This Tiramisu manual is designed to be viewed using Courier
fonts (not TrueText fonts nor any other variable width font.
If the screen shots do not line up correctly, change the font.



TIRAMISU - SOPHISTICATED DATA RECOVERY -
(c) 1997 by Ontrack Data International

    CONTENTS

    1. OVERVIEW
       1.1. Features
       1.2. Versions of TIRAMISU
       1.3. Differences between 16-bit and 32-bit Fat systems

    2. SYSTEM REQUIREMENTS
       2.1 TIRAMISU for Fat16
       2.2 TIRAMISU for Fat32
       2.3 TIRAMISU for NTFS
       2.4 TIRAMISU for Novell
       2.5 TIRAMISU for ZIP/Jaz

    3. INSTALLATION
       3.1. Boot diskette
          3.2.1 TIRAMISU for Fat16
          3.2.2 TIRAMISU for Fat32
          3.2.3 TIRAMISU for NTFS
          3.2.4 TIRAMISU for Novell
          3.2.5 TIRAMISU for ZIP/Jaz
          3.2.5 TIRAMISU -General
       3.2. Specify swap area
       3.3. Which drive to RECOVER.
       3.4. How to copy some or all files to a safe medium

    4. RESULTS

    5. RESTRICTIONS

    6. OPTIONS
       6.1. Swap Area
       6.2. Excluded Main Directory Entries
       6.3. Logging (Logfile)
       6.4. Force recovery without FAT
       6.5. LFN (long file name) support
       6.6. Automatic Identification (Verify correct file system structure)
       6.7. XBios Read
       6.8. Start Identification At Sector X (multi partition problem)
       6.9. Bad File Entry Acceptance
       6.10. Restart from last / Keep for next session: Tirmaisu for Novell
             or NTFS Only
       6.11. Valid FAT Required: Tirmaisu for Novell Only
       6.12. DET maintainance mode: Tirmaisu for Novell Only

    7. Special Issues
       7.1 For TIRAMISU for Novell Only
       7.2 For TIRAMISU for NTFS Only

    8. TROUBLE SHOOTING
       8.1. Wrong Disk Size
       8.2. Drive Structure Recognition Routine
       8.3. Missing files or directories
       8.4. Computer frozen or Runtime error
       8.5. The resulting files contain garbage only
       8.6. No partition found at all: TIRAMISU FOR NTFS
       8.7. "Restrict sectors" must match previous setting
       8.8. Other Disk Tools
       8.9. Get a New Version

    9. OTHER FUNCTIONS
       9.1 Long file names (LFN)
       9.2 Save & Load a Recovery

   10. REGISTRATION

   11. NO WARRANTY

   12. LICENSE AGREEMENT



1. OVERVIEW

1.1. Features

    TIRAMISU is software for reconstructing data from crashed hard drives.
    It can help when the drive has been:

        - hit by a virus
        - formatted
        - 'fdisk'ed
        - zapped by a power failure
        - damaged by applications

    Note: Be aware of strange noises coming from your hard drive. If you
    hear a strange noise or grinding sound, turn off your computer immediately
    and call Ontrack. Further operation may damage your hard drive beyond
    repair or cause irretrievable data loss.
    
    TIRAMISU scans the drive even if there is physical damage. If you have
    mission critical data on a drive with hardware damage, however, we
    recommend using Ontrack Data Recovery services rather than any software.
    TIRAMISU can recover data from drives without readable boot sectors,
    readable Fats or readable directories. It can recover data if you are
    unable to start the SERVER.EXE. It can also handle drives that are no
    longer recognized by the operating system.

    TIRAMISU automatically creates a VIRTUAL DRIVE in memory. This virtual
    drive looks like a normal file manager. In it you can see the lost
    directories and files from your crashed drive.
    Files and directories can be viewed and copied to a safe medium.
    Never use the drive with data problems as the copy destination.

    The extensive use of our sophisticated pattern recognition technology
    enables TIRAMISU to put the right pieces of data together again. Even
    disks with very little administrative information left can still give
    files of a  high quality.

    TIRAMISU recovers much more data than any other 'disk doctor'.

    TIRAMISU is NON DESTRUCTIVE and READ ONLY. It does not put any data onto
    your crashed drive. Recovered data is restored to another destination
    (disk, diskette, network, interlink). It may be advisable to install an
    additional hard drive media as a destination device if no other
    alternatives are currently present.

1.2. Versions covered:

    Each version of TIRAMISU is an independent program available for
    download from the Ontrack web site. All basic documentation is within
    the downloadable file, however additional FAQs are also on the web site.
    The DEMO versions are the same as the full version except for the
    ability to copy files from the Virtual drive in memory to any
    floppy or hard drive destination.

    TIRAMISU is capable of working from a DOS platform to recover files
    from DOS, Windows 3.x, Windows 95/98, Windows NT, or Novell. If you are
    using Windows3.x or Windows95/98 TIRAMISU should be run in the DOS-only
    mode.

    TIRAMISU FOR FAT16 works on DOS and Windows platforms. Windows95,98,
    and Multi partition recovery is supported. All files will be recovered,
    however, long filenames will be truncated to DOS 8,3 characters.
 
    TIRAMISU FOR FAT32 works on WIN95 rel. B, OSR2, or Windows 98 platforms
    with 32-bit Fat. TIRAMISU for FAT32 only works on 32-bit Fat
    systems. This file system was first introduced by Microsoft with
    Windows 95 Rel. B. in 1996 and continues in OSR2, and Windows 98.

