DMDE

DM Disk Editor and Data Recovery Software

User Manual
Version 2.10

Revision of the Manual 2014-07-03

© 2005-2014 Dmitry Sidorov

Contents
About DMDE Help .................................................................................................................................................. 3
Context Sensitive Help ......................................................................................................................................... 3
About DMDE ........................................................................................................................................................... 4
About DMDE ....................................................................................................................................................... 5
Acknowledgement ................................................................................................................................................ 6
File Descriptions .................................................................................................................................................. 7
DMDE Editions .................................................................................................................................................... 8
Installation and Run ................................................................................................................................................ 9
Operating Systems ............................................................................................................................................... 9
System Requirements ......................................................................................................................................... 11
Activation ........................................................................................................................................................... 13
Languages/Localizations .................................................................................................................................... 15
Settings ............................................................................................................................................................... 16
Known Issues and Other Limitations ................................................................................................................. 17
Updates, License Downloads ............................................................................................................................. 18
Work with program .............................................................................................................................................. 19
Find and Open Volume ...................................................................................................................................... 20
Data Recovery .................................................................................................................................................... 21
Partition Management ........................................................................................................................................ 23
NTFS/FAT Search ............................................................................................................................................. 26
Device Selection ................................................................................................................................................. 27
Device I/O Parameters ....................................................................................................................................... 28
Disk Images and Clones ..................................................................................................................................... 33
RAID Arrays ...................................................................................................................................................... 34
File Panel ............................................................................................................................................................ 36
Disk Editor ......................................................................................................................................................... 37
Disk Editor Templates ........................................................................................................................................ 38
Cluster Map (File Allocation) ............................................................................................................................ 41
Menu ....................................................................................................................................................................... 42
Menu "Drive" ..................................................................................................................................................... 43
Menu "Tools" ..................................................................................................................................................... 46
Menu "Windows" ............................................................................................................................................... 56
Menu "Editor" .................................................................................................................................................... 57
Menu "Mode" ..................................................................................................................................................... 58
Menu "Edit" ........................................................................................................................................................ 59
About Help
Table of contents online:
Revision of the Manual 2014-07-03

About DMDE Help

The most recent documentation may be found on the software sites.

Reading the manual is recommended when working with the program.

A number of parameters may be set within the software which understanding requires some knowledge about file
systems and disks, and their discussion is beyond the scope of this guide. If the role of such parameters is not clear,
it is recommended to keep the default.

Bold and green fonts are usually used for software interface terms and for commands.
In order to open CHM file in Windows you should copy it to a local disk and unblock the file (right click for Properties and
Unblock).

Context Sensitive Help

Context sensitive help can be called from the most dialog boxes by pressing F1/ Shift+F1/ Shift+F11 keys or
button Help. Supported in Linux and Windows only.

Help is available in the form of a set of HTML files under both Linux and Windows. CHM files are supported
under Windows.

By default CHM files are used under Windows. To use HTML files remove CHM files and copy directory man_en to the software
directory or other man directories to the directory locals. HTML files are opened using default system browser.

In Linux command xdg-open is used to call the default application for HTML files. You may use another command using
parameter shellopen=.

3
About
Table of Contents

About DMDE
● About DMDE
● Acknowledgement
● File descriptions
● DMDE Editions

4
About
Table of Contents

About DMDE
DMDE 2.10 (DM Disk Editor and Data Recovery Software)
Copyright © 2005-2014 Dmitry Sidorov

http://dmde.com/ http://softdm.com/

Search, edit, and recover data on disks.

● Free Edition: most of features, file recovery from the current panel
● Paid Editions: data recovery without the limitation
● Professional Edition: additional features and rights, including rights to provide paid data recovery
● GUI, Console versions for Windows 98/ME/2K/XP/Vista/7/8, console versions for DOS, Linux (terminal)
● File systems supported: FAT12/16, FAT32, NTFS/NTFS5, Ext2/3/4 (browse, view files and system structures,
data recovery)
● Thorough search for NTFS, FAT volumes and data recovery in complex cases
● Simple partition manager to find and restore accidentally removed partitions using information from boot sectors
of FAT, NTFS, exFAT, and superblocks of Ext2/3/4, and from their backup copies
● Disk imaging to create, write images back to disk, to clone disks, including I/O errors handling, reverse copy, and
other features
● Disk editor compatible with the most recent Windows versions to view, edit, and navigate through different disk
structures (built-in and custom templates)
● RAID constructor to virtually reconstruct RAID supporting RAID-0, RAID-1, RAID-4, RAID-5, RAID-6,
delayed parity, custom striping, JBOD/spanned disks
● NTFS tools to work bypassing NTFS driver (copy, delete file, create, repair directory)
● Support for national names, large disks, large files, large sectors, NTFS compression, and other features
● Run without installation

5
Acknowledgement
TOC · About DMDE

Acknowledgement
Thank all users for comments, bug and test reports, suggestions, payments, advertising and publicity.

Special thanks to:

Igor (jsfhd), Alex (box2134), Konstantin Volkov, Leonid Arkadjev, Antech, Yatagan, 9285, okzo, Nirvanowiec,
Migol21, gsm_virus, BIGOLSEN, Stepan Martinek, lordo4

6
File Descriptions
TOC · About DMDE

File Descriptions
Executable
dmde.exe or dmde - the program

Localization
*.tbl - code page tables
*.lng - language files

Documentation
eula*.txt - license agreement (EULA) files
versions.txt - information about some version changes
readme*.txt - readme files
dmde*.chm - help files in Windows CHM format
man*/* - help files in HTML format

Other files
dev9x.dll, dev32.dll - drivers to run under Windows 9x/ME
dmde*.ini - program settings files
cwsdpmi.exe - DOS Extender to run 32-bit DOS apps (Copyright © 2010 CW Sandmann, not a component of
DMDE product)

7
DMDE Editions
Table of contents · About DMDE

DMDE Editions
Actual information (compare editions, buy online) is available on the software site.

Free Edition has all base features and recovers up to 4000 files from the current panel only.

Paid editions feature data recovery without the limitation.

Professional Edition has additional features and extended rights to provide data recovery services:
● Portable use on different computers
● Native 64-bit versions (access more than 2GB RAM, Windows and Linux only)
● Data recovery reports (include logs and file checksums)
● Use logs to continue disk copying after stop
● Customizable I/O handler script
● Recovery of NTFS alternate data streams
● DMA access under DOS (for ATA interface)
● One-time activation of Client Edition

8
Installation and Run
Table of Contents

Installation and Run

System Requirements Activation Languages Settings Limitations Updates

Attention! If in doubt about the physical health of the disc it is recommended to appeal to specialists. Further work
with the disk (including starting up) may worsen the problem or cause complete inability to recover data. If device
size is detected incorrectly.

Attention! Do not load operating system, install or run the program on a partition where lost or damaged data is
located (data to recovery), otherwise it may be erased irrevocably.
To prevent writing to the problem disk it is highly recommended to load the system from the removable media
(LiveCD/USB, bootable DOS disk, etc.).

To install and run the program just extract entire software package into a single directory (may be on removable
media) and run dmde.exe or dmde depending on a version. You need Aministrator/Superuser priveleges to
access devices in Windows NT+, Linux. To run the software without Adminstrator rights (to work with images
only) add the parameter notadmin=1 to the file dmde.ini.

Operating Systems
Windows 98/ME
Attention! Without special patches Windows 9x/ME handles 128GB and larger drives incorrectly.
To avoid the problem reload computer in MS-DOS mode and use DMDE for DOS to access such drives via BIOS
or ATA-interface or load another OS.

Windows 2K/XP
To use the program you should login as Administrator.
Attention! To work with 128GB and larger drives you need Windows 2K SP4 with LBA48 support manually
switched on in the registers or Windows XP SP2 (LBA48 is switched on by default).

Windows Vista/7/8
To run the program as Administrator right-click the program icon and use the corresponding command in the
context menu or confirm UAC elevation request.
Attention! To work with drives larger than 2TB under Windows Vista/7/8 the most recent versions of controller
drivers must be installed.

