TIRAMISU FOR NTFS - SOPHISTICATED DATA RECOVERY
(c) 1997 by Plug'n Play, Uwe Gissemann


INTRODUCTION

TIRAMISU FOR NTFS is a software for reconstructing data from a crashed
NTFS server or workstation drive.

It helps when the drive is

    - hit by a virus
    - formatted
    - 'fdisk'ed
    - zapped by a power failure
    - damaged by applications

TIRAMISU FOR NTFS scans the drive even when there are physical damages.
The found data are analyzed and reconstructed. TIRAMISU can handle
drives that are not recognized by the operating system anymore.

TIRAMISU FOR NTFS automatically creates a VIRTUAL DRIVE in memory.
This virtual drive looks like a usual file manager. You can see the lost
directories and files of your crashed drive. Now files and directories
can be viewed and copied to a safe medium.

The extensive use of our sophisticated pattern recognition technology
enables TIRAMISU FOR NTFS to put the right pieces of data together
again. Even disks with very few administrative informations left can
reach a high recovery quality.

TIRAMISU FOR NTFS is NON DESTRUCTIVE and READ ONLY. It does not put any
data onto your crashed drive. Recovered data are restored to another
destination (disk, diskette, network, interlink). TIRAMISU is run from
a DOS diskette or drive.

TIRAMISU FOR NTFS works on any NTFS workstation or server platforms.

A version for DOS/WINDOWS and for NOVELL is available too.


SYSTEM REQUIREMENTS

- 386 processor and up
- 8 MB RAM and up

Depending on the size of the drive to be recovered we recommend a 486 with
16 MB RAM. Installing 8 MB of EMS (Version 4) is recommended.


GETTING STARTED

1) Boot diskette

Create a boot diskette with a CONFIG.SYS similar to this:

        files=25
        device=himem.sys
        device=emm386.exe

Make sure you have specified the correct drive parameters in BIOS setup.
Boot the computer and start the program TIRAMINT.EXE.

4) Specify swap area

By default TIRAMISU FOR NTFS uses EMS as swap area. If for some reason
there is no or not enough EMS you can specify a swap area on disk.
Select OPTION -> DATA RECOVERY, tag 'DISK', specify path.
CAUTION: Do not swap to the drive you intend to recover.

3) Restrict sectors

By default the whole drive will be scanned for NTFS partitions. If for
example you *know* that the NTFS partition you want to recover is
somewhere between sector 0 and sector 500000 of a 2GB drive (=4000000
sectors) you can specify the area that will be scanned by TIRAMISU FOR
NTFS. This will speed up the recovery process.

4) Restart from last / Keep for next session

The scanning of the drive can take up to several hours. It might be a
good idea to keep the results of the drive scan for a future run of
TIRAMISU FOR NTFS. For doing this select OPTION -> DATA RECOVERY,
tag KEEP FOR NEXT SESSION.
If you want to use scan results from a previous session tag RESTART
FROM LAST.
Specify a directory if you tagged one of these options.

5) Fast Identification

By default TIRAMISU FOR NTFS uses fast structure recognition algorithms.
If you don't see the partition you want to recover tag this option off.

6) Hit RECOVER for the drive you want to recover. You can switch between
   the drives using the TAB key.

TIRAMISU FOR NTFS starts processing. Depending on your system's speed
and the size of your drive this can take 15 minutes or even up to 8 hours.
Finally you will be shown a window containing the found NTFS partitions.
Every entry contains the following information:

- Start sector of this NTFS partition
- Block size used by this NTFS partition
- Score (entries with high scores are more likely to be valid than others)

Select the entry that describes your lost partition best (usually the 1st)
TIRAMISU continues processing. This can take up to 2 hours.

7) Copy some or all files to a safe medium using F7

Now you see the "Virtual Drive" and you can view and copy (registered
version only) the files to any DOS-available destination.

THAT'S IT! ISN'T IT EASY?


RESTRICTIONS


Since TIRAMISU FOR NTFS is very memory hungry, your PC might run
out of memory. If you face this problem, install a memory manager with as
much RAM and EMS as possible.
Watch the available memory displayed at the bottom line. The value displayed
at the far right shows the free RAM. The E:XXX shows the free EMS.
The RAM should not go below 50000.