    TIRAMISU FOR NTFS works on any Windows NT system on NTFS only:
    workstation or server platforms.

    TIRAMISU FOR NOVELL works on NOVELL only: 3.XX and 4.XX with and without
    File compression.

    TIRAMISU FOR ZIP DRIVES works on DOS and Windows platforms. 

    TIRAMISU is copyrighted by Ontrack Data International.
    The DPMI run-time modules RTM.EXE and DPMI16BI.OVL are copyrighted by
    Borland International, Inc.
    ZIP and JAZ are registered trademarks from Iomega Corp.


1.3. Differences between 16-bit and 32-bit Fat systems

    The "16-bit" or "32-bit" refers to the maximum size of a Fat entry. The
    maximum size of a Fat entry in a 16-bit system is 16 bit (Binary digIT).
    This means you can address up to

        binary 1111111111111111 (= 2^16-1 = 65535)

     (Note: 16 binary digits)

    clusters. A cluster is the smallest logical allocation unit on the
    disk drive. It is simply a given number of sectors that the operating
    system may manipulate rather than individual sectors.

    The maximum size of a Fat entry in a 32-bit system is 32 bit. Consequently
    you can address up to

        binary 2^32-1 (= 42949672950)

    clusters.

    The advantage of the 32-bit Fat systems is the ability to use smaller
    allocation units (cluster sizes).

    A 16-bit formatted 2GB drive for example uses a cluster size of 32KB.
    32-bit formatted it uses a cluster size of 4KB only. Because the average
    disk space loss per file (ADSLPF) due to internal fragmentation is

        cluster size / 2

    you get

        ADSLPF(16-bit) = 16KB

    and

        ADSLPF(32-bit) = 2KB

    This is a saving of 14 KB for every file on your hard drive. A typical
    system has 10000 files. With the 32-bit system you save 140MB!

    Another advantage of the 32-bit Fat system of course is the ability to
    address drives larger than 2GB.


2. SYSTEM REQUIREMENTS

2.1 TIRAMISU for Fat16
    - 286 processor and up
    - 4 MB RAM and up

2.2 TIRAMISU for Fat32
    - 486 processor and up
    - 8 MB RAM and up

2.3 TIRAMISU for NTFS
    - 386 processor with co-processor and up
    - 8 MB RAM and up

2.4 TIRAMISU for Novell
    - 386 processor and up
    - 8 MB RAM and up

2.5 TIRAMISU for ZIP/Jaz
    - 486 processor and up
    - 4 MB RAM and up


    Depending on the size of the drive to be recovered we recommend a 486
    with 16 MB RAM. Installing 5 - 12 MB of EMS (Version 4) is recommended
    for larger filesystems such as Novell or NTFS.

3. INSTALLATION

3.1. Boot diskette

    Create a boot diskette with a CONFIG.SYS similar to this:


3.1.1 TIRAMISU for Fat16

        files=30
        device=himem.sys
        device=emm386.exe ram
        DOS=HIGH

3.1.2 TIRAMISU for Fat32

        files=30
        device=himem.sys
        device=emm386.exe ram
        DOS=HIGH

3.1.3 TIRAMISU for NTFS

        files=30
        device=himem.sys
        device=emm386.exe ram
        DOS=HIGH

3.1.4 TIRAMISU for Novell

        files=30
        device=himem.sys
        device=emm386.exe ram
        DOS=HIGH

3.1.5 TIRAMISU for ZIP/Jaz
        files=30
        device=himem.sys
        device=emm386.exe ram
        DOS=HIGH
    Only for TIRAMISU for ZIP/Jaz:
    The AUTOEXEC.BAT should look like this:
        lh guest.exe

    GUEST.EXE is the DOS based driver program from Iomega, the manufacturer
    of Zip and Jaz diskettes. This program can be found on your Iomega
    driver diskette. Updated version can be downloaded from Iomega's
    internet address http://www.iomega.com.

3.1.6 TIRAMISU - General

    Make sure you have specified the correct drive parameters
    in BIOS setup. (Check the Troubleshooting section of this document). 

    Boot the computer and start the program (best starting point
    is a good second hard disk).


3.2. Specify swap area

    By default TIRAMISU uses RAM as swap area. If for some reason there is
    not enough RAM memory available you can specify a swap area on disk.
    Select OPTION -> DATA RECOVERY, tag 'DISK', specify path.

    IMPORTANT: Do not swap to the drive you intend to recover.

    You can swap to another computer via INTERLINK if you do not have
    enough memory or a second hard drive (typical laptop situation).
    However this should be your last choice because the speed would
    decrease dramatically.