Linux
At first go to the Root Terminal or run Terminal emulator (Konsole, Gnome-terminal, etc.). Go to the software
directory and type ./dmde. You should run the software as a superuser to access devices. Please, refer to your
operating system documentation for this information (e.g., run sudo ./dmde in Ubuntu, go to root with su
command in Debian at first, etc.). You may also need to set execution permission for the file dmde (type chmod
755 ./dmde). To run 32-bit software versions on 64-bit operating systems you may have to install additional
32-bit shared libraries (e.g., run sudo apt-get install libc6-i386 in Ubuntu to install libc6-i386
package).

9
DOS
You may use DMDE on a regular partition supported by DOS or use DOS bootable disk. This may be helpful when
there are problems using specific disk. SATA disks must be switched to IDE-compatible mode in BIOS settings for
direct ATA-access. SCSI, USB, and other devices may be accessed via special DOS drivers or using BIOS
functions if they are supported.

Some files for creating DOS boot disks are available on the software site in the section Additional Downloads.

Bootable Floppy
To create bootable floppy download and unpack FDD image. You may use the function Copy Sectors to write the
image to a floppy disk. Use the image as a source file and fdd as a destination device. ISO images for bootable CD
may also be created on the base of boot FDD images with the help of different software.

DOS Bootable Disk

Loading from the specific disk must be supported by BIOS (see BIOS boot menu). To create bootable USB/HDD
you need a freshly formatted primary FAT16/FAT32 partition on the disk. Non-standard disks/partitions are not
supported (non-MBR, 3TB+, etc.). You may probably need to zero the disk to properly create compatible primary
FAT partition using standard OS means.

1. Download the FreeDOS Package and unpack files into the root of the FAT partition.
2. Open the disk as physical device in DMDE and use the command Write Boot Sectors... in the
Partitions menu to make the device bootable (specify the location of unpacked files as a source of boot sectors).
Apply changes and close DMDE.
3. Download DMDE for DOS and unpack into the FAT partition.

10
System Requirements
TOC · Installation and Run

System Requirements
Common Requirements
● Drives: without significant physical damage
Attention! If there are physical problems (extraneous sounds, error messages, slow performance, etc.) it is
recommended to appeal to specialists
● CPU: Intel compatible (i486 and higher)
● To save/use results, reports, and settings a valid partition is required which is supported by the operating system
(in particular, FAT partition is required to work in DOS/Win9x/ME)

If Device Size Is Detected Incorrectly

This must be resolved before any further work. Some issues are quite simple - see guide from external source.
Some issues are below:
● Capacity Limitation Jumper is misplaced (device size is limited to 32GB)
● HPA is erroneously applyed. Device size usually becomes 1TB less or similar (typical to some GYGABYTE
motherboards). Try software: HDD Capacity Restore Tool (Windows), hdparm (Linux), HDAT2, MHDD,
Victoria (DOS)
● No large drive support on OS - see below
● Incorrect drivers for SATA/USB controller (no correct 3TB+ support). Device is displayed tipically 2.2TB less.
Update drivers
● USB enclosure / another adapter has no correct 3TB+ support. Change adapter or attach device directly

Windows 2K+ (2K/XP/Vista/7/8 and other)

● Recommended: Windows XP + SP2 and higher
● 32-bit versions work in both 32-bit and 64-bit Windows
● Administrator privileges
● Drives: supported by OS
Attention! To work with drives larger than 2TB under Windows Vista/7/8 the most recent versions of controller
drivers must be installed. To work with 128GB and larger drives under Windows 2K/XP certain ServicePacks
must be installed and LBA48 support must be switched on in the system registers. Windows 2K/XP does not
support drives larger than 2TB.

Windows 98/ME
● Drives: supported by OS
Attention! Windows 9x/ME handles 128GB and larger drives incorrectly unless special patches are installed.
You may reload computer in MS-DOS mode and use DOS version to access drives via BIOS or ATA-interface

DOS
● OS: MS-DOS 5.0+ compatible
● Drives: supported by BIOS or supported by DOS (using ASPI drivers) or supporting ATA-interface (IDE or
SATA). SATA disks must be switched to IDE-compatible mode in BIOS settings for direct ATA-access
● DOS Extender (file CWSDPMI.EXE © 2000 CW Sandmann in the software directory is enough)
● At least 200 KB of low memory free

11
● At least 64 MB of extended memory
● For extended name duplicates handling during data recovery long name driver is required (e.g., DOSLFN.COM
© Haftman software)
● If you wish to use a mouse then mouse driver for DOS is required

Linux
● OS: Latest Linux distributions with libc library
● 32-bit shared libraries to run 32-bit versions on 64-bit Linux (e.g. libc6-i386 package)
● Drives: supported by OS
● Superuser rights
● Root terminal or terminal emulator (xterm, Konsole, Gnome-Terminal, etc.)
● utf-8 locale support

12
Activation
TOC · Installation and Run Online:

Activation
Attention! After buying the software you should download licensed copy from your personal section (restore
address). Free Edition may not become fully functional.

In order to enable all features you should activate the software when first run on a new/modified hardware. You
may use the menu command Help-About to view if the software copy is activated. Please use the software
according to the license terms in order to avoid blocking. You may view your activation logs in your personal
section.

Online Activation
Click then button Online Activation. If direct Internet connection is available the software will be activated
automatically. Activation key will be stored to dmde.ini. DOS versions do not support online activation.

Offline Activation
If Online activation is not possible you may manually get and enter activation key.
1. Run the software on a computer where it will be used. Click Offline Activation. Save the file
dmdeinst.dat (or write out your Prod.ID and Inst.ID).
2. Open the activation site http://activate1.dmde.com/ or http://activate2.dmde.com/ from any location. Upload the
file dmdeinst.dat (or enter your Prod.ID, Inst.ID and registration e-mail). An activation key will be
generated for you.
3. Enter your activation key to complete Offline Activation.

Activation Types (Professional Edition)

1. Local Activation
Local Activation associates the use of the software with a specific computer: select the item Local
Activation and use Online or Offline Activation.

2. Portable Activation (Portable Use)

Portable Activation associates the use of the software with a removable USB flash drive that allow using on
different computers without Internet access. Windows (2K and higher) & Linux only.

Initial Association with a Device

1. Select Portable Activation (click it or use Space bar) and specify the removable device for
association. The device must have correct serial number (12 or more digits and capital Latin letters).
2. Use Online or Offline Activation to complete the association (will be stored to dmde.ini).

Further Use on Different Computers

Attach the device to a computer, run the software, and select the device if necessary.

3. One-time Activation
DMDE Professional users may also download special version (Client Edition - without Professional features) and

13
get one-time passwords to single run the software on a client computer when it is not possible to use portable
activation (e.g. remote use). To use Client Edition it is necessary to fulfill Online or Offline Activation and enter
one-time password.

14
Languages/Localizations
TOC · Installation and Run

Languages/Localizations
Dialog Box "Select Language"
Apply Codepages. If the option is checked then ANSI and OEM code pages from the selected localization file are
used.

Translit. Transliterate interface if there are problems displaying national symbols.

Code Pages - Interface and Data Recovery

ANSI code page is used in DMDE interface under Windows and Linux. OEM code page is used in DMDE interface under DOS.
Symbols outside the selected interface codepage are transliterated or substituted.

OEM code page is used also when read short names (8.3 format) from FAT volumes in all DMDE versions. DMDE for DOS uses
OEM code page for file name recovery also. DMDE for Windows and for Linux uses Unicode (if it is supported by OS) during
recovery regardless of the selected code page.

By default OS code pages are used (if applicable). Code pages from Ini-file (if defined) override them. Code pages from the
selected lng-file (*.lng) override everything if Apply Codepages option is checked in the dialog box "Select Language".
Lng-file string 107 is for ANSI, lng-file string 108 is for OEM codepage.

INI-file settings
usecodepage= ANSI code page
oemcodepage= OEM code page
translitenable= (Translit)
viewtranslit= (Translit)

15
Settings
TOC · Installation and Run

Settings
Settings are stored in the file dmde.ini in the software directory. See the file for the parameter descriptions.

