         RESQDATA - NON-DESTRUCTIVE, PROFESSIONAL DATA RECOVERY
                              By Zvi Netiv
                       NetZ Computing Ltd. Israel
                              August 1996

  DESCRIPTION

  ResQdata is InVircible's non-destructive file recovery utility as
  implied from its name. ResQdata's purpose is to retrieve files from
  a hard drive or floppy when the data cannot be accessed anymore
  through the file system. ResQdata can be used to advantage in the
  following cases:

  -  When a directory or tree section containing important data files
     was accidentally erased, corrupted or destroyed.

  -  When part or the whole file system was corrupted or ruined and
     the problem could not be fixed with disk repair utilities. Or as
     happens more often, when an attempt to repair the file system
     resulted in more damage to the file system.

  -  To recover a file that had been set to zero length by either user
     mistake or by an application error.

  -  To recover data from bad floppies, in conjunction with two other
     NetZ utilities: ResQflpy -- the floppy cloning utility -- and
     FixBoot, IV's floppy boot sector repair utility.

  ResQdata can either search for default data files or for user
  defined ones. In the default mode, ResQdata will search for a fixed
  set of data files, including Word, Excel, PowerPoint and Quatro's.
  In user guided search, ResQdata will look for files having the same
  characteristics as the sample provided by the user. This way,
  ResQdata can recover a large variety of database types and formats,
  even user unique databases, provided the files have typical and
  recognizable features.

  ResQdata works only on drives organized under a FAT file system.

  The extent to which ResQdata will successfully recover files depends
  primarily on the fragmentation level of the sought drive. Contiguous
  files can be fully recovered, while the recovery of fragmented files
  will yield incoherent data fragments.

  ResQdata has additional and important uses in data recovery. It can
  be used to verify whether correct drive geometry and parameters were
  selected. If the drive parameters and boot sectors are correct, then
  ResQdata should be able to spot files on that drive of the type
  known to exist on it. If ResQdata finds none, or only few, then this
  could indicate a bad selection of parameters in the setup, wrong
  partition data in the MBR or incorrect BPB (BIOS parameter block) in
  the boot sector. See in the ResQpro section for details on how to
  fix these problems with ResQdisk.

  To actually recover data from a hard drive, ResQdata should be run
  from the special InVircible ResQ Professional floppy. In its
  freeware mode, ResQdata will only search for data files on the hard
  drive but will not recover them. Still, ResQdata will recover data
  from floppies, for both practicing purposes and real data recovery.


  RESQDATA SETUP

  The following are needed for a ResQdata session:

  -  A source drive from which to read the data. The source drive must
     be accessible, to the level of being able to change the current
     directory to the source drive. This would require that the hard
     drive parameters in the CMOS are correct and that the master
     partition sector (MBR) and the boot sector(s) have correct data
     in them. In case a special driver is required to access either
     the source or the target drives, like the Ontrack DDO or else,
     then load the driver via the config.sys or the autoexec, as
     required.

  -  A save drive, where ResQdata will write the files it retrieves as
     well as the session report. Any logical drive with sufficient
     free space on it can serve for the purpose, including floppies or
     network drives. Most convenient is an external ZIP drive, or you
     could use a second hard drive, either master or slave for that
     purpose.

  -  The ResQdata software. ResQdata must run of the special IV
     Professional floppy for actual recovery of data from a hard
     drive.

  -  Samples data files of the same type as sought on the source
     drive.

  Boot the computer with the same operating system as installed on the
  source drive before it crashed. This could be important with the
  newer versions of Windows 95 as there may exist Win95 partitions
  that are not recognized by DOS, only by Win95.

  Boot of a floppy, preferably. Data recovery should be conducted
  under real 16 bit DOS (not in protected mode), from either DOS 5.0
  or higher, or under Windows 95, before Windows started its 32 bit
  driver.

  Check that the source drive is accessible by changing to it. Use
  ResQdisk Professional if necessary to fix access problems in case
  DOS returns an "invalid drive specification" message (bad partition
  data) or "invalid media type" (bad parameters in the boot sector).

  Start ResQdata and select the search mode first, to assure that the
  drive setup parameters are correct. If okay, then ResQdata should be
  able to spot files that are known to exist on the sought drive. If
  no files can be found in the search phase then the reason could be
  different drive configuration parameters from the ones with which
  the drive was configured. Refer to the disk recovery section in this
  manual for details on how to fix the problem.

  ResQdata will generate a report, display it to screen and save it to
  the target drive with the name of RESQDATA.RPT. The report contains
  useful information that could help in assessing the desired startup
  parameters for recovering your files. It's recommended that you
  print the RESQDATA.RPT report after each run.


  RESQDATA STARTUP OPTIONS

  When started, ResQdata will prompt whether to search for default
  files or use the sample file, designated by the user. Press Enter
  for the default, or "S" for sample.

  Give the sample's pathname when prompted. DOS wildcards (*,?) are
  allowed. ResQdata will reply with the sample's full pathname if
  found, or abort if it cannot find the sample.

  When in user designated mode, ResQdata will ask to enter an
  extension filename for the retrieved files. Enter a three characters
  extension name such as RTF, GIF, PCX, DBF etc. ResQdata will add the
  given extension to the saved files name. The extension in the
  default mode is selected automatically. MS-Word files will be saved
  as *.DOC, Excel files as *.XLS, Power Point as *.PPT and Quatro
  files will be saved as *.WQ1. Files that have been created by
  Microsoft Office but cannot be classified as belonging to one of the
  above categories are saved with the extension OFS (for Office).

