                    DRT - CIHFix32 Special Edition
 
                            Version 2.0b

           Copyright (c) 1998-1999 by VDS Advanced Research Group

                        http://www.vdsarg.com
                         
                         All Rights Reserved
                           
                   Revision Date:  April 29, 1999
   
                      
                              WARNING

THIS SOFTWARE AND MANUAL ARE BOTH PROTECTED BY U.S. COPYRIGHT LAW 
(TITLE 17 UNITED STATES CODE). UNAUTHORIZED REPRODUCTION AND/OR SALES 
MAY RESULT IN IMPRISONMENT OF UP TO ONE YEAR AND FINES OF UP TO $10,000 
(17 USC 506). COPYRIGHT INFRINGERS MAY ALSO BE SUBJECT TO  CIVIL LIABILITY.

                             Disclaimer

The developers and distributors of DRT make no warranty of any kind, either 
express or implied, with respect to this software and accompanying 
documentation. In no event shall the developers be liable for any damages 
arising out of the use of or inability to use the included programs. The 
entire  risk as to the results and performance of this software package is 
assumed by the customer. We specifically disclaim any implied warranties of 
merchantability or fitness for any purpose. Use at your own risk.

The developers and distributors of DRT reserve the right to revise the 
software and accompanying documentation and to make changes in the contents 
without obligation to notify any person of such revision or changes.

   

   What is DRT?

DRT (Data Recovery Tool) is a sophisticated program to recover data
from damaged hard disks. We use it internally to perform data recovery.

   What is DRT - CIHFix32 Special Edition?

This is a limited version that can recover data only from CIH-type of damage
to the start of a drive that had a FAT32 partition of at least 976 MB.

   Can it recover data if I had a FAT16 partition?
   
No. FAT16 partitions will lose both their FATs and the ROOT directory as
well as parts of the data area. If you had important data on a FAT16
partition, we recommend that you send your drive to an expert recovery
service.

   What is CIH and who unleashed it?
   
This is a relatively new computer virus released by a Taiwanese jackass
in the summer of 1998. There are at least three different variants.
Its damage routine is to corrupt the flash ROM BIOS and overwrite the first
1 megabyte of hard drives. The flash routine works only on some systems. In
such cases, the computer will not boot up. It is possible to restore the
flash chip contents by reprogramming it; however, that usually means shipping
either the motherboard or the BIOS chip to the manufacturer. 
According to some news, the punk who wrote and released CIH is a student and
CIH are his initials. He was supposedly questioned by the police and then 
released because no charges were pressed by any of the local people.
We believe that people responsible for such world-wide damage should be held
responsible for crimes against computing and tried in an international court
of law, much like war criminals and their ilk. If you are affected by this
virus, we encourage you to write to the Taiwanese embassy in your country
and express your outrage and disappointment with one of their citizens. 
   
   Can I use DRT on drives larger than 8gig?

Yes, you can. The largest drive we tested it on was 22 gig.

   Does it work on SCSI drives?

Yes, it works on all hard drives that can be accessed via the INT 13h API.

   How much does it cost?

The special edition is free of charge for personal use.

   Can I use it to recover from other damage?

It is possible. As long as the damage is limited to the beginning of
the drive before the second copy of the FAT, it should work.

   What is the best way to use it?

You should get another hard drive of similar or larger capacity than
the one you wish to recover data from. Use Copy HD to HD command to
clone the hard drive to the test drive. Remove the victim drive, and
work on the test drive. If the recovery works on the test drive, you
got your data back. You can then do the same on the victim drive too.
Boot and run SCANDISK after recovery to make sure the file system is OK.

   Does it recover extended partitions?

Yes, it does. After the primary partition is established, DRT will search
for extended partitions. If one is located, it will make the appropriate
entry in the MBR.
 
   Why does DRT show block numbers instead of just cylinder,head,sector?
   
Because DRT uses LBA addressing internally and will either translate that
to CHS mode or use extended INT 13h APIs. This is also the reason why it
can work on drives as large as 127gig.

   What does zero HD command do?
   
It allows technicians to erase the contents of returned hard drives. You
can do the same before you sell your hard drive.

   What does copy HD to HD command do?
   
This command allows you to clone a hard drive onto another one sector by
sector. If the drives are identical, you can essentially make an exact
image of your drive. We use it to prepare for data recovery. When we receive
a drive, we try to clone it onto a similar or larger drive, and then work
on that copy.

   What if DRT does not work?
   
It will tell you so before making any changes. In fact, DRT tries very hard 
to make sure the data it has gathered is enough for a successful recovery. 
If it fails and you are certain that you had a FAT32 partition of 976 megs
or larger, then please let us know. You can email us at drtcih@vdsarg.com

   Why doesn't DRT work in Windows?
   
Because DRT accesses the disks at a low-level, it is much safer to use it in
plain DOS mode. Ideally, you should boot off of a diskette first. DRT 
requires very little memory, about 200K free memory will suffice.


