TIRAMISU FOR DOS/WINDOWS V3.10 - SOPHISTICATED DATA RECOVERY
(c) 1996, 97 by Plug'n Play GbR, Uwe Gissemann, Dirk Knoblauch


    CONTENT

    1. OVERVIEW

    2. SYSTEM REQUIREMENTS

    3. INSTALLATION
       3.1. Boot diskette
       3.2. Specify swap area
       3.3. Which Drive To RECOVER.
       3.4. How to copy some or all files to a safe medium

    4. RESULTS

    5. RESTRICTIONS

    6. OPTIONS
       6.1. Swap Area
       6.2. Excluded Main Directory Entries
       6.3. Logging (Logfile)
       6.4. Automatic Identification (Verify correct file system structure)
       6.5. Start Identification At Sector X (multi partition problem)
       6.6. Bad File Entry Acceptance

    7. TROUBLE SHOOTING
       7.1. Wrong Disk Size
       7.2. Drive Structure Recognition Routine
       7.3. Missing files or directories
       7.4. Other Disk Tools
       7.5. Get a New Version

    8. REGISTRATION

    9. NO WARRENTY

    10.DISCLAIMER



1. OVERVIEW

    TIRAMISU is a software for reconstructing data from a crashed hard drive.
    It helps when the drive is

        - hit by a virus
        - formatted
        - 'fdisk'ed
        - zapped by a power failure
        - damaged by applications

    TIRAMISU scans the drive even when there are physical damages. The found
    data are analyzed and reconstructed. TIRAMISU can handle drives without
    readable boot sector, readable Fat or readable directories. It can
    handle drives that are not recognized by DOS anymore.

    TIRAMISU automatically creates a VIRTUAL DRIVE in memory. This virtual
    drive looks like a usual file manager. You can see the lost directories
    and files of your crashed drive. Now files and directories can be viewed
    and copied to a safe medium.

    The extensive use of our sophisticated pattern recognition technology
    enables TIRAMISU to put the right pieces of data together again. Even
    disks with very few administrative informations left can reach a high
    recovery quality.
    TIRAMISU recovers much more data than any other 'disk doctor'.

    TIRAMISU is NON DESTRUCTIVE and READ ONLY. It does not put any data onto
    your crashed drive. Recovered data are restored to another destination
    (disk, diskette, network, interlink).

    TIRAMISU works on DOS and Windows platforms. Better Windows95 support
    has been added in version 1.03. Multi partition recovery has been added
    in version 2.0.

    Versions for NOVELL and NTFS are available too.


2. SYSTEM REQUIREMENTS

    - 286 processor and up
    - 4 MB RAM and up

    Depending on the size of the drive to be recovered we recommend a 486
    with 8 MB RAM. Installing 5 MB of EMS (Version 4) is recommended.


3. INSTALLATION

3.1. Boot diskette

    Create a boot diskette with a CONFIG.SYS similar to this:
        Ŀ
        files=25             
        device=himem.sys     
        device=emm386.exe ram
        DOS=HIGH             
        
    Make sure you have specified the correct drive parameters
    in BIOS setup (Look to sec 7.1.).

    Boot the computer and start the program TIRAMISU.EXE (best starting point
    is a good second harddisk).


3.2. Specify swap area

    By default TIRAMISU uses EMS as swap area. If for some reason there is
    no or not enough EMS you can specify a swap area on disk.
    Select OPTION -> DATA RECOVERY, tag 'DISK ALLOWED', specify path.

    CAUTION: Do not swap to the drive you intend to recover.

    You can swap to another computer via INTERLINK if you do not have
    enough memory or a second hard drive (typical laptop situation).
    However this should be your last choice because the speed would
    decrease dramatically.


3.3. Which Drive To RECOVER.

    You can switch between the drives using the TAB key.
    Hit RECOVER for the drive you want to recover.
    HD 128 is normaly C: and 129 is D: and so on...

    Ŀ
     File  Options  Registration  Help           Registered  14:05:35 
                              TIRAMISU                DATA RECOVERY   
                SOPHISTICATED DATA RECOVERY (V3.03)       STATUS      
              (c) '96 by Plug'n Play, Uwe Gissemann                   
                                                      IDENTIFICATION  
     HD 128 ͻ  HD 129 Ŀ                 Cluster       
     1022*64* 63      786*64* 63                    Main          
      4120704 sec     3169152 sec                   FAT           
       2012 MB         1547 MB                                    
       RECOVER        RECOVER                   CLASSIFICATION  
                                  Cluster       
    ͼ                  Fat           
                                                                      
                                                      PROCESSING      
                                                        Main          
                                                        Subs          
                                                        Files         
                                                                      
                                                      DONE            
                                                                      
    Alt+F3 Close  F10 Menu  F7 Copy  F8 View          E:28896 403648  
    

    TIRAMISU starts processing. Depending on your system's speed and the size
    of your drive this can take 5 minutes or even up to 2 hours.