3.3. Which Drive To RECOVER.

    You can switch between the drives using the TAB key.
    Hit RECOVER for the drive you want to recover.
    HD 128 is normally C: (the first SCSI drive or Primary Master IDE drive)
    and 129 is D: (the second SCSI drive or IDE drive - either Primary Slave
    or Secondary Master if Primary Slave is the CD-ROM or does not exist)
    and so on...

    |------------------------------------------------------------------|
    | File  Options  Registration  Help           Registered  14:05:35 |
    |                          TIRAMISU                DATA RECOVERY   |
    |            SOPHISTICATED DATA RECOVERY (Version)     STATUS      |
    |          (c) '97 by Ontrack Data International                   |
    |                                                  IDENTIFICATION  |
    ||--- HD 128 ----| |--- HD 129 ----|                 Cluster       |
    || 1022*64* 63   | |  786*64* 63   |                 Main          |
    ||  4120704 sec  | |  3169152 sec  |                 FAT           |
    ||   2012 MB     | |   1547 MB     |                               |
    ||   RECOVER     | |   RECOVER     |               CLASSIFICATION  |
    ||               | |               |                 Cluster       |
    ||---------------| |---------------|                 Fat           |
    |                                                                  |
    |                                                  PROCESSING      |
    |                                                    Main          |
    |                                                    Subs          |
    |                                                    Files         |
    |                                                                  |
    |                                                  DONE            |
    |                                                                  |
    |Alt+F3 Close  F10 Menu  F7 Copy  F8 View          E:28896 403648  |
    |------------------------------------------------------------------|

    TIRAMISU starts processing. Depending on your system's speed and the size
    of your drive this can take 15 minutes or even 2 hours.



    TIRAMISU FOR NOVELL and NTFS ONLY: 
    Depending on your system's speed and the size of your drive
    processing can take 30 minutes or even up to 24 hours.
    Finally you will be shown a window containing propositions what the
    lost Novell volume(s) or lost NTFS partition(s)might have been.

    |------------------------------------------------------------------|
    | File  Options  Registration  Help           Registered  14:05:35 |
    |                    TIRAMISU FOR NOVELL             DATA RECOVERY |
    |            SOPHISTICATED DATA RECOVERY (V2.13)         STATUS    |
    |          (c) '97 by Ontrack Data International                   |
    |                                                    CLASSIFICATION|
    ||--- HD 128 ----||--- HD 129 ----||--- HD 130 ----|   Scan        |
    ||  78|-[ ]----------- Select a volume to recover -------|         |
    ||  31|  START: 238544 ( 942MB)  BS: 8KB  SCORE:29     - |VAL      |
    ||   1|  START: 62544 ( 90MB)  BS: 8KB  SCORE:6          |c        |
    ||   R|  START: 223568 (*378MB)  BS: 8KB  SCORE:1        |t        |
    ||    |  START: 68752 (*605MB)  BS: 8KB  SCORE:1         |e        |
    ||----|  START: 131184 (*684MB)  BS: 8KB  SCORE:1        |         |
    |     |                                                  |E        |
    |     |             OK                Cancel             |         |
    |     |                                                  |ns       |
    |     |--------------------------------------------------|         |
    |                                                      Files       |
    |                                                                  |
    |                                                    DONE          |
    |                                                                  |
    |Alt+F3 Close  F10 Menu  F7 Copy  F8 View          E:28896 403648  |
    |------------------------------------------------------------------|

    Select the entry that describes your lost volume best.
    THE BEST CHOICE IS USUALLY THE FIRST ENTRY.

    Entries with a high score are better than low ones.
    Entries without "*" are better than entries with a "*".
    Ignore entries that start at 0.

    Please read section 7 ("VOLUME SELECTION WINDOW") for further
    information or if the recovery is not successful.

    TIRAMISU FOR NOVELL continues processing. This can take up to 2 hours.

3.4. How to copy some or all files to a safe medium

    Now you see the virtual drive and you can view and copy (registered
    version only) the files to any DOS-available destination by pressing
    the F7-key. Caution: Do not copy to the same drive as then one you are
    recovering


4. RESULTS

    The virtual drive is like a file manager window. It will look like this:

    | File  Options  Registration  Help               Registered  12:13:11|
    |-[ ]------------------ Virtual Drive ----------------------------[ ]-|
    |-ROOT(128)       | IO.SYS           41055 31.05.94 06:22 a__shr8BF0-8|
    | |--AOL25I       | MSDOS.SYS        38186 31.05.94 06:22 a__shr8C0A-8|
    | |  |--DOWNLOAD  | COMMAND.COM      57377 31.05.94 06:22 a____r8BC6-8|
    | |  |--SPOOL     | DRVSPACE.BIN     66294 31.05.94 06:22 a__shr8BD4-8|
    | |  |--ORGANIZE  | AOL25I      <DIR>      05.05.97 13:31 _d____0015-||
    | |     |--SAVE   | AWR         <DIR>      05.05.97 13:31 _d____03FB-||
    | |  |--CCL       | BATCH       <DIR>      05.05.97 13:31 _d____043A-||
    | |  |--IDB       | BITMAP      <DIR>      05.05.97 13:31 _d____044A-||
    | |     |--SAVE   | CHIP        <DIR>      05.05.97 13:31 _d____0475-||
    | |--AWR          | CORELDRW    <DIR>      05.05.97 13:31 _d____070C-||
    | |--BATCH        | CORLSCSI    <DIR>      05.05.97 13:31 _d____0716-||
    | |--00123456     | CSERVE      <DIR>      05.05.97 13:31 _d____073B-||
    | |  |--ANW16     | DBASE3      <DIR>      05.05.97 13:32 _d____0EB8-||
    | |  |--ANW256    | DECODER     <DIR>      05.05.97 13:32 _d____0EF2-||
    | |--CHIP         | DESKJET     <DIR>      05.05.97 13:32 _d____10BE-||
    | |--CLIPART      | DOS         <DIR>      05.05.97 13:32 _d____10DA-||
    | |  |--BUSINESS  | DUMMY       <DIR>      05.05.97 13:32 _d____12AF-||
    | |  |--CARTOONS  | EATEMS      <DIR>      05.05.97 13:32 _d____12B7-||
    |-================----------------------------------------------------|
    |Alt+F3 Close  F10 Menu  F7 Copy  F8 View            E:26320    117696|

    On the left you can see the directory names. If for some reason your
    main directory was destroyed there can be some dummies directories
    ("00123456" or "CLU01234"). You will find the files from the missing
    directories in these dummy directories. This does not affect the quality
    of these files.