Device I/O Parameters can be changed at runtime.

16
Issues and Limitations
TOC · Installation and Run

Known Issues and Other Limitations

Data Recovery
● DOS, Win9x/ME: unicode symbols in file names outside the selected code page are replaced with "_" or
transliterated according to the loaded translit tables
● DOS, Win9x/ME or FAT: unable to recover file greater then 4GB as a single file due to a FAT limitation
● NTFS alternate streams can be recovered to NTFS volumes only
● One file hard link per NTFS directory is recoverable
● One alt. stream hard link per NTFS file is recoverable
● NTFS symbolic links are not supported
● NTFS encrypted files are not supported
● Win9x/ME: drives greater then 128GB are not handled correctly without special patches applied to Windows
drivers
● Maximum path length supported: 259 characters for DOS, 4096 for Windows, Linux
● Maximum path length supported by DOS: 79 or 127 characters (for DOS-names) depending on DOS version.
● Subdirectory depth is up to 1024 (can be increased using maxrecoverdepth= parameter)
● If name substitution is used under DOS then name handling (such as auto renaming) is not supported

NTFS write support

● Journal is not supported
● SECURITY INFORMATION is not supported on creation (to access files and directories it is necessary to set
permissions using OS features)
● OBJECTID is not supported
● DOS short names (8.3) are not supported
● Compressed files are not supported
● Alternate data streams are not supported
● Removing file/directory problem: directory entries may be incorrectly updated after removing. Directory entries
may be repaired with the help of system chkdsk or using NTFS Tool Repair Directory INDX-Records

Other
● The software may work within the available RAM. 32-bit versions may use up to 2GB of RAM only (corresponds
to the support of ~10 million files)
● Up to 2K items in the list of Devices
● Up to 400 volumes in the Partitions
● Up to 16K custom data rotation items (striping) when constructing Custom RAID
● Up to 1K volumes for FAT Search (can be changed using fatmaxvolumes= parameter)
● Up to 1K volumes for NTFS Search (can be changed using ntfsmaxvolumes= parameter)
● Load up to 131K (Windos, Linux) / 65K (DOS) MFT fragments for NTFS Search (can be changed using
ntfsmaxmftruns= parameter)
● Load up to 65K INDX records for NTFS Search (can be changed using ntfsmaxindxrecs= parameter)
● Maximum search depth for File Panel Search is up to 1K directories
● Unicode is supported in names to recover only (other unicode support is very limited)
● Keyboard and mouse input is limited in Linux (keyboard shortcuts and national input may not be supported)

17
Updates
TOC · Installation and Run

Updates, License Downloads

Updates are performed in the same way as a first installation.

License owners may download licensed software copies from the personal site section. To restore personal entrance
address fill out the form on-line:
http://dmde.com/request.html

18
Work with Program
Table of Contents

Work with program

● Find and Open Volume
● Data Recovery
● Partition Management
● NTFS/FAT Search
● Device Selection
● Device I/O Parameters
● Disk Images and Clones
● RAID Arrays
● File Panel
● Disk Editor
● Cluster Map (File Allocation)
● Menu Commands

19
Open Volume
TOC · Work with program

Find and Open Volume

To browse, view, edit, and recover files and directories you should find and open a volume containing data. Use the
following methods depending on the damage.

1. If a volume is fully available by a letter (C:, D:, ...), you may open it via the dialog box Select Drive by
selecting the options Logical Disks / Volumes / DOS Services. This method is suitable to recover
deleted files on healthy volumes. If it is not possible to open the volume and correctly recover files then try the next
method.

2. Select a physical device containing the volume (Select drive – Physical Devices, or under DOS –
ATA Interface or BIOS Services). Then select and open the volume in the dialog box Partitions. If it is
not possible to open the volume in such a way or data is still not properly recoverable try using the next method for
the most complicated cases.

3. Run NTFS or FAT Search depending on the volume file system and open one of the found volumes. Read the
section NTFS/FAT Search for more efficient recovery in this case.

Use the command Open volume parameters in the context menu to manually change some parameters before opening the
volume.

If the initial storage is a RAID you probably need to Construct RAID instead of opening single physical device.

Also, the volume may be opened from the Editor Window when view the volume boot sector or boot sector copy in
NTFS/FAT/FAT32 Boot sector mode.

20
Data Recovery
TOC · Work · Menu · Tools

Data Recovery
Attention! If files are recovered incorrectly or there are other problems make sure you are using a legal software
copy.

Attention! Do not recover to the same partition which contains source data to recover. It is highly recommended to
recover data to another physical device. You may recover to another partition of the same device only if you are
sure that source and destination partitions don't overlap and device has no physical problems. Do not load system or
run program from the partition where data to recover is located.

Before data recovery you should find and open volume. The recovery results depend on results of the volume
search and which volume is opened.

To recover all found files (including lost and removed files and NTFS altstreams) you should open virtual directory
[All Found + Reconstruction] in the File Panel. This is also required for auto unmarking items during
group recovery.

Free Edition supports recovery of up to 4000 files from the current panel only.

Dialog Box "Recover"

Button "Size"
Calculate size of the data to recover. Global indicator of recovery process is working if the size is calculated. You
should not calculate the size to avoid unnecessary device load on devices with bad sectors.

Button "List"
Save list of files selected for recovery to a file.

"Deleted" files
Recover files marked as "deleted" (see File Panel). If the option is not selected "deleted" files won't be recovered
regardless the selection state.

Checkbox "Include Found"

Recover files marked as "found" (see File Panel). If the option is not checked "found" files won't be recovered
regardless the selection state.

Unicode names
The option is selected if the OS supports recovering paths containing special or national symbols which does not
included in limited ANSI set.

Create report (Professional Edition only)

Save recovery report to a file. List files and directories, log file I/O errors, calculate checksums CRC32, MD5,
SHA1.

Checkbox "Include altstreams" (Professional Edition only)

Recover NTFS alternate data streams (Alt. stream name and file name are separated by a colon, i.e.
FileName:StreamName).

21
Additional Issues
Recover to a FAT formatted volume
FAT volumes do not support files greater than 4GB (or sometimes 2GB). So it is not possible to recover entirely
large files to FAT volumes. Large files are split during recovery (upon request). Later file parts may be joined on
another disk by using system utility copy /b part1 + part2 + part3 result, for example. Pure DOS
supports only FAT volumes.

File names in DOS, checkbox "Substitute names"

Without special drivers long files names are not supported under DOS. Option Substitute names allows
name substitution during recovery. File LRENAME.BAT is being created in the destination folder for backward
renaming. To restore original file names load OS Windows, go to the destination folder and execute the file
LRENAME.BAT. An appropriate OEM code page must be selected when working in DOS in order to restore
national symbols correctly. Unicode symbols outside the selected code page will be transliterated or substituted.

You may add the parameter substnamesutf8=1 to the file dmde.ini to create LRENAME.BAT in the unicode
format which supports all unicode symbols regardless the selected code page. Unicode format is supported in
Windows 7 and higher.

Paths longer than 259 symbols under Windows NT+

In order to recover paths which are longer than 259 symbols you should manually prepend the destination directory
name with a prefix \\?\, e.g.: \\?\C:\. Such long paths may be inaccessible for standard programs such as
Explorer (My Computer).

Handling of Name Duplicates

During recovery there may be name duplicates due to finding different versions of the same file, different links to
the same file, or due to erroneous merging of directories.

If a file or directory with the same name is being recovered you are prompted to choose how to handle the
duplicates. It is possible to rename the object manually by entering name or to choose auto renaming or skipping all
subsequent objects. It is also possible to merge directories with same names.

There is a threshold number of renaming for a single object after which there will be a second request for a desired
action when the threshold is exceeded. Parameters maxfilerenames and maxdirrenames of ini-file are used
as threshold numbers by default.

Determining name duplicates is working on the base of destination file system. Name handling is not working if
name substitution is used under DOS.