3.4. How to copy some or all files to a safe medium

    Now you see the virtual drive and you can view and copy (registered
    version only) the files to any DOS-available destination by pressing
    the F7-key.


4. RESULTS

    The virtual drive is a file manager like window. It will look like this:

      File  Options  Registration  Help               Registered  12:13:11
    [] Virtual Drive []ͻ
    ROOT128          IO.SYS           41055 31.05.94 06:22 a__shr8BF08
     AOL25I        MSDOS.SYS        38186 31.05.94 06:22 a__shr8C0A8
       DOWNLOAD   COMMAND.COM      57377 31.05.94 06:22 a____r8BC68
       SPOOL      DRVSPACE.BIN     66294 31.05.94 06:22 a__shr8BD48
       ORGANIZE   AOL25I      <DIR>      05.05.97 13:31 _d____0015ĳ
         SAVE    AWR         <DIR>      05.05.97 13:31 _d____03FBĳ
       CCL        BATCH       <DIR>      05.05.97 13:31 _d____043Aĳ
       IDB        BITMAP      <DIR>      05.05.97 13:31 _d____044Aĳ
         SAVE    CHIP        <DIR>      05.05.97 13:31 _d____0475ĳ
     AWR           CORELDRW    <DIR>      05.05.97 13:31 _d____070Cĳ
     BATCH         CORLSCSI    <DIR>      05.05.97 13:31 _d____0716ĳ
     CLUS1234      CSERVE      <DIR>      05.05.97 13:31 _d____073Bĳ
       ANW16      DBASE3      <DIR>      05.05.97 13:32 _d____0EB8ĳ
       ANW256     DECODER     <DIR>      05.05.97 13:32 _d____0EF2ĳ
     CHIP          DESKJET     <DIR>      05.05.97 13:32 _d____10BEĳ
     CLIPART       DOS         <DIR>      05.05.97 13:32 _d____10DAĳ
       BUSINESS   DUMMY       <DIR>      05.05.97 13:32 _d____12AFĳ
       CARTOONS   EATEMS      <DIR>      05.05.97 13:32 _d____12B7ĳ
    
     Alt+F3 Close  F10 Menu  F7 Copy  F8 View     E:26320 F:7576    117696

    On the left side you can see the directory names. If for some reason your
    main directory was destroyed there can be some dummies ("CLUS1234"). This
    usually does not effect the quality of the recovered files. You will find
    the recovered files inside of these dummy directories.

    The right part of the windows contains the file and directory entries of
    the directory you selected on the left side.

    You can copy (registered version only) the recovered files either from
    the left or the right side of the virtual drive window. If you want to
    retrieve the whole drive you should select "ROOT128" on the left side
    and press F7-Copy.

    The quality of the recovered files depends on the condition of the drive.
    The recovery quality of a single file can be checked by selecting the file
    in the right part of the window and pressing the space key:

      File  Options  Registration  Help               Registered  12:13:11
    [] Virtual Drive []ͻ
    ROOT128          IO.SYS           41055 31.05.94 06:22 a__shr8BF08
     AOL25I        MSDOS.SYS        38186 31.05.94 06:22 a__shr8C0A8
       DOWNL[] SAMANTA.DOC ͻ___r8BC68
       SPOOLAttributes:  a_____                          _shr8BD48
       ORGANDate:        20.02.97                        ____0015ĳ
         SATime:        18:00:22                        ____03FBĳ
       CCL  Length:          484864 (x00076600)          ____043Aĳ
       IDB  Methode:     DSF                             ____044Aĳ
         SAChaining:                                    ____0475ĳ
     AWR     8C368C378C388C398C3A8C3B8C3C8C3D     ____070Cĳ
     BATCH   8C3E8C3F8C408C418C428C438C448C45     ____0716ĳ
     BITMAP  8C468C478C488C498C4A8C4B8C4C8C4D     ____073Bĳ
       ANW168C4E8C4F8C508C518C528C53ĳ              ____0EB8ĳ
       ANW25                                             ____0EF2ĳ
     CHIP                       Ok                       ____10BEĳ
     CLIPART                                      ____10DAĳ
       BUSINͼ____12AFĳ
       CARTOONS   EATEMS      <DIR>      05.05.97 13:32 _d____12B7ĳ
    
     Alt+F3 Close  F10 Menu  F7 Copy  F8 View     E:26320 F:7576    117696

    The characters next to "Methode:" tell you something about the quality
    of this single file.

