Before you start

IMPORTANT: If you wish to work with a disk following forensic guidelines (meaning: nothing may be changed on the disk that is examined), you MUST start ByteBack D.R.I.S.^TM in Forensic mode. If this is the case, please make sure to read the manual parts that explain the Forensic mode.

Things to consider

# Make sure you understand the conventions used in this User Guide.

# Make sure you have a good overview of which partitions you want to be present after the recovery. You should have some idea about their location, size and type (FAT, NTFS etc.). In the phase where you select the partitions for repair, make sure you select all partitions that should be present after the recovery, including the ones that are intact and that you currently have access to.

# ByteBack D.R.I.S.^TM can theoretically access disks as large as 2 TeraBytes *IF* your system BIOS or the BIOS of the hard disk controller can address disks that large. If your system can only access the first 128 Gb of a disk, ByteBack D.R.I.S.^TM will also be limited to accessing the first 128 Gb.

Note: As BIOS problems are sometimes the cause for data loss, ByteBack D.R.I.S.^TM will try to detect a possible 128 Gb boundary problem (the absence of 48 bit LBA addressing support) that your BIOS may have. If ByteBack D.R.I.S.^TM detects such a problem, you should consult your motherboard manufacturer to see if a BIOS update is available to resolve this issue. If no BIOS or firmware updates are available, an add-on disk controller is a good solution.

# ByteBack D.R.I.S.^TM will only work with the first 4 physical hard disks in your system. If you have attached more than 4 physical hard disks, and the disk that needs repairs is not one of the first 4, you need to (temporarily) change the configuration of your system.

# ByteBack D.R.I.S.^TM accesses disks through the extended int13h interface offered by your System BIOS or hard disk (IDE/SCSI) adapter. USB and Firewire disks are not detected. To be able to make repairs on USB or FireWire disks you need to remove the actual disk from it's casing and attach it directly to an IDE port.

# If you suspect or have evidence that physical disk problems (such as surface damage) are the cause for dataloss while the BIOS still detects the disk, your should clone the disk as soon as possible.

# After the repair, ALWAYS verify the contents of the drives before you attempt to boot from a repaired disk! Access the drive(s) read-only! To verify FAT and FAT32 partitions, use a MS-DOS boot diskette. To verify the contents of an NTFS partition we recommend the (freeware) read-only NTFS driver NTFSDOS from http://www.sysinternals.com or the read/write driver NTFS4DOS from http://www.datapol.de (also free for personal use). 

Other advanced ways to access a repaired disk:

• a Linux bootable CD-ROM can be used (can access FAT, FAT32 and NTFS) - For example the Knoppix distribution.
• BartPE can be used to create a bootable Windows XP CD/DVD.