    The right-hand side of the window contains the file and directory
    entries of the directory you selected on the left-hand side.

    You can copy (Full or Lite version only) the recovered files either from
    the left or the right side of the virtual drive window. If you want to
    retrieve the whole drive you should select "ROOT" (or "ROOT128") on the
    left side and press F7-Copy. Caution: Do not copy to the same drive as
    the one your recovering

    The quality of the recovered files depends on the condition of the drive.
    The recovery quality of a single file can be checked by selecting the
    file in the right part of the window and pressing the space bar:

    | File  Options  Registration  Help               Registered  12:13:11|
    |-[ ]------------------ Virtual Drive ----------------------------[ ]-|
    |-ROOT            - IO.SYS           41055 31.05.94 06:22 a__shr8BF0-8|
    | |--AOL25I       - MSDOS.SYS        38186 31.05.94 06:22 a__shr8C0A-8|
    | |  ||-[ ]-------------------- LOGO.SYS -------------------------|6-8|
    | |  ||Attributes:     ____h_                                     |4-8|
    | |  ||Date:           05.09.96                                   |5-||
    | |   |Time:           11:11:00                                   |B-||
    | |  ||Length:             129078 (x0001F836)                     |A-||
    | |  ||Start:              203292 (x00031A1C)                     |A-||
    | |   |Group:                   0 (x00000000)                     |5-||
    | |--A|Id:                 203292 (x00031A1C)                     |C-||
    | |--B|Long file name: (none)                                     |6-||
    | |--B|Methode:     DF                                            |B-||
    | |  ||Chaining:                                                  |8-||
    | |  ||00031A1C-00031A1D-00031A1E-00031A1F-00031A20-00031A21-     |2-||
    | |--C|                            Ok                             |E-||
    | |--C|                                                           |--||
    | |  ||-----------------------------------------------------------|F-||
    | |  |--CARTOONS   EATEMS       <DIR>      05.05.97 13:32 _d____12B7-||
    |-================----------------------------------------------------|
    |Alt+F3 Close  F10 Menu  F7 Copy  F8 View     E:26320 F:7576    117696|

    The characters next to "Methode:" tell you something about the quality
    of this single file.

        F - FAT approved. This file has been recovered using a valid FAT
            entry. This is a very good sign. In all probability this file
            is good.
        D - Directory entry found. A directory entry was found for this
            file. This is usually a minimum requirement for a good file
            quality.
        S - Confirmed by signature. Some kinds of files (for example EXE
            files) has signatures. An 'S' indicates that the found data
            indeed have this signature.

    Another way to check the file quality before you copy is viewing it with
    the hex-viewer (F8).


5. RESTRICTIONS

    TIRAMISU FOR FAT16 can only work on drives with 16-Bit Fats, not Fat 32.
    TIRAMISU FOR FAT32 can only work on drives with 32-Bit Fats, not Fat 16.
    TIRAMISU FOR NTFS can only work on drives with NTFS Filesystems,
    not Fat16 or Fat32 partitions.
    TIRAMISU FOR Novell can only work on drives using Novell 386 or Netware
     4.xx.
    TIRAMISU FOR ZIP/JAZ can only work on drives with 16-Bit Fats, which
    applies to most Zip or Jaz diskettes.

    Since TIRAMISU is very memory hungry, your PC might run out of memory.
    If you face this problem, install a memory manager with as much RAM and
    EMS as possible. (EMS not necessary for TIRAMISU FAT32).
    Watch the available memory displayed in the bottom left-hand corner. The
    value displayed at the far right shows the free RAM. The E:XXX shows the
    free EMS. The RAM should not go below 50000.


6. OPTIONS

    There are several options you can change in the OPTIONS->DATA RECOVERY
    screen:

    |-[ ]--------- TIRAMISU Data Recovery Options -------------|
    | Swap area:                                               |
    |  (X) Memory        ***CAUTION: Don't swap to the drive   |
    |  ( ) EMS           you intend to recover!                |
    |  ( ) Disk           D:\TEMP                              |
    |                                                          |
    | Excluded main directory entries:                         |
    |  FILE*.CHK;DIR*.CHK;*._DD;PCT*.FIX;DIR0????.*            |
    |                                                          |
    | Logging to file:                                         |
    |                                                          |
    |  [ ] Force recovery without FAT                          |
    |  [X] LFN (long file name) support                        |
    |  [X] Automatic identification                            |
    |  [X] XBios read                                          |
    |                                                          |
    | Start identification at sector:         0                |
    | Bad file entry acceptance (0-100 %):    50               |
    |                                                          |
    |                  OK                Cancel                |
    |                                                          |
    |----------------------------------------------------------|


6.1. Swap Area

    By default TIRAMISU stores memory intensive data in ram memory. You
    also can store it to EMS or disk drive. Make sure you do not choose
    the drive you are recovering.


6.2. Excluded Main Directory Entries

    This option tells TIRAMISU to ignore files entries that have been created
    during a previous run of another disk doctor (Norton, Scandisk, etc.).


