Introduction

Runtime's DiskExplorer for NTFS © 2001-2012 by Runtime Software LLC

75-5744 Alii Dr., Suite 256, Kailua Kona, HI 96740, USA
Phone (USA): 1-808-329-2202, Fax: 1-818-475-1741
Phone (Germany): +49-30-2180 1016
Email: info@runtime.org , Web: http://www.runtime.org

Runtime's DiskExplorer for NTFS is a powerful disk editor, which enables you to

  • navigate through your drive by using browser-style back and forth arrows,
  • go directly to the partition table, boot record, MFT or root directory (links),
  • open physical drives and logical drives,
  • create or open image files,
  • open RAID arrays as virtual images
  • access remote drives over serial cable or TCP/IP,
  • clone the entire drive into a compressed image
  • switch between several views, such as hex, text, index allocation, file entry, file entry details, partition table and boot record view,
  • search your drive for text, boot records, partition tables and sub directories,
  • investigate the volume' s boot record by looking at the volume information,
  • edit your drive by using the direct read/write mode or the virtual write mode,
  • view and recover files and whole directories,
  • create a virtual volume when you boot record is lost or corrupted,
  • find the file which is associated with a certain cluster,
  • conduct your own data recovery by taking advantage of all these features (see our examples).

Runtime's DiskExplorer for NTFS was tested with NT4 SP3, W2K, XP. It supports compression. It does not decrypt encrypted files.

Credits:
NTFS Documentation by Regis Duchesne, http://www.via.ecp.fr/~regis
Inside the Windows NT File System by Helen Custer, Microsoft Press 1994


Main Screen

DiskExplorer's main screen is structured as follows:

On top is the main menu and the navigation and link bar.

Next the current data area is displayed in the view that you choose.

Underneath the data area the cursor position is shown as sector:offset in hexadecimal and decimal format on the left side.
On the right side the current selection is displayed as sector:offset to sector:offset in hexadecimal format.

Drive specifies the loaded drive, floppy or file with its total number of sectors in decimal and hexadecimal format.

Beneath drive on the right side the accessible data window is shown in decimal format.

Path shows what area of the drive you are currently in and also the steps you can go back or forth by clicking the arrows on the navigation bar.

Region lets you switch between boot sector, partition table, MFT, MFT No. and cluster region: simply right-click while the mouse is over the text right of "Region".

Volume gives information such as the position of cluster 0, the cluster size, the type of the drive. To obtain more information on the volume, just click the underlined information line.

Memory features the memory currently in use.

View lets you see which view you are in. You can choose a different view by double-clicking the view icon.
Available views are:
Hex view, Text view, Boot record view, Partition table view, Index allocation view , File entry view and File entry detail view.

R/O , V/M or R/W displays whether you are in read only mode (R/O), virtual write mode (V/M) or in direct read/write mode (R/W). You can change the mode by double-clicking the icon.

See also: Introduction, Menu


NT file system

The main characteristics of the NT file system are described by the boot record. The file system starts at the location of the boot sector and ends at this sector plus the sectors in the volume field. The volume is organized in clusters of multiples of 512 bytes. The start of the volume is associated with cluster number 0.

Any addressing within the file system is done using the cluster number instead of a sector number. Any kind of file information is contained in a structure called Master file table (MFT). The start of the MFT is indicated by the boot sector's field 1st MFT cluster. The MFT is a database containing information about every file or directory on the volume. The default size of an entry in the MFT is 1024 bytes. Each entry describes a file or directory on the volume (including the MFT itself) and has a record number that equals the byte position inside the MFT divided by 1024. Each MFT entry consists of a header and a list of attributes. The attributes describe file names, time stamps, file sizes, data allocations and more. In the file entry details view you can inspect any attribute of any MFT entry. Most important attributes are:

  • $10 Standard information: contains time stamps and DOS attributes,
  • $30 File name: contains the file's name for different name spaces (usually NT's native Unicode file name and DOS compatible DOS file name),
  • $80 Data: if the entry represents a file, this attribute contains the file's data.
  • $90 Index root: if the entry is a directory, this attribute describes the root of a binary tree in which the directory entries are located,
  • $A0 Index allocation: if the entry is a directory, this attribute contains a list of file names.

If the attributes are too large to fit into 1024 bytes, some of them will be non-resident, meaning the value part the specific attribute will be found outside of the entry. In this case the outside data allocation will be described by a run list. A run list is a list of clusters used. When in the file entry details view you can inspect a non-resident attribute's data by following a link.