  The next choice in ResQdata's dialog is what correlation factor
  should ResQdata use? The decision whether a matching file was found
  is based on statistical correlation derived from the InVircible
  correlator, IVX. There are differences between data files, even if
  from the same application. Asking for a too high correlation factor
  will cause ResQdata to miss many instances, while a too low factor
  will yield excessive hits with a lot of garbage files. The default
  correlation factor of 4 (from the range of 1 to 5) works well for
  most databases. Yet there are instances in which you may need to
  decrease the factor, like when looking for archive files (ARJ, RAR,
  ZIP etc.). The best factor for a particular database can be found by
  trial and error. Run ResQdata with different factors and analyze the
  report on each run.

  ResQdata will next prompt for the source drive. Just press the drive
  letter key.

  ResQdata will ask if to run in search-only mode (the freeware
  default). If running of an InVircible Professional floppy then the
  default is the full mode (with file saving to the target drive).
  Press Enter for the default, or answer "Yes" for searching only,
  without saving.

  Next, you will be prompted for the target drive, where to write the
  report and the recovered files. Select the target drive letter, from
  A to Z. ResQdata will check that the source and target drives are
  not identical and abort in case they are. A rule in data recovery is
  to NEVER WRITE ANYTHING to a drive being rescued, unless its
  integrity has been checked and confirmed. Writing to a corrupted
  drive will worsen the problem and overwrite data that could be
  recovered otherwise.

  When in full mode, with the "save files" option set, ResQdata will
  prompt for the desired file-length of the recovered files. A rule of
  thumb is to chose a length that is larger by a few kbytes than the
  largest file you expect. See later how to truncate garbage from data
  files and restoring them to their original length. In case a
  recovered file was too too short, then retrieve it a second time
  with a larger selected size, using the report for localizing the
  cluster at which the file starts.

  In full mode, ResQdata will ask if to prompt before saving a file.
  The default is automatic saving of found files. Saved files will be
  named "1000.ext", 1001.ext" etc., where "ext" stands for the default
  extension name, or the one selected by the user. Saving upon
  confirmation is useful when you wish to recover a specific file at a
  known location.

  The last parameter in the ResQdata startup dialog is from which
  cluster it should start searching. This choice is useful when you
  need to retrieve a specific file, knowing its exact location from, a
  previous ResQdata scan or report. Data recovery is continued in next
  page.


  RESQDATA RUNTIME OPTIONS

  Pressing the space bar will pause ResQdata. The search will resume
  upon pressing 'space' again.

  The +/- keys are used for changing the search location, in
  increments or decrements of 200 clusters.

  ResQdata will prompt for replacing a full floppy, if a floppy drive
  was selected as target.

  Restoring the Original File Size

  Files recovered with ResQdata do not have their correct original
  size. To successfully recover the data in a saved file, the latter
  should be larger than the original one by a fair margin.

  Yet it's simple to restore the recovered files to their original
  size. Just open the recovered file with its appropriate application
  (e.g. open DOC files with MS-Word, XLS with Excel, GIF with
  PaintShop etc.) and save them to disk.

  The normal opening of the file confirms that the data is valid.
  Saving the file will truncate the excess garbage code and restore it
  to the correct size. This could also be the proper occasion for
  renaming the restored file, by saving it under a new filename.


  PRACTICING DATA RECOVERY

  You can practice ResQdata by searching various files types on your
  hard drive, or by actually retrieving files from a floppy.
  Practicing actual data recovery from a hard drive requires that
  ResQdata runs of the special InVircible Professional floppy.

  To see the effect of defragmentation on recovery, then run the
  following test. Format a floppy with the /U switch (unconditional
  formatting) and copy a few Word docs to it. Now, run FORMAT A: /Q
  (quick formatting) so that the FAT and root directory are blanked
  (UNDELETE won't be able to see the files anymore). Now restore them
  from the blanked floppy with ResQdata (use the hard drive for saving
  the recovered files). You will notice that the files will recover
  properly. The reason is that the files were written contiguously by
  DOS, since the floppy was freshly formatted.

  Try now a different scenario. Copy files to the floppy until DOS
  complains "insufficient disk space". Erase a few files of the
  floppy, picking them at random, and then copy more files until the
  floppy is full again. Apply FORMAT /Q to blank the floppy and try
  restoring the files again with ResQdata. You will notice that this
  time, less files will recover properly. The reason being the
  fragmentation, caused by erasing and rewriting data to the floppy.

  Regular defragmentation of your hard drives is good practice. Except
  for its other advantages, it also increases the chances of
  successfully recovering your data when needed.


  CUSTOMIZED VERSIONS OF RESQDATA

  ResQdata will work as is with most database. Yet, it's possible that
  ResQdata will indicate on certain databases that "the sample has no
  recognizable features". This doesn't mean that your database format
  cannot be recovered. You may simply need a customized version of
  ResQdata, to suit your specific database format.

  NetZ Computing will be glad to look at your problem and design a
  customized version of ResQdata. To investigate whether your data can
  be restored with such version, please e-mail to netz@actcom.co.il
  and attach a few samples of your database files (not less than three
  and no more than ten), in ZIP format.


  COPYRIGHT NOTICE

  ResQdata is copyright (c) 1996 of NetZ Computing Ltd. Israel and is
  complementary to ResQdisk, the hard drive recovery module of
  InVircible. InVircible is the anti virus protection and disaster
  recovery package, made by NetZ Computing.

  ------------------------------------------------------------------
  NetZ Computing Ltd. Israel    Developer and Producer of InVircible
  Telefax: +972 3 532 5325                 E-mail: netz@actcom.co.il
  ftp.netzcomp.com/private/netz/               http://invircible.com
  ------------------------------------------------------------------