        F - FAT approved. This file has been recovered using a valid FAT
            entry. This is a very good sign. In all probability this file
            is good.
        D - Directory entry found. A directory entry was found for this
            file. This is usually a minimum requirement for a good file
            quality
        S - Confirmed by signature. Some kinds of files (for example EXE
            files) has signatures. An 'S' indicates that the found data
            indeed have this signature.

    Another way to check the file quality before you copy is viewing it with
    the hex-viewer (F8).


5. RESTRICTIONS

    TIRAMISU handles only drives with 16-Bit Fats, which applies to most
    systems. Very old (10 MB) drives have another Fat (12-Bit). The very
    new 32-Bit Fat is not supported.

    Since TIRAMISU is very memory hungry, your PC might run out of memory.
    If you face this problem, install a memory manager with as much RAM and
    EMS as possible.
    Watch the available memory displayed at the bottom line. The value
    displayed at the far right shows the free RAM. The E:XXX shows the free
    EMS. The RAM should not go below 50000.


6. OPTIONS

    There are several options you can change in the OPTIONS->DATA RECOVERY
    screen:

    [] Tiramisu Data Recovery Options ͻ
     Swap area:         ***CAUTION: Don't swap to the drive   
      () EMS only      you intend to recover!                
      ( ) Disk allowed   D:\TEMP                              
                                                              
     Excluded main directory entries:                         
      FILE*.CHK;DIR*.CHK;*._DD;PCT*.FIX;DIR0????.*            
                                                              
     Logging to file:                                         
                                                              
                                                              
      [X] Automatic Identification                            
     Start identification at sector:         0                
     Bad file entry acceptance (0-100 %):    50               
                                                              
                      OK               Cancel               
                                              
    ͼ

6.1. Swap Area

    By default TIRAMISU stores memory intensive data in EMS. If your have no
    or not enough EMS available you can allow swapping to a drive. Be sure to
    choose a drive you are not just recovering.


6.2. Excluded Main Directory Entries

    This option tells TIRAMISU to ignore files entries that have been created
    during a previous run of another disk doctor (Norton, Scandisk,...).


6.3. Logging (Logfile)

    Use this option to create a log file of TIRAMISU's processing. This might
    be interesting for debug purposes.


6.4. Automatic Identification (Verify correct file system structure)

    The first thing TIRAMISU does is to retrieve the original structure of
    the file system: place of Fat1, Fat2, main directory, number of sectors
    per cluster, number of clusters.
    If you tag off this option TIRAMISU shows you what it thinks what kind
    of file system it found. Usually you confirm this by pressing OK. If you
    do not confirm the structure TIRAMISU found, you can continue the
    identification procedure by pressing SEARCH AGAIN. After a while TIRAMISU
    will make a new proposal.


6.5. Start Identification At Sector X (multi partition problem)

    By default TIRAMISU starts its identification procedure at sector 0.
    However you might be interested in recovering another but the first
    partition. Then you can enter a value in this field.
    Example: Let's suppose you have a 600 MB drive with two partions (400 MB
    and 200 MB). You want to recover the second (200 MB) partition. The first
    partition uses 400 MB space on the hard drive. These are approximately
    800000 sectors (one sector has 512 bytes). Consequently you should enter
    the value 800000 in this field.
    You should tag the "Automatic Identifation" off. So you can verify if
    TIRAMISU retrieved the correct file system structure.


6.6. Bad File Entry Acceptance

    TIRAMISU uses statistical algorithms to decide if file entries are
    included into the recovery process. If you set this option to 0
    TIRAMISU is very strict. If you set it to 100 TIRAMISU is very loose.
    50 is a good value. Increase it if you miss some files in the resulting
    virtual drive. Decrease it if you get scrambled results.


7. TROUBLE SHOOTING

    Sometimes you might think the computer is frozen and TIRAMISU is
    crashed. Be patient! Some procedures might take up to one hour. If
    TIRAMISU crashes you usually get an error code.