6.3. Logging (Logfile)

    Use this option to create a log file of TIRAMISU's processing.


6.4. Force recovery without FAT

    You usually will not tag on this option. During its structure recognition
    TIRAMISU tries to reconstruct the remaining FAT fragments. However, if
    TIRAMISU finds an old FAT that is not the FAT of the file system you
    want to recover it is better to do the recovery without FAT than with
    FAT.


6.5. LFN (long file name) support (Tiramisu FAT32 and NTFS versions only)

    By default the LFN support is enabled (see also section 7.1).
    If you do not need long file names or your file system did not support
    them you can switch this option off. This speeds up the recovery.


6.6. Automatic Identification (Verify correct file system structure)

    The first thing TIRAMISU does is to retrieve the original structure of
    the file system: place of Fat1, Fat2, main directory, number of sectors
    per cluster, number of clusters.
    If you tag off this option TIRAMISU shows you what it thinks what kind
    of file system it found. You can confirm the suggestion and look at it
    by pressing OK. If you do not confirm the structure TIRAMISU found, you
    can continue the identification procedure by pressing SEARCH AGAIN.
    After a while TIRAMISU will make another suggestion.


6.7. XBios Read - Tiramisu for FAT32 only

    This option enables TIRAMISU to access drives larger then 8 GB by using
    Extended INTERRUPT 13 calls.


6.8. Start Identification At Sector X (multi partition problem)

    By default TIRAMISU starts its identification procedure at sector 0.
    However you may want to recover a later partition. If so you can enter
    a value in this field.
    Example: Let's suppose you have a 600 MB drive with two partitions (400 MB
    and 200 MB). You want to recover the second (200 MB) partition. The first
    partition uses 400 MB space on the hard drive. These are approximately
    800000 sectors (one sector has 512 bytes). Consequently you should enter
    the value 800000 in this field.
    You should tag the "Automatic Identification" off. So you can verify if
    TIRAMISU retrieved the correct file system structure.


6.9. Bad File Entry Acceptance

    TIRAMISU uses statistical algorithms to decide if file entries are
    included into the recovery process. If you set this option to 0
    TIRAMISU is very strict. If you set it to 100 TIRAMISU is very loose.
    50 is a good value. Increase it if you miss some files in the resulting
    virtual drive. Decrease it if you get scrambled results.

6.10. Restart from last / Keep for next session - Tirmaisu for Novell or
    NTFS Only

    The scanning of the drive can take up to several hours. It might be a
    good idea to keep the results of the drive scan for a future run of
    TIRAMISU FOR NOVELL. For doing this select OPTION -> DATA RECOVERY,
    tag KEEP FOR NEXT SESSION.
    This generates two files: SCAN_RES.RST and INTERVAL.RST.
    If you want to use scan results from a previous session tag RESTART
    FROM LAST.
    Specify a directory if you tagged one of these options.
    You always must select this option BEFORE hitting the RECOVER button.


6.11. Valid FAT Required - Tirmaisu for Novell Only

    By default TIRAMISU FOR NOVELL expects to find a valid FAT or at least
    FAT fragments on the drive.
    If TIRAMISU FOR NOVELL does not find the volume you want to recover
    untag this option.
    However, a recovery without any FAT will be poor.


6.12. DET maintainance mode - Tirmaisu for Novell Only

    By default TIRAMISU FOR NOVELL uses Novell's "directory entry tables
    (DET)". It might happen that these DETs are corrupt.
    If you miss files in the "Virtual Drive" tag this option on.
    Please note that this option does not effect the recovery quality of a
    single file.


7. Special Issues

7.1 For TIRAMISU for Novell Only

    VOLUME SELECTION WINDOW

    In this window you have to choose which volume you are going to
    recover. It is the most important decision you have to make
    during the data recovery process.

    |------------------------------------------------------------------|
    | File  Options  Registration  Help           Registered  14:05:35 |
    |                    TIRAMISU FOR NOVELL             DATA RECOVERY |
    |            SOPHISTICATED DATA RECOVERY (V2.13)         STATUS    |
    |          (c) '97 by Ontrack Data International                   |
    |                                                    CLASSIFICATION|
    ||    HD 128     ||    HD 129     ||--- HD 130 ----|   Scan        |
    ||  786* 64* 63  ||  611* 64* 63  || 1024* 64* 32  |               |
    ||  3169152|-[ ]----------- Select a volume to recover -------|    |
    ||   1547 M|  START: 238544 ( 942MB)  BS: 8KB  SCORE:29       |    |
    ||   RECOVE|  START: 62544 ( 90MB)  BS: 8KB  SCORE:6          |    |
    ||         |  START: 223568 (*378MB)  BS: 8KB  SCORE:1        |    |
    ||         |  START: 68752 (*605MB)  BS: 8KB  SCORE:1         |    |
    |          |  START: 131184 (*684MB)  BS: 8KB  SCORE:1        |    |
    |          |                                                  |    |
    |          |             OK                Cancel             |    |
    |          |                                                  |    |
    |          |--------------------------------------------------|    |
    |                                                                  |
    |                                                    DONE          |
    |------------------------------------------------------------------|
    |Alt+F3 Close  F10 Menu  F7 Copy  F8 View          E:28896 403648  |
    |                                                                  |

    Select the entry that describes your lost volume best.
    THE BEST CHOICE IS USUALLY THE FIRST ENTRY.

