Active@ UNERASER for DOS 

Copyright (C) 2002 Active@ Data Recovery Software 
All rights reserved. 
 

USERS MANUAL 
 

Table of Contents

1. PRODUCT OVERVIEW 
2. SYSTEM REQUIREMENTS 
3. DIFFERENCES BETWEEN DEMO AND COMMERCIAL VERSION 
4. OPERATING PROCEDURES 
	4.1. Bootable floppy disk (startup disk) preparation 
	4.2. Program start and information display 
	4.3. Scan and search for deleted file(s)/folder(s) 
	4.4. Deleted file(s)/folder(s) recoverability check 
	4.5. Deleted file(s)/folder(s) recovery (Commercial version only) 
	4.6. Scan and detection of deleted partition(s) and drive(s) 
	4.7. Scan existing or damaged partition(s) and drive(s) 
	4.8. Backup MBR, Partition Table, Volume Boot Sectors 
	4.9. Virtual restoration of MBR and Partition tables(s) 
	4.10. Disk Image creation 
	4.11. Using Disk Viewer 
	4.12. Localized file names display 
	4.13. Long file names display 
	4.14. Command line parameters 
5. RECOVERY TIPS 

 
 
1.	PRODUCT OVERVIEW
 
Active@ UNERASER is a compact and powerful DOS utility that can recover 
deleted files and folders on FAT12, FAT16, FAT32 and NTFS systems. It can 
even restore your files from deleted partition(s)! 
 
With this data recovery software you can access NTFS volume(s) from DOS 
and can recover deleted item(s) from NTFS partitions. This software does 
not even require you to install it on your system's hard drive, so there are 
no risks of possible overwriting data, which you want to recover. 

 

2.	SYSTEM REQUIREMENTS
 
Minimum system requirements for Active@ UNERASER are: 
- AT compatible CPU with 286 or newer processor 
- 640Kb of RAM 
- 1.44 Mb floppy diskette drive 
- EGA 640x480 or better screen resolution 
- Bootable Floppy disk containing MS-DOS 6.0+, or startup disk for 
  Windows 95/98/ME/XP
- HDD of type IDE/ATA/SCSI attached to be recovered. 
 

3.	DIFFERENCES BETWEEN DEMO AND COMMERCIAL VERSION

Active@ UNERASER for DOS version                           DEMO COMMERCIAL 

Can be saved and run from bootable floppy                   Yes   Yes
Displays complete physical and logical drive information    Yes   Yes
Supports IDE / ATA / SCSI drives                            Yes   Yes
Supports large (more than 8GB) Hard Drives                  Yes   Yes
Supports FAT12, FAT16, FAT32, NTFS, NTFS5 file systems      Yes   Yes
Supports non-english and long file names                    Yes   Yes
Supports compressed and fragmented files on NTFS            Yes   Yes
Supports MS-DOS, Windows 95/98/ME/NT/2000/XP partitions     Yes   Yes
Detects deleted primary/extended partitions and drives      Yes   Yes
Scans partition(s) damaged by virus or with damaged MBR     Yes   Yes
Ability to check file(s)/folder(s) recoverability           Yes   Yes
Ability to preview file(s)/folder(s) before recover         Yes   Yes
Supports search by file name or mask                        Yes   Yes
Disk Viewer displays content of any sector on the drive     Yes   Yes
Ability to create Disk Image                                Yes   Yes
Creates backup for MBR, Partion Table, Boot Sectors         Yes   Yes
Virtually restores MBR and Partion Table from backup        Yes   Yes
Un-erases and saves deleted files/folders onto FAT drive     -    Yes
Copies existing files/folders from FAT/NTFS to FAT drive     -    Yes


4.	OPERATING PROCEDURES
 
4.1 Bootable floppy disk (startup disk) preparation 

If you do not have bootable floppy disk, you can make one using MS-DOS, 
Windows 95/98/ME/XP following these steps: 

FROM MS DOS Prompt

- Boot the system in MS-DOS or Command Prompt mode, 
- Insert a blank floppy and type:  
		FORMAT A: /S 
  and follow the instructions on a screen.
 