TROUBLE SHOOTING

Sometimes you might think the computer is frozen and TIRAMISU FOR NTFS
is crashed. Be patient! Some procedures might take up to one hour. If
TIRAMISU FOR NTFS crashes you usually get an error code.

If the program crashes check the available EMS and disk space. 16 MB ram
with 8 MB configured as EMS are good.

If TIRAMISU FOR NTFS does not find any partition tag off the option
"Fast identification". Re run TIRAMISU FOR NTFS.

If you selected "Restrict sectors" *and* "Keep for next session" you
must enter the same sector range for a further session using "Restart
from last".

You should not use any other 'disk doctor' before running TIRAMISU FOR
NTFS.

Upload a new version from our Internet site (address below).

If you find any bugs, please send a description to one of the addresses
below.


REGISTRATION

TIRAMISU FOR NTFS IS DISTRIBUTED AS SHAREWARE. FEEL FREE TO COPY,
DISTRIBUTE OR UPLOAD IT TO ANY MEDIUM. The unregistered version has
all functions for recovering your crashed hard drive. But only the
registered version of TIRAMISU allows you to COPY files from your
recovered drive.

There are two kinds of licenses available:

    - A limited version that can only be used for a PERIOD OF ONE WEEK.
      In effect this is a PAY PER USE registration. The fee is
      DM 295 (approximately US $195).
    - An unlimited version that can be used for an UNLIMITED PERIOD at
      one computer at the same time. The fee is DM 590 (approximately
      US $390).

The procedure is this:

    - Run TIRAMISU FOR NTFS and check if it can restore your data
      (VIEW your files)

    - Select REGISTRATION->REGISTRATION. You will be asked to insert a
      diskette in drive A:. Please have ready a blank formatted 1.44 MB or
      1.2 MB diskette. This diskette will become your license diskette
      later. Be aware that any data on this diskette might be damaged
      during this procedure.
      If you encounter any problems please try it again using a fresh
      formatted and error free diskette.
      Finally you will be shown a 16- or 17-letter code.

    - Submit this code to the TIRAMISU registration service (preferably
      by fax, use the form you can find in REGISTER.TXT):

      Tel. 49-30-292 00 99       (Germany)
      Fax  49-30-292 60 63
      Email 101457.1447@compuserve.com
      http://ourworld.compuserve.com/homepages/data_recovery
      http://www.snafu.de/user-cgi-bin/recovery

      Address:          Plug 'n Play
                        Uwe Gissemann
                        Scharnweberstr. 43
                        D-10247 Berlin
                        Germany

    - Specify the kind of license you want to purchase (7 days license or
      unlimited license). Send the money or credit card information (VISA,
      MASTERCARD or DINERS).

    - The registration key will be forwarded to you immediately by fax
      or email.

    - After receiving the registration key from us, please insert the
      prepared diskette. Start TIRAMISU FOR NTFS. Select
      REGISTRATION->REGISTRATION. Enter the received key in the
      registration screen.

    - Ready! Now you can use COPY to save your data.

IMPORTANT: Label the diskette as your license diskette. You will need it
anytime you run TIRAMISU FOR NTFS. The license diskette can not be
duplicated. This is a copy protection.

The limited license allows you to recover data only from one
computer. It is not valid for other systems. (This restriction does not
apply for the unlimited license.)


DISCLAIMER


PLUG'N PLAY DOES NOT WARRANT THAT THE SOFTWARE IS ERROR FREE.

PLUG'N PLAY DISCLAIMS ALL WARRANTIES WITH RESPECT TO THE SOFTWARE,
EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF THIRD PARTY RIGHTS.

NO LIABILITY FOR CONSEQUENTIAL DAMAGES.  IN NO EVENT SHALL
PLUG'N PLAY BE LIABLE FOR CONSEQUENTIAL, INCIDENTAL
OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE DELIVERY,
PERFORMANCE OR USE OF THE SOFTWARE, EVEN IF PLUG'N PLAY HAS BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL
PLUG'N PLAY'S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT OR
ANY OTHER THEORY OF LIABILITY, EXCEED THE LICENSE FEE PAID BY
THE BUYER.

