MRECOVER 1.85
Partition and Data Recovery Software
By Monirul Islam Sharif
---------------------------------------------------------------------------
ABOUT THIS DOCUMENT:
--------------------
This small document will provide necessary information about the features,
limitations and usage of this software. This documentation is just given
for the convenience of the user, as all online help and information could
not be included into the software itself due to lack of time. This document
will also outline what's new in MRECOVER 1.85. Please visit the web site
http://members.xoom.com/monirdomain, for upto date information and new
versions of the software.
RELEASE NOTES:
--------------
I am very sorry to say that all the versions 1.8, 1.81 and 1.82 had bugs
which prevented it from working in a lot of situations. The new features
I added to 1.71 caused this problem, and I've very sorry to all of the people
out there who have tried it out.
MRECOVER 1.85 should work as it is supposed to please inform me of problems
it encounters and if it works.
MRECOVER software was written primarily for recovering data from harddisks
that have been damaged by the CIH virus. This software has been made FREEWARE
So you can freely distribute it. I request to see to it that it is not used
in any money earning activities by others.
The Chernobyl virus, also known as the CIH virus normally destroys the
partition table along with the a vital portion of the first partition.
The partition table stores information that allows access to each individual
partition in the hard disk. Although the partition table is destroyed, MRECOVER
will successfully and automatically rebuild the partition table by searching
the hard disk for valid partition sequences in all hard disks. Although many
other commercial softwares like NDD can rebuild partitions, this job isn't
straightforward.
Now speaking of the data contained in each partition, it is possible to
recover all the data from the partitions except the first one in all cases.
That means if you have not much important data in your first partition then
you are lucky. MRECOVER will be able to recover your first partition too if
it used FAT32 and is greater than 1GB. The loss of vital information prevents
straightforward data recovery from the first partition.
If you had FAT32 in the first partition, after MRECOVER runs and reboots,
you should be able to be in the state before the accident occurs. If not you
shoud be able to access the later partitions.
What's new in version 1.85:
* MRECOVER 1.85 is now a finally well tested update to 1.8, 1.81 and 1.82.
* MRECOVER should now identify and recover LINUX partitions (except the first
one).
* MRECOVER will now try to identify if the first partition's file system is
FAT32 automatically. This means you don't need to enter the type if you're
not sure.
* A bug has been fixed which caused the computer to hang while repairing some
FAT32 primary partitions.
* The messages and instructions inside the program have been made more
informative. The message 'you have to format' has been removed. Well I didn't
mean that you'll have to format if MRECOVER fails, but incase a lot of people
might misunderstand, I've removed it (should've done this a long time ago).
* Last of all although it's not that important, I've optimized the code, so it's
a lot smaller (50KB, compared to 80KB of MRECOVER 1.71)
* /F option has been added to forcefully mark the first partition as FAT32 and
proceed with the recovery of it. You can select this if you've accidentally
selected the first partition as a different type, or you know what you're
doing.
* A bug of MRECOVER 1.8 is fixed which sometimes tells you in Phase 2 that
you don't have a FAT32 even though in Phase 1 it did find one! What a lame
bug... and MRECOVER 1.81 does not reboot when it says it will (another one)
REQUIREMENTS
------------
It is required that after the CIH attack, you have not formatted your harddisk
or changed the contents with other software.
USING THE SOFTWARE
------------------
You will first have to boot from a system disk and run MRECOVER from a floppy.
Please change the boot sequence from the BIOS to boot from the floppy first
if it not booting from the floppy. If you have a damaged BIOS then please
repair it first.
After running MRECOVER you will be provided with necessary information with
how to proceed. You will be asked to select a hard disk from a list (if you
have more than one physical hard disks in your system the list will show you
them). The current status of the selected hard disk will be shown. This
status will include current information about the partitions. Recovery work
will proceed in two phases.
Phase 1: Parition table recovery:
If no valid partition information is found you will be asked if there was
more than one partition in your system. Select 'N' to not proceed with search
and you will be asked if you want to assign all the space to one partition.
Please make sure what you are doing in this stage. But if you accidentally
select that you don't have more than one partition and assign all the space
to one, you can still run the program again and the next time search for
the other partitions. The contents will not be damaged.
You will be prompted for the estimated size of the first partition. This is
asked only in speeding the search and it need not be accurate at all. But
PLEASE REMEMBER TO give a smaller size than the actual one. If you are not
sure then give 0, to search from the beginning.
After finding a partition sequence you will be shown the information. If you
are happy with the searched out partition list then select `Y'. You will be
prompted again to make sure. Then rebuilding the partition table will start.
MRECOVER can automatically check to see if the first partition was FAT32
or not. If you it's not you will be asked for type of the first partition.
FAT32 is a format supported by Windows 95B and later releases (Windows
95B is also called Windows 97 by some people).
Phase 2: Recovery of first partition:
After rebuilding the partition, if the first partition is FAT32, MRECOVER
should be able to recover its contents. If not you will see the drive letter
after rebooting but will not be able to access. Please try other software
to recover data. The contents of that partition are left untouched by
MRECOVER. The problem is my FAT16 version will not be ready for a long time,
and I really apologize for it.
Type MRECOVER /F to forcefully mark the first partition as FAT32 and
proceed with the second phase. Use this option if you have accidentally
selected a wrong type.
CONCLUDING NOTES:
-----------------
This software has been used by a lot of people throughout the world and tested.
I'm not having much time in updating the software and adding new features
although I have plans. So I request feedback, in case of bugs and other
problems of the program.Please write me about any severe flaws in the program.
Please visit my web site for updated information and new releases.
I'm really not having luck with the FAT16 version of recovery software, so
I'm temporarily shifting away from it's development. The program uses a
completely different technique than MRECOVER, and is taking a long time to
develop, I'll try to complete it by next month.
I'm really sorry for this, and all the people out there who had FAT16 please
try other software for the time being.
The program MRESCUE should be ready in a week. It will keep a backup of the
vital information about partitions, and FAT, so that you can be ready for
any disasters like this in the future. I'm thinking of making it free too.
Please visit my web page for updated and detailed information:
http://members.xoom.com/monirdomain
Goodluck...
-Monirul Islam Sharif
Author of MRECOVER
Student, Dept. of Computer Science, Dhaka University, Bangladesh.
E-mail: monir@innocent.com
Update History:
---------------
28 April 1999 - MRECOVER 1.0 First release
30 April 1999 - MRECOVER 1.05 Bug fixed, and supports 8GB harddrives
01 May 1999 - MRECOVER 1.5 Ability to fix FAT32 first partitions.
02 May 1999 - MRECOVER 1.51 Minor bug fixed.
04 May 1999 - MRECOVER 1.7 Major bug fixed release, tested on a lot of
FAT32 partitions. [the first one released on
the internet]
06 May 1999 - MRECOVER 1.71 [the most successful one]
17 May 1999 - MRECOVER 1.8 New features
18 May 1999 - MRECOVER 1.81 Lame bug of version 1.8 fixed.
20 May 1999 - MRECOVER 1.82 A small bug of version 1.81 fixed.
22 May 1999 - MRECOVER 1.85 Well checked version fixing a major bug which I
overlooked a lot of times.
