Hexpert version 0.9X.x, user manual, TXT version.


The contents of this document: 

General information
Copyrights, disclaimer and distribution
Program description
How to use 
  - menus and options explained
Run errors
Tools used and copyrights
Version history
Known issues
Contact information


--------------------------------------------------------------------------------

General information. 

Please note : In this document we refer to the "recovery manual". This recovery manual is not yet finished. Please check the site http://diydatarecovery.sites.cc for info on the recovery procedures that in the future will be described in the recovery manual. The direct link is here, (http://home.soneraplaza.nl/mw/prive/jvs/repoman.htm). 


--------------------------------------------------------------------------------

Copyright, disclaimer, permission and distribution notices. 

This program is conceived and written bij Joep van Steen and Tom Kuurstra.
(C) 2000, DIYdatarecovery and (C) 2000, Intra_Vee developments.

You may not include (parts of) this program in your own code and/or programs. Please check below for redistribution notices.

This program does NOT write anything to the harddisk that the recovery is performed on (unless the user directs the recovery output to a logical partition that is on the harddisk that is examined). This program therefore does NOT perform any recovery by itself. This is by design. The output this utility creates is to be used for the recovery of harddisk content. We can and will not be held responsible for any damage that might be inflicted by the user as he or she performs the recovery operations.

You, as the user, are not permitted to:

decompile, disassemble or change the program code in any way; 
change the documentation or any text accompanying the program; 
change the distribution in any way. No files may be removed from and no files may be added to the distribution; 
use this program for commercial reasons or in environments (i.e. companies or persons) that (make a) profit from datarecovery; 
(re)sell the program, or accept any fee for distributing or using the program; 
redistribute the program. Distribution rules follow. 
This program is distributed as Freeware. You are free to use this program, as long as you comply with the above mentioned rules. There is one restriction. You may NOT redistribute the program. This program may not be placed on bbs's, websites, FTP sites or any other location that facilitates download. If this is desired anyway, please contact us on one of the supplied e-mail addresses and we will get back to you. 

We also ask that you supply us with feedback on what has been achieved with the program or what has gone wrong. Also, any suggestions for changes or improvements are welcome. Contact information can be found at the end of this document.

We try to provide as much support as we can, however, the number of support requests we receive forces us to be selective. We cannot guarantee a prompt replt to your support request. Registered users will always be helped before non registered users. Problems that are not real dataloss issues are ignored (my system won't boot but I can see all my files..) and will not even be replied.

If you do need our support please see the Help function on the website on where to mail and what information should be included. Incomplete support requests will be ignored and will not receive a reply at all.


--------------------------------------------------------------------------------

Program description. 

- In short

A tool that runs in real-mode win9x/DOS environment, that allows access to harddrives through BIOS int13h calls. By using the BIOS for access, it is not required that the OS can access information on the harddrive. Having direct access to raw information on the harddrive can aid in the recovery of the information on the harddisk.

- A little less short

Hexpert offers you powerfull features that might aid in the recovery of 'lost' data of a harddrive. Where an OS depends on the integrety of logical structures on the harddrive, Hexpert bypasses these structures, and lets you work with raw data as it is found on the harddrive. Hexpert can be used in conjunction with RepoMan (c) Intra_vee/DIYdatarecovery, where RepoMan can help you find 'anchors' or 'significant sectors' and where Hexpert can be used to manipulate these sectors, and by this gaining access to data again through the OS.

RepoMan uses int13H calls to access the harddisk through BIOS. In general this means, if FDISK detects your harddrive, Hexpert can work with it. NOTE: Do not write any information to the drive with FDISK when dataloss occurred!