FROM WINDOWS 95/98/ME

- Boot the system in Windows 95/98/ME. 
- Open the "Control Panel" and click the "Add/Remove Programs" icon. 
- Switch to tab "Startup Disk" and click the button "Startup Disk" 
  and follow the instructions
 
FROM WINDOWS XP 

- Boot the system in Windows XP
- Insert blank floppy, and right-click A: drive in Windows Explorer
- Choose "Format",  and select the "Create an MS-DOS startup disk" 
  option. Click the "Start" button

Copy Active@ UNERASER for DOS (UNERASER.EXE) to the bootable floppy disk


4.2 Program start and information display 

- Boot from the floppy drive in DOS mode, or in Command Prompt 
  mode in Windows 95/98
- Run Active@ UNERASER for DOS by typing: 
		UNERASER.EXE
- The UNERASER program window will open up. 
- On the left side of the window you will see the list of detected Hard 
  Disk Drives (HDD).
- HDD Partitions and Logical Drives are displayed underneath.
- Deleted partitions and HDD space not occupied by partitions will 
  be shown as "Unallocated space". 
- Use the arrow keys to move the cursor between the HDD and logical 
  drives. Positioning cursor to a particular drive, displays its 
  information on the right side of the program window.
 
  
4.3. Scan and search for deleted file(s)/folder(s) 
 
If you know the exact location of the deleted file or folder, you can scan the 
drive and folders by:

- Selecting the drive containing the deleted file(s) and scanning it by 
  pressing the [ENTER] key.
- Positioning the cursor to the proper folder and scanning the folder by 
  pressing the [ENTER] key.
- Repeat scanning until you reach the folder where the file or folder is 
  located
 
Deleted files are marked with a solid mark on the left side
 
If you do not know the exact location of the deleted file(s), use the search 
mode by:

- Selecting the drive containing the deleted file(s) and pressing the 
  [Ctrl]+[F] keys.
- Enter the exact filename or search pattern in the "Search Dialogue 
  type" and pressing the [ENTER] key.
- Search will initiate. You can stop the search process at any time by 
  pressing the [ESC] key.
- If file(s) matching the search pattern are found, the file information 
  is displayed.
- Press the [Ctrl]+[F] keys to continue searching if you are unable to 
  locate the required file(s). 
- Press the [ENTER] key to go directly to the folder where the file was
  located or press the [ESC] key to cancel further search

The search pattern to use to find the file(s) and folder(s) is the same pattern 
that is used when performing search in DOS or Windows. 

The * (asterisk) symbol is used as a wild card character(s). * during the search 
process is replaced by any allowed possible character(s) available on the 
system for search purposes.  

The ? (Question mark) symbol is used for a single wild card character and is 
replaced by any allowed possible character available on the system for search 
purpose.  
 
Examples for searchable expressions:
	*          - All files in the folder(s) or drives(s)  
	*.TXT      - all files with the "TXT" extension 
	My*.*      - all files starting with "My" text 
	MyFile.txt - search for the file named "MyFile.txt"


4.4. Deleted file(s)/folder(s) recoverability check 
 
To check for recoverability for deleted file(s)/folder(s) use the following 
steps:

- Boot in DOS mode and run Active@ UNERASER for DOS
- Scan or search for deleted file(s)/folder(s) (see paragraph 4.3)
- Find and position the cursor on a detected deleted file or folder. 
  Deleted file(s)/folder(s) are marked on the left side.
- Press the [ENTER] key to check the file's recoverability by previewing 
  the deleted file content. 
- If the file is recoverable - its content can be seen in the Disk Viewer. 
- If the file is not recoverable - an error message is displayed. 

You can check for the folder's recoverability at the same way. Try to open the 
folder by pressing the [ENTER] key. If the folder is not recoverable an error 
message is displayed. But if the folder is recoverable only the file(s) or sub-
folder(s) inside that folder are displayed instead.  
 
Note: 
A deleted file is unrecoverable if overwritten with other data, or if the file's 
header in the root folder is overwritten/ damaged. A deleted folder is 
unrecoverable if the folder's header is overwritten/damaged. Usually it 
happens when data is written / saved onto the drive where the deleted 
file/folder is located.  
 
 
4.5. Deleted file(s)/folder(s) recovery (Commercial version only) 
 
This functionality is only available in the commercial version of Active@ 
UNERASER for DOS.

Use the following steps to recover deleted file(s)/folder(s):

- Boot in DOS mode and run Active@ UNERASER for DOS
- Scan or search the deleted file(s)/folder(s) (see section 4.3)
- Find and position the cursor on your deleted file(s)/folder(s). Deleted 
  files and folders are marked at the left side 
- (Optionally) Press the [ENTER] key to check for the recoverability by 
  previewing the content of deleted file(s)/folder(s) (see section 4.4)
- Press the [Ctrl]+[U] keys to execute the unerase command
- If file(s)/folder(s) is recoverable, a dialog box is displayed where you 
  can choose the output drive and path where the file(s)/folder(s) will 
  be saved. 
- If it is not recoverable, an error message will be 
  displayed instead.  
 