    Every entry contains the following information:

    - Start sector of this volume (to be more exact: start of first FAT
      of this volume)
    - Size of this volume
    - Block size used by this volume
    - Score (entries with high scores are more likely to be valid than others)
    - A '*' indicates an inconstistency between the found FAT and the data

    Entries with a high score are better than low ones.
    Entries without "*" are better than entries with a "*".

    Please note that the proposed volumes are not neccessaryly real
    existing volumes. TIRAMISU uses advanced pattern recognition
    algorithms to decide which structure was the most likely.

    If the default choice does not show correct results or you are recovering
    a volume of a drive with more than one volume you must have a close look
    at the VOLUME SELECTION WINDOW.

    Example:

        Let's suppose you want to recover the third attached hard drive
        (HD 130). It is a 1GB drive that had this design before the
        crash:
        - 1 small DOS partition with 10MB
        - 1 Netware partition with two volumes:
            One volume with about 80MB
            One volume with about 900MB

        We want to calculate now which values for "START" we are looking
        for. The Netware partition begins after the small DOS partition.
        Therefore it begins approximately at sector 20000 (1 sector =
        0.5KB).
        However, the start of the file system is defined by TIRAMISU as
        the location of cluster 0. This is usually the location of the
        start of the first FAT, not the start of the partition.
        The disk space used for additional administration outside of the
        file system takes about 20MB.
        Therefore the start of the first volume (to be exactly: cluster 0
        of the first volume's file system) is somewhere at sector
        60000.
        The 2nd entry of the window will be correct for the 1st
        volume. The displayed size (90MB) is similar to the remembered
        size (80MB).

        If you want to recover the 2nd volume add the size of the
        first volume (80-90 MB) to the 60000 from the calculation above.
        This is a value of about 230000. Entry one is the correct entry
        for the 2nd volume.

        |-[ ]----------- Select a volume to recover -------|
        |  START: 238544 ( 942MB)  BS: 8KB  SCORE:29       |
        |  START: 62544 ( 90MB)  BS: 8KB  SCORE:6          |
        |  START: 223568 (*378MB)  BS: 8KB  SCORE:1        |
        |  START: 68752 (*605MB)  BS: 8KB  SCORE:1         |
        |  START: 131184 (*684MB)  BS: 8KB  SCORE:1        |
        |                                                  |
        |             OK                Cancel             |
        |                                                  |
        |--------------------------------------------------|

    HINT: If possible do not use entries with a '*'.

    If the volume you want to recover is definitely not listed please
    read section 8.4. ("Drive structure recognition routine fails").

7.2 For TIRAMISU for NTFS Only
PARTITION SELECTION WINDOW

    In this window you have to choose which partition you are going to
    recover.
    |------------------------------------------------------------------|
    | File  Options  Registration  Help           Registered  14:05:35 |
    |                     TIRAMISU FOR NTFS            DATA RECOVERY   |
    |            SOPHISTICATED DATA RECOVERY (V1.52)       STATUS      |
    |         (c)'96,'97 by Plug'n Play, Uwe Gissemann                 |
    |                                                  CLASSIFICATION  |
    ||  |-[ ]------- Select a NTFS partition to recover -----------|   |
    || 1|  START: 62  BS: 0.5KB  (BOOT RECORD APPROVED)            |   |
    ||  |  START: 62  BS: 0.5KB  SCORE:100.0                       |   |
    ||  |  START: 10574  BS: 0.5KB  SCORE:25.0                     |   |
    ||  |  START: 67646  BS: 0.5KB  SCORE:25.0                     |   |
    ||  |  START: 68110  BS: 0.5KB  SCORE:25.0                     |   |
    ||  |                                                          |   |
    |   |             OK           Manual         Cancel           |   |
    |   |                                                          |   |
    |   |----------------------------------------------------------|   |
    |                                                    Virtual Drive |
    |                                                                  |
    |                                                  DONE            |
    |------------------------------------------------------------------|
    |Alt+F3 Close  F10 Menu  F7 Copy  F8 View            E:28M 418368  |
    |                                                                  |
    Select the entry that describes your lost partition best.
    THE BEST CHOICE IS USUALLY THE FIRST ENTRY.

    Every entry contains the following information:

    - START: Start sector of this NTFS partition
    - BS:    Block size used by this NTFS partition
    - SCORE: (entries with high scores are more likely to be valid than
             others)
        OR
      BOOT RECORD APPROVED

    TIRAMISU uses two different drive structure recognition routines.
    One searches for signatures ("BOOT RECORD APPROVED") the other
    uses pattern recognition routines and creates a list of "possible"
    partitions ("SCORE: XXX%").

    Entries with a high percentage are better then low ones.
    It is best to have a BOOT RECORD APPROVED and a high percentage entry
    describing the same partition (START: 62, BS: 0.5KB in our example
    above).

    Please note that the proposed partitions are not necessarily real
    existing partitions. TIRAMISU uses advanced pattern recognition
    algorithms to decide which structure was the most likely.

    If the default choice does not show correct results or you are recovering
    another than the first partition of a drive with more than one partition
    you must have a close look at the partition selection window.

    Example 1 - Problems with the recovery of the one and only partition:

        The Problem:  Your drive had only one partition and this partition
                      was a NTFS partition. The default choice in the
                      "Select Partition" window does show only garbage
                      files. (Please read section "RESULTS" on this.)