The program has two modes of operation.These modes can be set in the preferences menu. The modes are:

READ ONLY MODE (default) - Hexpert is in read-only mode when you start the program. In this mode the following options are available; view raw HEX data as found on the harddrive, save sectors to a file (do NOT write to the corrupted harddrive!), search the harddriev for a ascii string on a given offset within a sector. Searching on a specified offset will reduce the number of unwanted hits when searching for a string like 'MSWIN' (which can reveal the location of a bootsector)

READ/WRITE MODE - Apart from the above options the following are availabe as well; read a sector from a file and write it to disk, copy a sector from one location to another (the advanced options for FAT32/NTFS bootsector repair are based on this), edit a sector, copy a drive to another drive. the last option can be very usefull when a drive is developing bad sectors and the data needs to be copied to a healthy drive. In these scenario's 'conventional' clone utilities might fail, while Hexpert can make several attempts to copy data from 'bad sectors', or if this fails, skip them. This option is also usefull when the outcome of recovery interventions is unpredictable and a backup to another drive is required. All write operations will make Hexpert the data that is about to be overwritten back up first. This will allow you to undo your actions if they have unwanted results.

The program does NOT perform any recovery, the user performs the actual recovery operation. For this the user needs to be aware of how operating systems store information on a harddrive, for information on this, visit the DIYdatarecovery website which has information on this and also links to several other informative sites.

For gathering information on the harddrive that can be used for the recovery we suggest the use of RepoMan. RepoMan is a powerfull utility that can dig up any information from a harddrive as long as it was not overwritten.

We call the files that RepoMan produces, the Recovery Output. It is adviced to view the recovery output in a DOS text editor. 
Please note that all hex that is displayed in the recovery output has not been modified in any way, no calculations are performed. The bytes you see are the bytes that are on the disk, as they are. See the Repoman documentation for more detailed information about this program.


--------------------------------------------------------------------------------

How to use. 

- Get started.

When performing recovery with Hexpert and when running Hexpert, it is best to do this from a real mode DOS/win9x bootdisk. We assume you know how to create one. When Hexpert can store its temporary files and undofiles on a RAMdrive it will speed up the actions considerably. Note that when the drive is full the temporary and undofiles will be overwritten, no warning is given. Make sure you have a large enough logical drive to hold the undo and temporary files. You should not use the harddisk that the recovery is performed on for this, even if it still contains a valid logical drive. 

Include a compression utility on the bootdisk to transport the recovery output from the RAMdrive to any other machine, if so desired. We endorse the ARJ compressor, the best and most flexible commandline compressor available,  which can be found here (http://www.arjsoftware.com).

- Starting the program.

Starting the program from the commandline with no parameters will display the main menu. Before the main menu is displayed some checks are performed: the target disk is checked to see if it exists and if it can be read; the disk is scanned for drive overlay signatures. If any errors occur during these checks the user is notified.

If the disk can not be found or read, the program exits with an int13H error code. Use the code to see which exit condition is the cause for the abort and see if you can fix the problem. The list with exit int13H error return codes can be found in the "run errors" section.

If a signature for drive overlay software is found the program will notify the user. The program will not abort. The user should check to see if the drive overlay software is loaded. If not, the CHS can be erratic and can not be used for recovery.


--------------------------------------------------------------------------------

- The menus 

When the program is ready for use it will display the main menu, which looks like this :
________________________________________________________________________________________
 Hexpert version 0.97b [under construction]                      memory : 29184

 --- Main Menu ---                          --- Current settings/info ---

 --- Sub Menu ---                          geo for drive : Cyl / Head / Sect
 [p] - parameters source/destination             drive 0 : 621 / 128 / 63
 [a] - advanced options                          drive 1 : 782 / 128 / 63
 [q] - settings                                  drive 2 : 0 / 0 / 0
                                                 drive 3 : 0 / 0 / 0
 --- Commands ---
 [c] - copy a sector from a to b                   --- Source ---
 [s] - save sector to file                         drive : 0
 [r] - read sector from file                      sector : 0 / 0 / 1
 [e] - edit sector                              --- Destination ---
                                                   drive : 0
                                                  sector : 0 / 0 / 1


 [Esc] - quit
 [i] - info
[F1]-help[Esc]-back/abort[F7]-reset[F8]-undowww.diydatarecovery.sites.cc
 Command line: Main menu              rwmode:rono.undofiles: 5retries: 4
 Select command / sub menu
________________________________________________________________________________________

The left side of the screen contains the menu options, the right side contains information on the current disk geometry and the current settings. The black bar displays other options that are available from this menu.

The top line contains the program name and version information.