7.1. Wrong Disk Size

    A nasty source of problems is a wrong disk size reported from BIOS.
    Check the size TIRAMISU thinks your drive has:
         HD 128 ͻ
         1022*64* 63   
          4120704 sec  
           2012 MB     
           RECOVER    
              
        ͼ
    If this size (2012 MB in this example) is not correct you won't get
    correct recovery results.

    Reboot your computer and enter the BIOS setup. Let it "auto detect"
    (if available) the drive size or enter the values manually.
    If the drive is bigger than 504 MB make sure the LBA mode is enabled.

    If you still get a wrong drive size try this (experts only!):

        - make a backup of the very first sector (physical sector 0,0,1)
        - Overwrite the very first sector (512 bytes) with zeros.

    You can use a disk editor like Norton's DISKEDIT for this task.
    Reboot the computer again.


7.2. Drive Structure Recognition Routine

    If you get only scrambled results this could be due to the TIRAMISU
    drive structure recognition routine. Try this:
    Select OPTION -> DATA RECOVERY, tag 'AUTOMATIC IDENTIFICATION' off.
    Press RECOVER. After a while you get a window that proposes a certain
    drive structure:

    [] Drive structure ͻ
    STRUCTURE-INFORMATION FOR DRIVE: 128                             
    1022 Cyl x 64 Heads x 63 Sec = 120704 phys. Sect. = 2012 MByte   
                                                                     
    Cluster size: 32 (x20)                                           
    Data start (Cluster 0) at sector: 538 (x0000021A)                
    Last Cluster: 64767 (xFCFF)                                      
                                                                     
    FAT start: 64 (x00000040)                                        
    FAT end:   316 (x0000013C)                                       
                                                                     
    Free:      27676 (x6C1C) Cluster = 42.73 %                       
    Reserved:      0 (x0000) Cluster =  0.00 %                       
    Used:      37090 (x90E2) Cluster = 57.27 %                       
    Bad:           0 (x0000) Cluster =  0.00 %                       
    Undefined:     0 (x0000) Cluster =  0.00 %                       
                                                                     
           Ok         Search again     Cancel                     
                              
    ͼ

    Check the value "Cluster size". It tells you how many sectors a cluster
    uses. In the example above the cluster size is 32 sectors (=16 kB).

    Check the value of "Data Start (Cluster 0) at sector". If you are
    retrieving the first partition it should be below 1000. If you try to
    retrieve - let's say - the 2nd partition of a 2 GB drive with two 1 GB
    partitions this value should be around 2000000.

    Check the value of "Last Cluster". Do the following calculation:

        (Last Cluster * Cluster Size) / 2

    This is the size (in kB) of the partition you are going to recover.
    In the example above the partition size is

        32 * 64767 / 2  =  1036272 kB

    This is approximately 1 GB. Since I know that my 2 GB drive had two
    partitions of 1 GB this identification is likely to be correct.

    If you are not satisfied with what you see you can press 'Search Again'.
    TIRAMISU tries to retrieve another structure. Repeat this until the
    proposed structure seems to be correct.
    Finally press 'Ok'.


7.3. Missing files or directories

    You can change the option "Bad file entry acceptance". 0% means a
    very strong directory recognition routine. Use only if TIRAMISU crashes.
    100% means a very loose directory recognition routine. Use if TIRAMISU
    goes through but you miss some directories. 50% is a good standard value.
    (see 6.6.)


7.4. Other Disk Tools

    You should not use any other 'disk doctor' before running TIRAMISU. If you
    did so, please 'undo'.
    If you cannot 'undo' you can tell TIRAMISU to ignore the file entries
    the 'disk doctor' created (something like FILE0000.CHK...).
    Select OPTION -> DATA RECOVERY, modify the field 'Exclude Main
    Directory Entries'.


7.5. Get a New Version

    Download a new version from our Internet site (address below).
    If you find any bugs, please send a description to one of the addresses
    below or use our support form at "http://www.recovery.de".


8. REGISTRATION

    TIRAMISU IS DISTRIBUTED AS SHAREWARE. FEEL FREE TO COPY, DISTRIBUTE OR
    UPLOAD IT TO ANY MEDIUM. The unregistered version has all functions
    for recovering your crashed hard drive. But only the registered version
    of TIRAMISU allows you to COPY files from your recovered drive.

    There are two kinds of licenses available:

    - A limited version that can only be used for a PERIOD OF ONE WEEK.
      In effect this is a PAY PER USE registration.
      The price is DM 168.20 (incl. 16% VAT) for residents of the European
      Community.
      The price is US $95 for residents of any other country.