        The Solution: Since there is only one partition the start sector
                      should be somewhere between 0 and 100.
                      Try the entries that have a start sector between 0 and
                      100.
                      If you still do not get good results try to remember
                      the start sector and the cluster size of your partition.
                      If your drive had only one partition it usually
                      starts at the first sector at the second head at
                      the first cylinder.
                      In our example above we have a drive with
                      898 x 15 x 62 sectors.
                      The NT partition would usually start at (0, 1, 1).
                      (Cylinders and heads start counting at 0, sectors
                      start at 1).
                      In logical addressing starting at 0 this is
                      sector 62.
                      The "block size" is usually 1 sector (=0.5 KB).
                      It is possible to enter the partition parameters
                      manually in the "Select Partition" window. In our
                      example you would have to enter "62" as the start
                      sector and 512 (0.5KB) as the block size.
                      Maybe you have to try other block sizes too (possible
                      block sizes are 0.5KB, 1.0KB, 2.0KB, 4.0KB).

    Example 2 - Problems with the recovery of another than the first
                partition:

        The problem:  You had more than one partition on your drive
                      and you want to recover a different than the first
                      one.

        The solution: Let's suppose you have a 2GB drive.
                      You remember the following layout:

                          1 DOS (FAT) partition 500 MB
                          1 NTFS partition 600 MB
                          1 NTFS partition 900 MB

                      You want to recover the last NTFS partition. It starts
                      somewhere at 1.1 GB (= sector 2200000). You should
                      look for a partition starting somewhere at about
                      2200000.

    As a last choice tag OPTIONS->FAST IDENTIFICATION off. This measure
    might show you different entries in the "Select Partition" window.



8. TROUBLE SHOOTING

    Sometimes you might think the computer is frozen and TIRAMISU is
    crashed. Be patient! Some procedures might take up to one hour. If
    TIRAMISU crashes you usually get an error code.


8.1. Wrong Disk Size

    A nasty source of problems is a wrong disk size reported from BIOS.
    Check the size TIRAMISU thinks your drive has:

        |--- HD 128 ----|
        | 1022*64* 63   |
        |  4120704 sec  |
        |   2012 MB     |
        |   RECOVER     |
        |               |
        |---------------|

    If this size (2012 MB in this example) is not correct you won't get
    correct recovery results.

    Reboot your computer and enter the BIOS setup. Let it "auto detect"
    (if available) the drive size or enter the values manually.
    If the drive is bigger than 504 MB make sure the LBA mode is enabled.

    If you still get a wrong drive size try this (experts only!):

        - make a backup of the very first sector (physical sector 0,0,1)
        - Overwrite the very first sector (512 bytes) with zeros.

    You can use a generic disk editor for this task.
    Reboot the computer again.


8.2. Drive Structure Recognition Routine

    If you only get scrambled results it could be because the TIRAMISU
    drive structure recognition routine has failed. Try this:
    Select OPTION -> DATA RECOVERY, tag 'AUTOMATIC IDENTIFICATION' off.
    Press RECOVER. After a while you get a window that suggests a certain
    drive structure:

    |-[ ]---------------------- Drive structure -----------------------|
    |STRUCTURE-INFORMATION FOR DRIVE: 129                              |
    | 620 Cyl x  64 Heads x  63 Sec = 2499840 phys. Sect. = 1220 MByte |
    |                                                                  |
    |Cluster size: 8 (x08)                                             |
    |Data start (Cluster 0) at sector: 4957 (x0000135D)                |
    |Last Cluster: 312191 (x0004C37F)                                  |
    |                                                                  |
    |FAT start: 95 (x0000005F)                                         |
    |FAT end:   2533 (x000009E5)                                       |
    |                                                                  |
    |Free:             439 (x000001B7) Cluster =  0.14 %               |
    |Reserved:           0 (x00000000) Cluster =  0.00 %               |
    |Used:          311751 (x0004C1C7) Cluster = 99.86 %               |
    |Bad:                0 (x00000000) Cluster =  0.00 %               |
    |Undefined:          0 (x00000000) Cluster =  0.00 %               |
    |                                                                  |
    |       Ok          Search again      Cancel                       |
    |                                                                  |
    |------------------------------------------------------------------|

    Check the value "Cluster size". It tells you how many sectors a cluster
    uses. In the example above the cluster size is 8 sectors (=4 KB).

    Check the value of "Data Start (Cluster 0) at sector". If you are
    retrieving the first partition it should be below 10000. If you try to
    retrieve - let's say - the 2nd partition of a 2 GB drive with two 1 GB
    partitions this value should be around 2010000.

    Check the value of "Last Cluster". Do the following calculation:

        (Last Cluster * Cluster Size) / 2

    This is the size (in KB) of the partition you are going to recover.
    In the example above the partition size is

        312191 * 8  / 2  =  1248763 KB

    This is approximately 1.2 GB. Since I know that my 1.2 GB drive had one
    partition this suggestion is likely to be correct.

    If you are not satisfied with what you see you can press 'Search Again'.
    TIRAMISU tries to retrieve another structure. Repeat this until the
    proposed structure seems to be correct.
    Finally press 'Ok'.

    If you do not get any satisfying results you should check that you really
    did have a 32-bit Fat system. If when you started for Fat 32 you got a
    message early on saying that no valid fat could be found, it could well be
    that you have something other than a fat 32 format.


8.3. Missing files or directories

    You can change the option "Bad file entry acceptance". 0% means a
    very strong directory recognition routine. Use this only if TIRAMISU
    crashes.
    100% means a very loose directory recognition routine. Use if TIRAMISU
    goes through but you miss some directories. 50% is a good standard value.