Note:
The number and drive letters in this dialog box may not match with what was 
displayed in the previous window. It happens because the write operation is 
performed in DOS real mode and only the FAT drives are visible to the 
operating system as the output location. 

- Use the [TAB] key to move between controls, and press the [ENTER] 
  key to change the drive or folder
- Define the output name and location and press the [ENTER] key and 
  start the recovery process 
- You can stop the recovery process at any time by pressing the [ESC] key
- If you recover a folder, all recoverable file(s) and/or sub-folder(s) 
  located in the deleted folder will be recovered and saved to the new 
  location recursively.

 
4.6. Scan and detection of deleted partition(s) and drive(s)

To scan and detect the deleted partitions and drives use the following steps:

- Boot in DOS mode and run Active@ UNERASER for DOS
- Position to "Unallocated" line below the HDD containing deleted 
  partition
- Press [ENTER] to scan drive. If partition or logical drive is found, you 
  are suggested to add it to the drive's list
- If the partition parameters look similar, press the [Y] key to add it to 
  the list and skip space equal partition size, otherwise press the [N] 
  key to continue to scan the space allocated by this partition.
- When a partition is properly detected and added to drive's list, 
  position the cursor on the partition line and verify the partition's 
  information 
- Press the [ENTER] key to scan the deleted partition for files(s) and/or 
  folder(s)
- Scan, search and recover file(s) and folder(s) on this virtual drive the 
same way as it's described in sections 4.3, 4.4, 4.5


4.7. Scan existing or damaged partition(s) and drive(s)
 
When a partition is damaged, it will be displayed as type "Unknown".
Active@ UNERASER cannot handle such a partition properly and is unable to 
preview the files and folders in that partition. 

It does not mean that the partition does not exist. It exists but as there is no 
"Unallocated" space on the screen, due to which it cannot scan it for other 
partition information detection. 

To solve this problem, start the program using the parameter -ignoreMBR. 
This will start Active@ UNERASER while ignoring the default MBR and partition 
information. This makes the Active@ UNERASER to scan the drive as if all the 
drives partitions are deleted.  
 
For example: 
			A:\>UNERASER.EXE -ignoreMBR=80h

After scanning, the "Unallocated" space will be displayed under HDD 80h.
 
Try to scan it by pressing the [ENTER] key to detect and recover partitions as 
described in section 4.6. 
 
 
4.8. Backup MBR, Partition Table, Volume Boot Sectors 
 
To make backups of MBR, Partition Table(s) and/or Volume Boot Sector(s) use 
the following steps:

- Run Active@ UNERASER for DOS
- Select the HDD which is to be backed up
- Insert the floppy disk and press the [Ctrl]+[B] keys
- Information will be saved to A:\HDD80h.MBR if HDD 80h is being backed up.
 
Using this floppy the system's MBR can be virtually restored and partitions and
drives will be viewable for the files and folders to be recovered.  
 
Note:
It is strongly advised to make MBR and partitions backup every time the 
computer configurations is changed (such as adding/removing HDDs, partitions, 
logical drives).  
 

4.9. Virtual restoration of MBR and Partition Table
 
To virtually restore the MBR and Partition Table from backup use the 
following steps:

- Insert floppy disk with the backup MBR file
- Run Active@ UNERASER for DOS with the parameter of -restoreMBR like: 
			
			A:\>UNERASER.EXE -restoreMBR=80h

- It will virtually restore the MBR and Partition Table(s) to the state as 
  it was before (when the MBR backup was created). You can see your 
  drives and folders, and can recover the deleted file(s) and folder(s) 
  to another drive (see sections 4.3, 4.4, 4.5).
 
It is important to make MBR and Partition Table backup regularly. 
 
If a partition becomes damaged and requires restoration from the backup MBR, 
Partition Table and Volume Boot Sectors to the HDD, please be advised to use 
Active@ Partition Recovery software. 
 
 
4.10. Disk Image creation 
 
A Disk Image is a copy of the hard drive saved in file. Disk Image can be useful 
for backup purposes or, even for the analysis by other utilities. 

Using Active@ UNERASER a Disk Image can be created for the whole Hard Disk 
Drive(s) as well as for a particular logical drive. Use the following steps for 
this purpose: 

- Run Active@ UNERASER for DOS
- Select the drive (HDD or Logical) for which the "Disk Image" is to be 
  created and press the [Ctrl]+[I] keys
- Select the path on another logical or network drive where the "Disk 
  Image" will be saved
- A "Disk Image" can only be saved on a FAT or network drive
- Press the [ENTER] key to see the progress and wait until creation of 
  disk image is completed
- To cancel this process press the [ESC] key at any time. 
 