22
Partition Management
TOC · Work · Menu · Drive

Partition Management
A tool to view, search, and open volumes, as well as for simple partition management on MBR and GPT-style disks.
Be sure to read the warning before operating.

Partition management includes undeleting removed and lost partitions, restoring boot sector from copy and other
tools. You may operate FAT (FAT12/16/32), NTFS, ExFAT, and ExtFS (Ext2/3/4) volumes. However, only FAT
and NTFS volumes can be opened and checked for consistency. MBR and GPT layouts are supported. Hybrid
(GPT+MBR) partitioning is not properly supported. Other styles (such as Dynamic Disks) are unsupported and
partitions on such disks may be shown as found.

Mark the checkbox found to express search and dsiplay lost and removed partitions (FAT/NTFS/ExFAT/ExtFS
volumes may be found). For more complex and deeper search use NTFS or FAT search. Volumes opened after
NTFS or FAT search are added to the list of found partitions and become available for partition management (e.g.
undeleting is possible if a valid boot sectors is found).

To prevent partition express search and displaying dialog box "Partitions" unmark the box Show partitions when open a
device or construct a RAID.

Info mode checkboxes:

● found: display found partitions
● tables: display AMBR and GPT partition tables
● detailed: display partition information from tables and boot sectors respectively in several lines per partition

(A) - bootable (active) partition status (Partition column).

Indicators - volume diagnostic indicators (indicate correspondent structure presence):

● T – partition table;
● E – table entry;
● B – volume boot sector;
● C – boot sector copy;
● F – MFT(0) for NTFS or Root for FAT (is tested when open FAT volume);
● f – MFTMirr(0) for NTFS;
● x – structure is absent or damaged;
● (indicator is absent) – structure is not tested (however it may present on a disk).

Red color indicates errors in the partitioning.

Dialog Box "Partitions" · Commands

Attention! Partitioning modification may cause impossibility to boot from the disk or inaccessibility of some
partitions after applying. Never modify partitioning of your boot or system disk. Use alternative boot disk or
connect your disk as second to another computer. Run the software from the device which won't be modified and
save current partitioning to a file on a device which won't be modified. After applying restart the computer or
reconnect pluggable device for changes to take effect. Cancel the chkdsk utility (by pressing any key) if it runs
automatically at startup as it may cause non-recoverable damage of the data.

Use the Menu button to view the operations available for the selected partition.

Partitioning changes are pending until you push the button Apply or use menu command Apply Partitioning. See
also Applying Changes for details.

23
Open Volume
Open volume to view and recover files.

Open Volume Parameters

View and manually edit volume parameters before actually open volume.

Show Volume Letters

Display volume letters assigned by OS.

FAT, NTFS Search within the Partition

FAT, NTFS Search

Create Image/Clone
Call the dialog box Copy Sectors to create partition image or clone the partition.

Insert the Partition (Undelete)

Insert lost or removed volume into the partition table. Invalid partitions may prevent insertion so they must be
removed before insertion. Completely damaged partitioning may be resetted using the command Toggle MBR
Signature On/Off applied to the topmost item. You should add partitions from the beginning to the end of the disk.

Remove the Partition

Remove the existing partition or a partition table. Some partitioning errors may be fixed by removing and
inserting the partition.

Create RAW Partition

Create unformatted (RAW) partition within the unallocated space. If there are no partitioning errors it is highly
recommended to use only standard system tools for creating and removing partitions.

Restore Boot Sector from the Copy

Replace damaged boot sector with a backup copy.

Toggle Bootable (Active) Partition Status

Set or reset active (A) status of a bootable partition.

Toggle MBR/Boot Signature On/Off (MBR On/Off)

Set or reset boot sector signature (0xAA55).

Reset GPT+MBR Signatures (GPT Off)

Reset boot sector signature (0xAA55) and signatures of GPT tables (EFI PART).

Set GPT+MBR Signatures (GPT On)

Set GPT and boot signatures. Available only on GPT disks after resetting.

Write Boot Sectors

Make DOS bootable disk.

Undo Action
Undo the last action.

Redo Action
Redo the last undone action.

24
Undo Partitioning Changes
Undo all partitioing changes.

Reset All Changes

Reset all unapplied changes.

Load from File

Load disk partitioning or rollback data from a file. See Changes for details.

Save Current Partitioning to File

Save current partitioning to a file for a backup purposes. Available only if the device is partitioned and there are
no unapplied changes.

Apply Partitioning
Write changes to the disk. See Applying Changes for details.

25
NTFS/FAT Search
TOC · Work · Menu · Tools

NTFS/FAT Search
Comprehensive search method allows you to find and virtually rebuild the directory structure of a damaged file
system.

If a file system is not seriously damaged then volumes may be opened before the scan completes. In the most
complex cases different volume variants may be given. You should select and Open volume, reconstruct file
system and recover files to estimate the quality of a variant. If the selected volume variant does not contain
necessary files or files are recovered incorrectly you should continue the search or try another variant. There are
indicators which allow preliminary estimating the quality of a variant (details are below). If data was moved (due to
partition move/split/merge/resize operation) then some files may be recovered correctly from one volume variant,
and others from another one, despite that files are visible on both volume variants.

It is recommended to scan selected area of a physical device (including old and new location of the volume if it was
moved) rather than scanning a logical disk. The software may read beyond the selected area if it is necessary.

Open volume Open volume selected in the list.

Save... Save search log to a file.
Load... Load search log from a file (to continue previous search or to use previous search results).
Start/Stop Start/stop scan. If the scan area is not changed the scan will continue from the last point.
Scan range Select the area to scan. Is is possible to select one of the partitions or any drive extent.
Menu Besides, allows changing volume sorting order.
The special search method allows detecting volumes without prior complete scan of the selected area. Scan is not continuous but
discrete with increasing of the sampling frequency. Volumes with the most number of files are being found first.

NTFS Search
The column Check may be used to estimate the recovery quality of a found volume variant (it corresponds to the
number of correct directory indexes on the volume). When a volume is selected the status lines display the
estimated percentage of found volume files and probable quality (including removed indexes), the number of found
files and estimated total number of files.

Min. Size is the minimum volume size (in sectors) containing all files in the best MFT fragments of a volume.

MFT Volume Start #1 and Volume Start #2 are possible volume starts for a given MFT fragment.

Volume Mod = Volume Start mod Cluster size

MFT Mod = MFT Cluster Start mod Cluster size

FAT Search
Sign "-" in the columns Boot FAT1 FAT2 Root indicates the absence (damage) of the corresponding file
system structures (boot sector, main FAT table, FAT table copy, root directory).

The column Found shows the number of directories found and allows estimating approximately the recovery
quality of a volume variant.
Values in the columns Boot FAT1 FAT2 Root are the sizes (in sectors) of the corresponding structures.

26
Device Selection
TOC · Work · Menu · Drive · Select drive

Device Selection
Select disk for further work.

If device size is detected incorrectly, refer to System Requirements issues.

Options
Physical Devices / Interfaces / Logical disks and DOS Services
Preferable access type depends on the problem (e.g. for data recovery see volume opening).

DOS Options

Use direct device access (for IDE and SATA devices in IDE mode).
ATA Interface
The preferable way to access devices with bad sectors
BIOS Services Use BIOS functions to access devices
DOS Services Use DOS functions to access logical disks
DOS ASPI Access to SCSI, USB, and other devices via ASPI drivers (if any)

Other
Disk Images: click or Enter the topmost list item to add new image for further work.

RAID option forwards to RAID constructor.

Show partitions option causes express searching and displaying partitions just after opening device.

Parameters button allows manually setting device I/O parameters.

Devices in Linux
If some specific devices are not listed you may use the option Disk Images and manually enter required device
path, e.g. /dev/mmcblk0 or /dev/mapper/truecrypt1.

27
Device I/O Parameters
TOC · Work · Menu · Drive Device I/O Dialog Box Device I/O Handler Script

Device I/O Parameters

Interface
A way to access disk/volume (may be set when selecting device).

OS Windows

IO FILE Use ReadFile/WriteFile functions to access device

IO SCSI Use SCSI driver (usually lower level driver than IO FILE)
Overlapped Use overlapped I/O (does not affect I/O, not recommended).

