explorer or by emptying the Recycle Bin. This option must be checked in or before Step2. When checking this option you also should check "Allow duplicate file names".

    • Fragmentation: Checking "Ignore Fat" will cause GetDataBack to allocate files without using an eventually found FAT. This can be useful when the found FAT does not reflect the file system you are currently recovering. It is better to use no FAT than using a FAT containing false information. Check this box only if you are not satisfied with certain files in the recovery tree. Look at the "Allocation" in the "file info" for a corrupted file in the recovery tree. If this is not continuous checking this option will generate another version of such a file. To be effective, this option must be set in or before Step1.

See also: F.A.Q., Support, Doing a Data Recovery


Snapshot

The snapshot summarizes the recovery process for support purposes. Important settings and choices are recorded in the snapshot. It is a short form of the log file, but will only be a couple of KB in size.

In order to create a snapshot proceed to Step2 or Step3 of the recovery and click Help->Snapshot for customer support. You will be asked for a file name and location to store this file. (Caution: Do not specify a location on the drive you want to recover). It is a good idea to include the snapshot when you send us an email for support.

See also: Log file, Support


Show Data Structures

The following information about the data structures of the drive/partition in the recovery tree are provided:

  • Drive: The drive/device the data recovery was performed on.
  • Window info: The drive/partition displayed in the recovery tree.
  • Entire drive: States whether or not the whole drive was scanned.
  • From sector: Starting sector of the drive/partition displayed in the recovery tree.
  • To sector: Ending sector of the drive/partition displayed in the recovery tree.
  • File system: File system of the recovered drive.
  • FileSystemDesc: Detailed description of the file system.
  • Excessive search: States whether excessive search for file systems was selected in Step1.

All other information are for debug purposes and though not of much use for the user.