8.4. Computer frozen or Runtime error

    Sometimes you might think the computer is frozen and TIRAMISU FOR NTFS
    is crashed. Be patient! Some procedures might take up to one hour. If
    TIRAMISU FOR NTFS crashes you usually get an error code.

    If the program crashes check the available EMS and disk space. 16 MB ram
    with 8 MB configured as EMS are good.


8.5. The resulting files contain garbage only

    If you get only garbage files please read section 7
    ("PARTITION SELECTION WINDOW")


8.6. No partition found at all: TIRAMISU FOR NTFS

    If TIRAMISU FOR NTFS does not find any partition tag off the option
    "Fast identification". Re run TIRAMISU FOR NTFS.
    Read section 7 ("PARTITION SELECTION WINDOW").


8.7. "Restrict sectors" must match previous setting

    If you selected "Restrict sectors" *and* "Keep for next session" you
    must enter the same sector range for a further session using "Restart
    from last".



8.8. Other Disk Tools

    You should not use any other 'disk doctor' before running TIRAMISU. If you
    did so, please 'undo'.
    If you cannot 'undo' you can tell TIRAMISU to ignore the file entries
    the 'disk doctor' created (something like FILE0000.CHK...).
    Select OPTION -> DATA RECOVERY, modify the field 'Exclude Main
    Directory Entries'.


8.9. Get a New Version

    Download a new version from our Internet site (address below).
    If you find any bugs, please send a description: use our support form at:
    "http://www.ontrack.com".


9. OTHER FUNCTIONS

    The FILE menu contains some additional functions. They are described
    below.


9.1 Long File Names (LFN) - Tiramisu for FAT32 only

    TIRAMISU is able to retrieve the WIN95 long file names (LFN). The
    recovery itself is done using the short (alias) names. After copying
    the data to a safe medium you can select FILE->CREATE LONGNAME BATCH.
    You will be prompted for a file name. Type in 'LONGNAME.BAT' for
    example (IMPORTANT: Do not write this file to the drive you are
    recovering). TIRAMISU will create a batch similar to this:

    |-----------------------------------------------------------------------|
    | REM TIRAMISU long name batch created: 19970604 16:35:17               |
    | REM This batch file renames the recovered file to the long file names |
    | REM This batch must be started in a WIN95 dos box                     |
    | REM Check that the path names are correct                             |
    | ren \ROOT\00036326\AOL&IN~1.LNK "AOL & Internet jetzt testen!.lnk"    |
    | ren \ROOT\PROGRA~1\MICROS~1 "Microsoft Exchange"                      |
    | ren \ROOT\PROGRA~1\INTERN~1 "Internet Explorer"                       |
    | ren \ROOT\PROGRA~1\THEMIC~1 "The Microsoft Network"                   |
    | ren \ROOT\PROGRA~1\ICW-IN~1 "ICW-Internet Connection Wizard"          |
    | ren \ROOT\PROGRA~1\ONLINE~1\COMPUS~1 "CompuServe"                     |
    | ren \ROOT\PROGRA~1\ONLINE~1 "Online-Dienste"                          |
    | ren \ROOT\PROGRA~1 "Programme"                                        |
    | ren \ROOT\VERKNš~1.LNK "Verknpfung mit Fawin.lnk"                     |
    | ren \ROOT\WINDOWS\SENDTO\3_5-DI~1.LNK "3,5-Diskette (A).lnk"          |
    |-----------------------------------------------------------------------|

    Run this batch under WIN95. Make sure it shows the correct path names,
    especially if you copied your files to a different location.


9.2 Save & Load a Recovery

    You can save a successful recovery on disk using the SAVE command (F2).
    You will be prompted to specify a file name. Depending on the size of
    the drive you are recovering, the size of this file can be up to 20 MB.
    IMPORTANT: Do not write this file to the drive you are recovering.

    After starting TIRAMISU you can load a previous saved recovery using
    the LOAD command (F3).
    Make sure the matching drive is selected (high-lighted). Do not load
    the stored recovery for a different drive.


10. REGISTRATION

    TIRAMISU IS DISTRIBUTED AS SHAREWARE. The shareware version has all
    Functions for recovering your crashed hard drive. But only the
    licensed versionof TIRAMISU allows you to COPY files from your
    recovered drive.

    There are two kinds of licenses available:

    - A Tiramisu Lite (five file) license that can be used 
    - for copying five files per execution. An unlimited number
    - of excutions may be run at a maximum of five files copied each run.
 

    - An unlimited license that can be used for an UNLIMITED PERIOD on
      different computers, but not at the same time.

    - The registration of ID Codes is no longer necessary. 

11. NO WARRANTY

    The quality of data recovery that is done by TIRAMISU depends on:

        - the physical condition of the hard drive
        - the fragmentation of the files
        - the grade of the loss of drive information

    TIRAMISU data recovery software, as all applications, has limitations.
    We cannot provide recovery capabilities under certain conditions. Due
    to the many variables associated with drive corruption, we cannot
    guarantee recovery in all cases.

    However, downloading and running the shareware version gives you the
    closest idea to what we can offer.
    All customers are recommended to check the files with the built-in
    quality control (file information and file viewer) before they buy.

    We do not do refunds.


12. LICENSE AGREEMENT 

    Please refer to the LICENSE.TXT file that comes with Tiramisu software.


(c) Ontrack Data International
11:20  2/17/99