DOS
ATA Interface
ATA Interface For HDD/SSD
ATAPI Interface For CD/DVD
use DMA Use faster DMA access for ATA (Professional Edition only)
use LBA48 To access more than 128 GiB
raw CD access To access non-digital CD
BIOS Services
Old BIOS Service CHS access up to 8.4GB
Ext BIOS Service LBA access
DOS Services
DOS Int 25/26 DOS functions
Win9x-FAT32 Calls New DOS functions
MSCDEX Services For CD/DVD

I/O Errors
A way to handle I/O errors.

Skip I/O Errors. If an error occurs and the option is checked then I/O operation continues after a certain number
of auto retries. Otherwise operation stops after a number of auto retries until user make a choice in
device I/O dialog box.

Do not wait if device is not ready. If the option is checked then I/O operation continues even if device is not ready.
Otherwise the user reaction is required (device I/O dialog box).

always: apply to future operations.

now: apply to current operation.

Auto retries number on CRC Error. A number of additional I/O retries number before entering standby mode for
user reaction or continuing the operation.

Zero value (0) stands for no additional retries, herewith the rest sectors of the block after the error will not be read to the I/O
buffer.

If the value is non-zero then sectors are being reread one by one until error sector encounters. The error sector is being read until the

28
 number of auto retries is reached or the sector is read succesfully.

Increasing of retries number increases the percent of data successfully read but decreases device lifetime due to heavy load.

Auto retries number on Seek Error. The same for errors of the type "sector is not found".
Input error is assumed to be a seek error if I/O buffer contents is not changed after I/O (or it is filled with zeroes). Usually seek
errors significantly slow down I/O and they are not recoverable after a number of retries.

Fill bad sectors (hex). 4-byte hexadecimal value to fill sector if error detected (optional).

Jump over sectors after error. A number of sectors to skip after a nonrecoverable error encounters.
Skipped sectors will be filled with a Filler value. If there are areas of sequential bad sectors then skipping significantly reduces
loading device. Herewith the percent of the data succesfully read will decrease if there are individual bad sectors.

Read back after jump. Reading skipped sectors backward until bad sector encounters.
The option is unavailable if the number of sectors to skip is too big. The feature improves data recovery quality when jump over
bad sectors.

Skipped sector filler (hex). 4-byte hexadecimal value to fill sectors skipped when jump over.

Additional Parameters
I/O buffer size in sectors. The maximum number of sectors transferred per I/O operation.

Timeout, msec. Time in milliseconds to wait for a device responce (DOS ATA Interface only).

SCSI Timeout, s. Timeout for SCSI driver I/O (Windows IO SCSI interface only).

ATA software reset if busy. Perform ATA soft reset if device is busy after timeout (DOS ATA interface
only).

ATA software reset timeout, ms. Time to wait for a device readiness after ATA soft reset (DOS ATA
interface only).

Script... Set custom Device I/O Handler (Professional Edition only).

29
Device I/O Dialog Box
TOC · Work · Device I/O Parameters Device I/O Handler Script

Device I/O Dialog Box

If an error occurs during device I/O then the dialog box appears where you can choose how to handle the error.
The following information is displayed: [W] indicates that error occurred when writing to device, LUN - disk number in the virtual
RAID, sector numbers where error has occurred, attempt number, error number, and error description (given by OS in Windows).
After a number of retries (defined by parameters) program waits for a user reaction (unless skipping errors mode in parameters is
selected) and the button Retry becomes active. Dialog box appears before the block of data is processed.

Abort: abort current operation.

Pressing Abort causes error sectors not to be copied to the destination (this behaviour may change in the future versions). Button is
inactive if the operation is not abortable.

Retry: retry I/O.

In some cases it is possible to successfully read a sector and continue without data distortion after a number of retries. Button is
inactive while I/O is in the progress.

Ignore: continue operation ignoring the error.

The current operation will be continued but most probably with data distortion. When reading file system structures this may cause
loss of some files and directory structure damage.

Ignore all: continue operation ignoring all analogous errors.

After a number of retries (defined by parameters) program does not wait for user choise but ignore the error and continue the
current operation.

Reset: reopen device (Windows NT+ only).

ATA software reset if busy: perform ATA soft reset. Available only if device is opened via ATA interface
under DOS.

Parameters: Device I/O settings

Confirm, Cancel: used for %CONFIRM% variable in the Device I/O Handler Script

30
Device I/O Handler Script /**/
TOC · Work · Menu · Drive · Device I/O Parameters Device I/O Dialog Box

Device I/O Handler Script

The script can be used for I/O error logging and for extended processing of errors (include external program calls).
The feature is available in the Professional Edition only.

Script can be loaded or modified via Device I/O Parameters (button Script).

The file ondevhsc.txt contains a brief description of available commands and some script examples.

Possible script lines are of the form:

IF CONDITION COMMAND
or
COMMAND
or
:LABEL

where CONDITION is an inequality or equality (!=, >, <, >=, <=, =) of two quantities,
and quantity is either an integer constant (0, 1, ...) or a variable (the list is below) or a simple mathematical
expression (operators +, -, *, %, /, without parentheses, ignoring the mathematical order of operators), e.g.
%ERROR%=0

Comments are preceded by two minuses (--)

Variables
Zero based
%CONFIRM% =1 if Confirm pressed, =0 if Cancel pressed (confirmation dialog box appears)
%DISKNUM% disk number in RAID array
%TRYNUM% i/o retry number
%LBA% first i/o sector number
%SECNUM% number of i/o sectors
%ERROR% i/o error
%ATASTATUS% ATA Status Register value (defined if BSY bit is cleared, DOS ATA only)
%ATAERROR% ATA Error Register (defined if ERR bit of %ATASTATUS% is set)
%LINE% current line number in script
i/o service:
0-ATA 1-ATAPI 3-BIOSINT13OLD 4-BIOSINT13
%SERVICE%
5-DOSINT25 6-DOSINT73 8-DOSMSCDEX 9-DOSFILE
11-WINFILE 12-WINSCSI 14-WIN9XINT13 20-LINUXFILE
%LASTRES% result of the previous command
%LASTERR% error of the previous command

Commands

SHOWDLG - force device i/o dialog box popping up

WAIT - wait for user choice
DELAY N - delay for N msec

31
EXECCMD CMDLINE - execute external command CMDLINE using Command interpreter
(equals "cmd CMDLINE" in Windows)
EXECCMDQ CMDLINE - execute without creating new console window (quiet)
EXEC "FILENAME" CMDLINE - call external programm FILENAME with parameter CMDLINE
EXECQ "FILENAME" CMDLINE - call without creating new console window (quiet)
MSDOS - call Command processor (not supported in Linux)
GOTO LABELNAME - jump to label LABELNAME in script (to the string :LABELNAME)
RETURN - break script execution, handle error according to device I/O params
RETRETRY - break script as Retry button pressed
RETIGNORE - break script as Ignore button pressed
RETABORT - break script as Abort button pressed
ADDLOG "FILENAME" LOGLINE - write LOGLINE to file FILENAME
(string LOGLINE may contain variables)
CANCELIO - Call CancelIO (WinNT+ only)
(available if a device is opened with overlapped option)
OVLRESLT N - Check Overlapped result (N=1: wait; N=0: not wait) (WinNT+ only)
(must be used if a device is opened with overlapped option)
RESETHANDLE - Reopen disk handle (WinNT+ only)
ATARESET - ATA Soft Reset (DOS ATA only)
ATARESETDET - ATA Soft Reset followed by ATA Identify (DOS ATA only)

Format specifiers
-- To format output integer a variable name may be followed
-- by a format specifier after a colon, e.g.
-- %LBA:8x% - width: 8, hexadecimal

Sample
IF %ERROR%=0 RETURN -- return if no error on last i/o
IF %ERROR%=128 GOTO LABEL1
IF %ERROR%=5 GOTO LABEL1
RETURN

:LABEL1
IF %CONFIRM%=0 RETRETRY -- retry if Cancel button is pressed
-- continue script execution if Confirm is pressed
EXECCMD /K ECHO error %ERROR% at LBA: %LBA% (%SECNUM%) try: %TRYNUM%. Type
EXIT to return.
IF %TRYNUM%<2 RETRETRY
DELAY 500
ADDLOG "C:\ERRORS.LOG" error %ERROR:x% at LBA: %LBA:10% (%SECNUM%) try:
%TRYNUM%
RETIGNORE

32
Drive Images and Clones
TOC · Work with program

Disk Images and Clones

● Copy sectors (menu "Tools"): creating and writing images, disk cloning
● Disk images (Menu "Drive"): opening and using image as device

33
RAID Arrays
TOC · Work · Menu · Drive

RAID Arrays
Dialog box "Construct RAID"
A tool to construct virtual RAIDs using individual disks (or partitions and images) when it is not possible to use
standard tools of the controller (hardware RAID) or the operating system (software RAID).