Another way (available in commercial version only) is to run software with the 
parameter -image, for example: 
 
			A:\>UNERASER.EXE -image80h=E:\BACKUPS 
 
"Disk Image" is a set of files: Drive_80h.hdd, Drive_80h.001, Drive_80h.002...
Each file (except the last one) has a size of 1GB, because MS DOS does not 
support files having size more than 2GB. 
If you require a "Disk Image" of the whole drive in one file, these files can 
merge later manually.  
 
 
4.11. Using Disk Viewer 
 
Disk Viewer allows view and accesses any sector on the physical or logical 
drive. Also it allows the preview of file sectors for the existing or deleted file 
(if it is still recoverable). 

- Run Active@ UNERASER for DOS
- Select the object HDD to view physical sectors, Logical drive to view 
  logical sectors, file/folder to view its sectors
- Press the [Ctrl]+[S] keys to open Disk Viewer

The Title displays the object to be viewed and the current sector number will 
be shown below. The rest of the area displays sector content in Hex view on the 
left side and Text View on the right side. 

- Use arrows, [HOME], [END] keys to scroll the view
- Use [Page Down], [Page Up] keys to go to the next/previous sector
- Press [Ctrl]+[G] to go the particular sector
- Press [TAB] key to change Hex/Text view to Text Only and backward
 
 
4.12. Localized file names display 
 
Localized file names are stored on the drive in Unicode format. Operating 
System (Windows 95/98/ME/NT/2000/XP) creates filenames based on regional 
settings. Also Windows has set of fonts to handle and display filenames 
properly. 
 
MS DOS might have local fonts supported but it cannot display filenames in 
Unicode.  
 
Active@ UNERASER can display localized filenames in DOS only if a proper font 
definition file for the same locale settings is available.  
 
To prepare this file with font definitions follow these steps:

- Download UNICODE.EXE and save it to the same place where 
  UNERASER.EXE is located.
- Boot in Windows 95/98/ME/NT/2000/XP that has the same locale 
  settings and run UNICODE.EXE.
- File UNICODE.DAT having size 65536 bytes should be created in the 
  same folder.
- Boot in DOS mode and run Active@ UNERASER for DOS 
- Scan your drive and switch to "Long file names" mode by pressing the 
  [TAB] key

Now you should be able to see your localized file names. 
 
Note: 
To be able to see localized filenames you must have support for the local fonts 
when booted in DOS mode. In other words, display driver for the proper code 
page must be loaded. 
 
 
4.13. Long file names display 
 
Since Windows 95 OS launch filename is not limited to 8.3 patterns and can 
have a length of up to 255 characters. 
 
Standard View displays all files and folders the same way as DOS does, i.e. in 
8.3 formats. However sometimes it is not convenient to see only first symbols 
of the long file name. 
 
To display long filenames (up to 36 symbols):

- Boot in DOS mode and run Active@ UNERASER
- Scan the particular drive by pressing the [ENTER] key
- Press the [TAB] key to switch to long filenames view

 
4.14. Command line parameters 

Active@ UNERASER for DOS supports a set of command line parameters. To 
view them and their definitions, type: 
 
			A:\>UNERASER -? 
 
Here is a list of command line parameters available:
 
-lba            - Force LBA mode for access to all detected HDDs 
 
-lba=N          - Force LBA mode for access to the particular HDD
                  Where N=[80h,81h,82h,83h] 
 
-restoreMBR=N   - Virtually restore MBR from the backup for a particular drive 
                  Where N=[80h,81h,82h,83h] 
 
-ignoreMBR=N    - Do not load MBR information for the particular drive,
                  Where N=[80h,81h,82h,83h]. 
                  It allows scanning of existing or damaged partitions 

-imageN=PATH    - Create image for the physical drive (Professional version),
                  Where N=[80h,81h,82h,83h] and PATH=<drive>:\\<path\\> 
 
 
5. RECOVERY TIPS
 
Do not save the recovered files onto the same drive from where they were 
recovered. This can overwrite table records for deleted entities like file(s) 
and folder(s) and thus can intrude in the process of recovery.

Please save your recovered data onto another logical, removable, network or 
floppy drive. 
 
Do not save/write/install anything onto the drive containing your important 
deleted data that is required to be recovered. Even installing the data recovery 
software to the same drive could make your sensitive data irrecoverable. 

Download and save Active@ UNERASER for DOS onto a bootable floppy and boot 
your system using that disk! 