The bottom green line displays information on the menu you are in, the mode the program is in (ro-readonly, rw-readwrite), the number of undofiles that is kept (default is 5), and the value for retries in case a read/write error is encountered (default is 4).

The bottom 3 lines are used for status information and for user input. During a search the location that is currently scanned is displayed. If a match is found you'll be notified in this area of the screen as well.

The basic screen layout is the same for all menus.

Main menu options :

[p] - use this option to enter the source sector(s) and destination values. Source values will be used for ALL read actions, and destination values for ALL write actions. Sectors are entered on a C/H/S (Cylinder / Head / Sector) bases.
[a] - Takes you to the advanced options menu; repair a FAT32/NTFS bootsector, search for phrase in specific offset and copy an entire disk to another drive.
[q] - Settinggs can be antered here, toggle read/write mode, number of retries and number of undofiles that should be kept.

[c] - Copy setor(s) from one location to another on same harddrive or another harddrive. Values that you have entered in the parameters menu are used.
[s] - Save sector(s) to a file. Values entered for source are used. You will be prompted to enter a filename.
[r] - Read sector(s) from a file and write them to disk, values entered as destination are used. You will be prompted to enter a filename where the information should be read from.
[e] - Edit the sector(s) that are specified as source. For this purpose, hexpert will start an external hexeditor. Here you can edit the sector, F12 exits the hexeditor and sectors will written to disk. 

[i] - will show some info on the program.

Note: All actions that include write operations to the drive, will only actually write if the program is in 'rw' mode!

Note: All write actions will provoce Hexpert to create an undofile of the sector that is to be written to first. At this point Hexpert does not log these undofiles yet. It is therefor advised to keep a list of, which undofile was created during which actions!


Press Escape to exit the program.

[F1] - Displays generic help
[F7] - Resets ALL (!) values to defaults and rescans drive geometry.
[F8] - Undo the last write action. Note: The last values that were set as destination will be overwritten with thee contents of the last created undofile. This implies, that is you have changed the destination values the wrong sector(s) will be corrected! If you make this mistake press F8.


--------------------------------------------------------------------------------

Run errors. 

If a problem occurs during a read/write action, the program will retry for the set value. A description of the error will be given unless the error is unknown, in which case the user will be given the errorcode. See contact information for info on how to deal with this. DOS level errors are handled by DOS at this time. So for instance, if the diskette is specified as location to save a file to, but the diskette is not ready, the standard DOS error will be displayed:

Drive not ready

(a)bort,(i)gnore,(r)etry?


If an error in an int13H function occurs, the program will not abort, unless the error occurred during the initialization fase. 

The error return codes for the program:

02 file not found
03 path not found
04 too many open files (no handles available)
05 access denied
08 insufficient memory
10 environment invalid (usually >32K in length)
11 format invalid
13 data invalid
15 invalid drive
19 disk write-protected
20 unknown unit
21 drive not ready
23 data error (CRC)
26 unknown media type (non-DOS disk)
27 sector not found
29 write fault
30 read fault

The error return codes for int13H functions :

01 - Bad command
02 - Bad address mark
04 - Record not found
05 - Bad reset
07 - Init failure
09 - DMA boundary
0B - Bad cylinder
10 - Bad ECC
11 - Data corrected
20 - Bad controller
40 - Bad seek
BB - Undefined error
FF - Sense failure

If you get a different returncode than the ones listed here, send us an e-mail. Check contact information for info on this.


--------------------------------------------------------------------------------

Known issues. 

The program does not give any feedback when the target drive for the recovery output is full. 
The program is limited to the first 1024 cylinders of a harddisk. 
Sometimes the (e) option in the main menu will not work. We are aware of this problem and are working on it. 

--------------------------------------------------------------------------------

Contact information. 

DIYdatarecovery 

website : DIY datarecovery, (http://diydatarecovery.sites.cc)
E-mail : webmaster (webmaster@diydatarecovery.sites.cc)

If you experience an unknown error or any other problems please mail us on one the above mentioned addresses. Please explain the situation in which the error occurred and note any codes or text the program displayed during the error. Also include a description of the machine the program is running on, try to be as specific as you can. Also include the Hexpert version number.