If it is necessary disks must be detached from the RAID controller and attached to a computer as single disks.

Incorrect selection of a RAID type or data rotation (striping) leads to incorrect data recovery (despite that the
directory structure may be reconstucted correctly).

RAID types
RAID-0. Usually contains two disks on which information is written alternately by blocks (stripes). If one disk is
absent only small files which fit into single block may be recovered. RAID-0 is supported in read/write mode.

RAID-1. Usually contains two disks, data is duplicated. Stripe size is not used. Supported in read-only mode. One
healphy disk may be opened as a single device without loss of data.

RAID-4. Usually contains three disks. One disk is for parity. Data is alternated between the rest disks. It is possible
to recover all data without any one of the disks. Use NULL device instead of the absent device. Supported in
read-only mode.

RAID-5. Usually contains three disks (or more). Data is alternated between all disks herewith one block of parity
per the rest blocks of data. There are four types of data rotation on a RAID-5. Some RAIDs (usually hardware) may
have delayed parity. It is possible to recover all data without any one of the disks (which should be replace with
NULL device). Supported in read-only mode.

RAID-6. Usually contains four disks (or more). It is similar to RAID-5 with exception that two blocks of parity
(different types) are used. Only type of parity is supported so only one disk may be replaced with NULL device.
Read-only.

RAID: Custom rotation. You may define your own striping (use Menu - Striping...). Use integer
numbers from 0 to specify data blocks according to their order on disks, -1 to specify XOR-parity block, and -2 to
specify unused block.

JBOD/Spanned. Just a bound of disks which are used as one continuous disk. There is no data alternation, stripe
size is not used. Data located on any disk will be lost if the disk is absent. JBOD is supported in read/write mode.

RAID parameters
Stripe Size:: data rotation block size. Not used in RAID-1, JBOD.

Delay: used in RAID-5 and RAID-6 with delayed parity only.

Offset: data start offset on disk (usually used on software RAIDs).

Offset and Size: partition offset and size for JBOD/Spanned disks.

Null disk: used instead of absent or damaged disk.

Striping...: manually specify striping for Custom RAID.

34
Save/Load: save/load RAID configuration.

35
File Panel
Table of contents · Work with program

File Panel
File panel displays virtual directory structure and allows browsing through directories and selecting items to
recover or to open them in the Disk Editor. You should open a volume to access the file panel.

Open virtual directory [All Found + Reconstruction] to virtually reconstruct file system and display all
found and removed files and directories. The results of NTFS/FAT Search are used for reconstruction.

To recover files marked as "found" or "deleted" (see icon description below) the corresponding options must be
selected in the data recovery dialog box.
Directory structure is virtual and may differ from the one that can be found directly on the disk or in the standard browser. Virtual
names are enclosed in square brackets or begin with the sign $ and are usually placed in the topmost level of the directory structure.
Virtual directory $Root generally corresponds to a root directory of a volume in the standard browser.

Press Enter key or double click to open the directory, or open the file in the Disk Editor.
Press Ctrl+Enter to open the item in the Disk Editor.
Press Insert key or Space Bar or click the checkbox to toggle marking the item for recovery.
Press Shift+F9/Shift+F10 or right click the item for a context menu.

GUI Console Icon Description

[.] general directory containing files
[ ] directory not containing files
[x] directory containing deleted files
[f] directory containing "found" files
[x} directory containing deleted and "found" files
(x) deleted directory
(.) deleted directory containing not deleted files (some kind of file system error)
(f) deleted directory containing "found" files
(x} "found" deleted directory
(.} "found" deleted directory containing general files
{f} "found" directory (name is followed by MFT fragment number in square brackets)
{.} "found" directory containing general files
{.) "found" directory containing general and deleted files
. general file
f "found" file (name is followed by MFT fragment number in square brackets)
x deleted file
xf "found" deleted file
[.] [MetaData] - virtual directory containing special file system files
[.] [NonameData] - virtual directory containing MFT files without names
[>] directory is not completely investigated
|.| virtual directory containing fragments of a file occupying several MFT files
. FileName:StreamName - NTFS alternate data stream StreamName of a file FileName

36
Disk Editor
Table of contents · Work with program

Disk Editor
Disk editor allows you to view and edit disk objects such as sectors, files and other file system and disk structures
in hexadecimal and formatted (structured) modes including the use of Custom Templates to parse data.

Select Object:

● use the menu Editor to select disk or file system object or to jump to a specified position
● use File panel to select a file or directory (right click for a context menu or press Ctrl+Enter)

Select View Mode (Template): menu Mode.

Enable Edit Mode: menu Edit - Edit Mode (Ctrl+E).

NTFS file editing is supported in RAW mode only.

Apply Changes: menu Drive - Apply Changes (Ctrl+W).

Use the menu Tools for additional functions:

• Copy sectors... to write the selection or the entire object to a file.
• Fill sectors... to fill sectors with a pattern.
• Search string to search string in the selected object.
• Search spec. sector to find some data structure on a disk.
Yellow text color in the Disk Editor indicates modified but not written data.
Grayed text color indicates unused data (unused part of the cluster, unused entry, etc.).
Green data color indicates I/O errors while reading corresponding sector.
Red text color indicates logical errors in the data.

37
Disk Editor Templates
TOC · Work · Menu · Mode

Disk Editor Templates

Apart built-in templates, Disk Editor supports custom templates to view and edit different disk structures.
Conditions, "goto" operators, simple arithmetics may be used to parse complex disk structures, such as MFT
records.

By default templates are loaded from the file template.txt. To use different files ini-parameter
editortemplates= may be used, wildcards are allowed (e.g., editortemplates=template*).

See files template.txt and template.tx_ for template samples.

Template File Structure

Each template begins with a name in square brackets [Template Name] followed by the template parameters
and commands (one per line).

Template Parameters
flow:0 - display single record at a time. flow:1 - display records in a flow.
h:Header - display static Header at the top.

Variables
$RECSIZE - size of the record.
$OFFSET - relative offset applied to data blocks.
$1 ... $64 - custom variables (64-bit signed integers).

Constants
Constants are specified as decimals and hexadecimals (with 0x prefix).

Data Block
Data block is usually a single byte/word/dword at a fixed position but it also may be any range(s) of record
bytes/bits which are processed as a single variable. Data block is specified in braces {...}.

{X+Z} defines range of Z bytes starting at offset X,

{X:Y+Z} defines range of Z bits starting at offset X byte and Y bits,
where X, Y, and Z may be any variables or constants,
several ranges may be separated by commas, e.g. {0x00+4,$1:$2+4}.

Data Block Formats

Format defines how data block is represented and edited (e.g. as integer / char / string, etc.).

The following formats are supported:

%u - unsigned integer (up to 32bit)
%D - signed integer (32bit)
%I - signed integer (64bit)
%X - hexadecimal (up to 32bit)

38
%IX - hexadecimal (up to 64bit)
%c - ANSI character (8bit)
C - array of ANSI characters
U - array of Unicode characters (UTF-16)
UNIXDATE - Unix date (seconds since epox)
FILETIME - Windows file time (nanoseconds since 1601)
F:ABCD.. - Flags (where A is displayed if bit 0 set, and B if bit 0 clear, etc.)