    - An unlimited version that can be used for an UNLIMITED PERIOD at
      one computer at the same time.
      The price is DM 336.40 (incl. 16% VAT) for residents of the European
      Community.
      The price is US $190 for residents of any other country.

The registration procedure is this:

    - Run TIRAMISU and check if it can restore your data (VIEW your files)

    - Select REGISTRATION->REGISTRATION. You will be asked to insert a
      diskette in drive A:.

      [] Information ͻ
                                            
        Please insert the license or a      
        blank diskette in drive A:          
                                            
                                            
                  OK       Cancel         
                            
      ͼ

      Please have ready a blank formatted 1.44 MB or 1.2 MB diskette.
      This diskette will become your license diskette later. Be aware
      that any data on this diskette might be damaged during this procedure.

      [] Confirm ͻ
                                            
        Disk in drive A: will be prepared   
        now for STEP 1 of registration.     
        DATA MIGHT BE DESTROYED! Continue?  
                                            
                 Yes         No           
                            
      ͼ

      If you encounter any problems please try it again using a fresh
      formatted and error free diskette.

      If you are running TIRAMISU from diskette do not remove the diskette
      during the registration process because it is needed for reloading
      overlays. If you do not want to risk this diskette's data, please
      terminate the program, put the TIRAMISU program files onto a new
      diskette and start TIRAMISU again to do the registration.

      Finally you will be shown a 16- or 17-letter code.

      [] Information ͻ
                                            
        Your license diskette is prepared   
        for registration now. Send us this  
        code:                               
             CPYQ BVVN MHVA VCWX K          
                        OK                 
                                    
      ͼ

    - Submit this code to the TIRAMISU registration service (preferably
      by fax, use the form you can find in REGISTER.TXT):

      Tel.:  49-30-292 00 99       (Germany)
      Fax:   49-30-292 60 63
      Email: data_recovery@compuserve.com
      http://www.recovery.de
      http://ourworld.compuserve.com/homepages/data_recovery

      Address:          Plug 'n Play
                        Uwe Gissemann
                        Scharnweberstr. 43
                        D-10247 Berlin
                        Germany

    - Specify the kind of license you want to purchase (7 days license or
      unlimited license). Send the money or credit card information (VISA,
      MASTERCARD or DINERS).

    - The registration key will be forwarded to you immediately by fax
      or email after we charged to your account.

    - After receiving the registration key from us, please insert the
      prepared diskette. Start TIRAMISU. Select REGISTRATION->REGISTRATION.
      Enter the received key in the registration screen.

    - Ready! Now you can use COPY to save your data.

    IMPORTANT: Label the diskette as your license diskette. You will need it
    anytime you run TIRAMISU. The license diskette can not be duplicated.
    This is a copy protection.

    The limited license allows you to recover data only from one
    computer. It is not valid for other systems. (This restriction does not
    apply for the unlimited license.)


9. NO WARRENTY

    The quality of data recovery that is done by TIRAMISU depends on:

        - physical condition of the hard drive
        - fragmentation of the files
        - grade of the loss of drive informations

    TIRAMISU data recovery software, as all applications, has limitations.
    We cannot provide recovery capabilities under certain conditions. Due
    to the many variables associated with drive corruption, we cannot
    guarantee recovery in all cases.

    However, downloading and running the shareware version gives you the
    closest idea to what we can offer.
    All customers are recommended to check the files with the build-in
    quality control (file information and file viewer) before they buy.

    We do not do refunds.


10. DISCLAIMER

    PLUG'N PLAY DOES NOT WARRANT THAT THE SOFTWARE IS ERROR FREE.

    PLUG'N PLAY DISCLAIMS ALL WARRANTIES WITH RESPECT TO THE SOFTWARE,
    EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
    OF THIRD PARTY RIGHTS.

    NO LIABILITY FOR CONSEQUENTIAL DAMAGES.  IN NO EVENT SHALL
    PLUG'N PLAY BE LIABLE FOR CONSEQUENTIAL, INCIDENTAL
    OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE DELIVERY,
    PERFORMANCE OR USE OF THE SOFTWARE, EVEN IF PLUG'N PLAY HAS BEEN
    ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL
    PLUG'N PLAY'S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT OR
    ANY OTHER THEORY OF LIABILITY, EXCEED THE LICENSE FEE PAID BY
    THE BUYER.