Output
Output command defines the position on the screen and format for data block or variable or outputs text.

{...},x:X,w:W,f:Format outputs data block {...} at column X with the maximum width W.
x:X,w:W,f:Text outputs Text at column X with the maximum width W.
= (equal sign) specifies end of line (line feed).

Conditions
Conditions are used in the following way:

IF Condition
... (commands to be performed if Condition is true)
ELSE
... (commands to be performed if Condition is false)
ENDIF

where Condition is a comparison (==, <>, <=, etc.) of two variables, constants, or data blocks.

Labels and Jumps

Line LABEL:N defines a label, and command GOTO:N is a jump to line LABEL:N, where N is any constant.
Inaccurate use of GOTO may cause infinite loop.

Assignment Operator
Assignment operator := may be used to assign variables with a constant values, data block values, other variable
values and the result of their addition or subtraction, e.g. $1:=$2+{X:Y}, $OFFSET:=$OFFSET+8.

Switches
Switches may be used e.g. to hide/show some lines by clicking or pressing Spacebar. E.g., command
$1:=TOGGLE:N,x:X outputs button [+] ([-]) at column X, where N is a unique switch number (variables and
constants are allowed, the best way is to use the next data offset); variable $1 gets value 0 or 1 depending on the
switch state. Only one switch may be in state 1.

Additional Template Sections

Record size calculation: commands between lines CALCSIZESTART and CALCSIZEEND. It is used when record
size may be greater than the sector size and may depend on disk data. Variable $RECSIZE may be assigned in this
section only.

Data preprocessing: commands between lines LOADSTART and LOADEND. It is used e.g. for MFT USN
processing (restoration of last two bytes of each sector). Data blocks may be assigned in this section: e.g., use
39
{U+Y}:={X+Y} to copy Y bytes at offset X to offset U.

Data postprocessing: commands between lines FLUSHSTART and FLUSHEND. It is used for reverse operation
when writing modified data to disk (data blocks may be assigned).

40
Cluster Map
TOC · Work · Menu · Tools

Cluster Map (File Allocation)

Volume cluster map allow finding the file located at a given cluster/sector.

To use cluster map first open volume and update cluster map (menu Tools).

To go to a specific location use menu commands

● Editor - Volume Cluster [Alt+C] to go to a specific volume cluster
● Editor - Volume Sector [Alt+S] to go to a specific volume sector
● Editor - Physical Sector [Alt+P] to go to a specific device sector

To identify the file located there use menu commands

● Editor - Cluster Map [Ctrl+M] to open cluster map at a selected location.
● Editor - File Data [Ctrl+F] to open file at a selected location.

Status string of the cluster map has the following format:

[current volume cluster/total clusters number]
"file (stream) name" vcn: cluster number per file

41
Menu
TOC · Work with program

Menu
● Drive
● Select Drive...
● Open Image...
● Construct RAID...
● Partitions...
● Lock Volumes...
● Device I/O Parameters...
● Load Rollback Data/Dump from File...
● Dump Changes to File...
● Undo Changes
● Redo Changes
● Reset All Changes
● Apply Changes
● Tools
● Recover...
● Search in found (by name)...
● Reconstruct File System...
● NTFS Search...
● FAT Search...
● Cluster Map
● Update Cluster Map
● Clear Directory Tree
● NTFS Tools
● Copy Sectors...
● Fill Sectors...
● Search for Special Sector...
● Search String in Object...
● Search Again
● Windows
● Editor
● Mode
● Edit

42
Menu "Drive"
TOC · Work · Menu

Menu "Drive"
● Select Drive...
● Open Image...
● Construct RAID...
● Partitions...
● Lock Volumes...
● Device I/O Parameters...
● Load Rollback Data/Dump from File...
● Dump Changes to File...
● Undo Changes
● Redo Changes
● Reset All Changes
● Apply Changes

43
Manage Changes
TOC · Work · Menu

Manage Changes
All changes made in Disk Editor and Partition Manager remains virtual until you explicitly apply them to the disk.

Load Rollback Data/Dump from File...

You may load rollback data (if saved when applying previous changes) and thus undo the last changes. Also you
may use the command to load changes which were dumped to a file instead of applying to the disk.

Dump Changes to File...

You may dump changes to a file instead of applying them directly to the disk. Later you may reopen the disk and
load all unapplied changes from the file.

Undo Changes
Group undoing the last changes. To undo individual actions use the corresponding commands of Disk Editor (menu
edit) or Partition Manager.

Redo Changes
Group redoing the last changes.

Reset All Changes

Discard all unapplied changes.

Apply Changes (Ctrl+W)

Write all changes to the disk. For changes to take effect in operating system you may probably have to restart
computer. Under Windows you may not be allowed writing to some disk areas used by volumes - see Volume
locking for details. Some antiviruses may also block direct writing to disk. Under Windows you may also try
interface option IO SCSI to circumvent some restrictions.

44
Volume Locking
TOC · Work · Menu · Drive

Volume Locking
Volume locking is used under Windows NT+ for RAW write access to prevent simultaneous OS access to a
volume at the same time.

DMDE tries locking volumes automatically when it is required. However, locking may fail if the volume is being
used by system or other applications. In this case, DMDE requests to retry or dismount not locked volumes. Close
all applications which may use the volume and retry.

Retry Retry volume locking

Dismount the volume. Warning! All used volume handles will be lost, e.g. unsaved data in opened files
Force
will be lost
Try RAW writing without locking the volume. Warning! File system may be damaged or RAW write
Ignore
access may be denied by operating system
Cancel Cancel the operation

Warning! You should not lock or dismount the volume from where DMDE software runs from. You may not lock
or dismount system volume.

DMDE unlocks volumes when closing the device currently used.

Additionally you may manually manage volume locking using menu "Drive" · "Lock Volumes for Write".

45
Menu "Tools"
TOC · Work · Menu

Menu "Tools"
● Recover...
● Search in found (by name)...
● Reconstruct File System...
● NTFS Search...
● FAT Search...
● Cluster Map
● Update Cluster Map
● Clear Directory Tree
● NTFS Tools
● Copy Sectors...
● Fill Sectors...
● Search for Special Sector...
● Search String in Object...
● Search again

46
Volume Commands
TOC · Work · Menu · Tools

Volume Commands
Search in found (by name)
List files matched the specified pattern. Search is performed over already found volume files. Reconstruct file
system to list deleted and other found files too.

Update Cluster Map

Update file allocation information.

Clear Directory Tree

Reset reconstructed virtual directory tree. View directory structure without the results of NTFS/FAT Search and
file system reconstruction.

47
Virtual File System Reconstruction
TOC · Work · Menu · Tools

Virtual File System Reconstruction

Open virtual directory [All Found + Reconstruction] in the File Panel to virtually reconstruct directory
structure and prepare found and removed files and directories for recovery.

NTFS
The results of NTFS Search are used by default. You may manually select found MFT fragments to be used for
reconstruction.

FAT
Use FAT Search results only
Use the previous FAT Search results only without scanning the entire volume again.
Rescan the entire volume
Additionally rescan the volume if it is not scanned completely during FAT Search. The results of volume scan
may not be saved for future use.

48
NTFS Tools
TOC · Work · Menu · Tools

NTFS Tools
Warning! The use of NTFS Tools on incompatible NTFS volume may damage the file system. Do not use the
tools if the program does not recognize file system properly or you are not sure if it is.
Never execute the commands on the system volume (where operating system files are located) otherwise it will be
damaged.
Volume locking is performed when writing to volumes. After executing the commands you should check the
volume with the system utility chkdsk.
It is not recommended to create file names with special symbols.

Open NTFS volume and enter the necessary directory in the file panel before using tools.

Copy File
Copy, overwrite, or append file to the opened NTFS volume bypassing NTFS system driver.
Read the warning before using.
• Open destination directory in the file panel to copy file to.
• Call the command from menu.
• Select the source file.
• Enter destination file name.
• Choose either to overwrite or append file if the destination file exists.
A continuous free space on the volume is required for writing the file.

Create Directory
Create a directory on the opened NTFS volume bypassing NTFS system driver.
Read the warning before use.
Directory is being created in the current folder of the file panel.

Remove File/Empty Directory

Remove selected file or empty directory from opened NTFS volume bypassing NTFS system driver.
Read the warning and NTFS write issue before use.

Repair Directory INDX-records

Repair NTFS directory currently opened in the file panel.
Read the warning before use.

49
Copy Sectors
TOC · Work · Menu · Tools

Copy Sectors
A tool for creating disk images, clones, writing images back to disk, and copying different disk objects. Write is
performed directly to the destination, the operation may not be undone. For changes to take effect in OS you may
probably have to reload computer. See Volume locking also.

Source and Destination

Button Purpose
Device Select Device, Logical disk (volume), Image as source/destination sectors
Partition Select Partition as source/destination sectors (use Device button to select the disk before),
To select the entire current device/disk/RAID double click the topmost item in the partition list
File Use file as source bytes / a destination (alternatively Device · Open Image to use file as sectors)
Editor Use the object opened in the Disk Editor window as source bytes
Selected Use selected block of the Disk Editor object as source bytes

Source fields Start Sector, End Sector, Number of Sectors, Start Byte, End Byte, Size
in Bytes are filled in automatically on source selection by buttons. Fields may be altered manually in order to
specify a portion of the source object to copy. If the source is a file or Editor object then fields are specified in
bytes.

Destination field Start Sector is also filled in automatically on destination selection by buttons Device,
Partition. Start Sector is specified relative to the beginning of the selected destination object. Start
Sector of the source always corresponds to Start Sector of the destination (regardless copying direction).

If RAID is constructed then it may be used as a source/destination.

Using the Device button you may select a file (disk image) as a source or a destination. Then you may specify parameters
available for a disk only.

If Editor or Selected is used as a source then some logical errors (such as invalid cluster or sector numbers) are silently
ignored.

Parameters
Log file may be used for tracking already copied ranges and for getting numbers of sectors with errors. The sector
numbers are absolute to the source disk.

The option "use log to continue copying" may be used to continue copying automatically from the last position. It
also may be used for multi-pass copying (including non-sequential copying in different directions) to copy sectors
skipped when previous passes. The option is available in Professional Edition only.

The option "Retry copying bad sectors from log" may be used to retry copying bad sectors from log when all
skipped sectors are already copied. The log may not be used for continue copying bad sectors (on each pass bad
sectors are being copied from the beginning).

The button "Parameters" allows setting up device I/O parameters to handle errors. Changing some parameters (
Jump over sectors, Auto retries number, I/O buffer size) when using log to
continue copying may cause copying of the previously skipped sectors (e.g. if you decrease the parameter
Jump over sectors).

Reverse copy: copy backward (from the end to the beginning) to create an image of a disk with problems.

50
Double thread: perform read and write operations in parallel threads to increase the speed. Do not use the option
for copying disks with errors.

The field Continue from sector/byte specifies the position to continue copying. The position is relative to source
start. When copy in reverse direction copying starts previos to the specified position and goes backward (e.g., if
set to 10 then sector 9 will be copied first and copying will go to the beginning).

The option Lock the source for copy is for locking the volumes located over the source area to prevent
modification of the source during copying (Windows only).

51
Fill Sectors
TOC · Work · Menu · Tools

Fill Sectors
Write a hex pattern or pattern from a file to a sector range of the device. Write is performed directly to the disk, the
operation may not be undone. Pattern is written multiple times, covering all specified sectors.

The maximum size of the hex pattern is 8 bytes. Use files for larger patterns.

Sector alignment. If the option is checked and the next pattern copy does not fit into the sector entirely then
pattern writing starts from the beginning of the next sector. Otherwise patterns are being written consistently
regardless of sector boundaries.

52
Special Sector Search
TOC · Work · Menu · Tools

Special Sector Search

Search for special disk or file system structure. Search is performed over disk sectors starting next to the current
sector.

Boot Signature: search for a sector having boot signature 0xAA55.

Boot Sector: search for a FAT/NTFS boot sector.

Partition Table Sector: search for a partition table.

MFT Record: search for MFT file.

NTFS Dir Record: search for NTFS directory INDX-record.

FAT Table Sector FAT16,

FAT Table Sector FAT32: search for FAT cluster table (file allocation table).

FAT Directory: search for FAT directory.

53
Search String in Object
TOC · Work · Menu · Tools

Search String in Object...

Search for a string in the Editor object.

54
Search Again
TOC · Work · Menu · Tools

Search Again
Continue searching the string over the current object or specific sector over the disk starting from the current
position in the Disk Editor.

55
Menu "Windows"
TOC · Work · Menu

Menu "Windows"
● Directory Tree
● File Panel
● Editor
● Search Panel (Search in Found)

56
Menu "Editor"
TOC · Work · Menu

Menu "Editor"
Select object to open in Disk Editor.

Partition Table Open all disk sectors. Go to the MBR sector (the first disk sector).
Open all volume sectors. Go to the volume boot sector (the first sector of the volume
Boot Sector
opened).
Boot Sector Copy Open all volume sectors. Go to the volume boot sector copy.
Root Directory Open volume root directory.
FAT/MFT Open FAT1 (main cluster table) for FAT volume, MFT for NTFS.
FAT Copy/MFT Mirror Open FAT2 (cluster table copy) for FAT, MFTMirr for NTFS.
MFT Record... Open MFT. Go to the specified MFT file.
Volume Cluster... Open all volume sectors. Go to the specified volume cluster.
Volume Sector... Open all volume sectors. Go to the specified volume sector.
Physical Sectors... Open specified drive sectors. Go to the specified drive sector.
File Data Open file located at the current cluster.
Directory Entry Open directory containing current file. Go to the file entry.
For FAT: open FAT1; go to the FAT1 cluster corresponding the current volume
FAT Cluster/MFT Record cluster. For NTFS: open MFT; go to the MFT record corresponding the current file
or volume cluster.
Cluster Map Open Cluster Map. Go to the map cluster corresponding the current volume cluster.
Goto Object Offset... Go to the specified position of the opened object.

Except for commands Partition Table and Physical Sectors you should open a volume at first.

57
Menu "Mode" /**/
TOC · Work · Menu

Menu "Mode"
Toggle Disk Editor view mode.

Custom Templates Select custom template

Hexadecimal, Text Use menu item Encoding to change view code table.
Press Enter key to open file data or directory in the Editor window (if FAT
FAT Directory
volume is opened).
FAT cluster table. Press Enter key to jump to the corresponding volume
FAT12/FAT16/FAT32
cluster.
Use the command again or press F6 to switch between MBR/GPT/GPT Copy.
Partition Table MBR/GPT
Press Enter key to jump to the mentioned sector.
Volume boot sector. Use the command again or press F7 to select the next file
FAT/FAT32/NTFS Boot Record
system. Press Enter to open volume.
NTFS directory INDX-record. Press Enter to open file or directory in the
NTFS Directory
Editor window (if NTFS volume is opened).
Press Enter key to open selected attribute or directory in the Editor window.
MFT Record
Press Space bar to view attribute details.
NTFS File RAW Sectors Switch between decoded file data and RAW sector data (as on drive).
Encoding... Select code table to translate text in Hexadecimal/Text mode.

58
Menu "Edit" /**/
TOC · Work · Menu

Menu "Edit"
Commands to use in Disk Editor.

Fill Zero Block Fill the selected block with zeroes

Copy Copy the selected block to the internal buffer
Paste Paste internal buffer data at the current cursor postition
Paste File... Paste file at the current cursor postition
Toggle selection mode. Or hold down Shift and use arrow keys or hold down left
Select Block
mouse button
Select All Select the entire object
Reread block Read data from the disk again
Hide/Show Changes... Switch between displaying the initial data and the modified data
Undo Undo the last edit (in the mode hex/text - all changes within the sector)
Redo Redo editing
Edit Mode Toggle edit/read only mode

59