Menu structure

File |  |
 | Drive | open a drive
 | Image | open an image file drive
 | Print | print data structures
 | Exit | quit this program
Goto |  |
 | Start | go to 1st sector
 | End | go to last sector
 | Sector | go to a certain sector
 | Partition table | go to the partition table
 | Boot record | go to the Boot record
 | Root directory | go to the root directory
 | Mft | go to the Master file table (MFT)
 | Mft no | go to a certain file entry
 | Cluster | go to a certain cluster
Link |  |
 | Back | visit the last sector in the history list
 | Forward | visit the next sector in the history list
 | Follow link | follow the link
 | Remember | include this sector in the history list
Edit |  |
 | Edit current sector | switch into edit mode
 | Write changes | write the changes made to this sector
 | Discard changes | write the changes made to this sector
 | Reload | reload current sector, clear all caches
 | Copy | copy current selection to clipboard
 | Copy to file... | copy current selection to an image file
 | Paste | paste from clipboard to current cursor position
 | Paste from file... | paste from an image file to current cursor position
 | Fill... | fill current selection with a certain value
 | Select... | select an area on the drive
 | Select all | select the entire drive
View |  |
 | as Hex | view current sector as hexadecimal
 | as Text | view current sector as text
 | as Index allocation | view current sector as a Index allocation buffer
 | as File entry | view current sector as a file entry
 | as File entry details | view current sector as file entry details
 | as Partition table | view current sector as partition table
 | as Boot record | view current sector as a Boot record
Tools |  |
 | Search | search for text, partitions, boot records, Fats or directories
 | Continue search | continue a previous search
 | File current file | find the file that owns the current sector
 | Volume information | show structure of the currently mounted volume
 | Create virtual volume | create a virtual volume
 | Recover file | recover a file
 | View file | recover and view a file
 | Create image file | clone your drive to a file
 | Options | modify drive access, cache, recovery options and NTFS settings
Help |  |
 | Register | enter a license key to unleash the full power of this software
 | Content | call the integrated help (this)
 | About | displays copyright, license and version information
 | Version info | displays more version information


Registration

Registering the DiskExplorer will enable you to copy and save files and will terminate the registration reminder. Registration is required when you use the software beyond the 30 days trial period.

Register online on our website http://www.runtime.org and get the registration key immediately.

If you prefer not to order online give us a call at 1-808-329-2202 (USA) or +49-30-2180 1016 (Germany).

Entering the License Key

When entering the license make sure you enter both, the name and the license key, exactly as spelled in the registration email Runtime sent to you. Name and key are related and only entering both will successfully register DiskExplorer. We recommend to copy and paste the information from the registration email.


Version Info

This windows displays version numbers and dates of the following program components:

  • Product name is this software's name.
  • Version is the current version number.
  • Program name is the name of the EXE file.
  • Program file date is the date of the EXE file.
  • DRV16 location is the directory where DRV16 is located. This file is the driver for accessing the hard drives and is required for Windows 95/98/ME.
  • DRV16 version is the hard drive driver's version number.
  • DRV16 date is the hard drive driver's date.
  • Help file is the name of this help file.
  • Installation dir is the directory this software is installed.
  • INI file is the name of this software's INI file.


License Agreement

License Agreement and Disclaimer

The following are the conditions under which Runtime Software software is sold, supported and may be used. By using or registering Runtime Software software, you are agreeing to these.
This document may be augmented or superceded by conditions included with specific applications.

Neither the author(s) nor Runtime Software assume responsibility for any expense, damage or loss caused by your use of this software, however it occurs.
All the registered trademarks used herein are registered to whoever it is that owns them. This notification is given in lieu of any specific list of trademarks and their owners.

If you register software by Runtime Software, we will assume that you are doing so having tested the shareware version and ascertained that it's suitable for your hardware and requirements. We cannot provide refunds for shareware registration if you subsequently change your mind.

No portion of the documentation for this software or any of its attendant files may be reproduced in whole or in part in any medium or form of transmission exclusive of the archive file for the software without the express written permission of Runtime Software. You may not modify or patch the software's executable files in any way, including but not limited to decompiling, disassembling, or otherwise reverse engineering the program.

Registering this software buys you a named single-user license to use it in perpetuity, subject to the terms discussed herein. With a named single-user license you are the only user of the license, installed on one computer owned or controlled by you. If you want to have the software installed on more than one computer at the same time, you need to purchase additional licenses. If you want the software to be used by additional users, you need to purchase additional licenses. A single-user license does not permit you to make the registered software available over a network for multiple users to access, to distribute it in any form or to provide it in conjunction with any other product without the express written permission of Runtime Software. The license is not transferable to another party without written permission of Runtime Software. If you have any questions about the software license, feel free to get in touch with us.

A "Technician's License" has the same rights and restrictions as the above "named single-user license", but allows you to perform data recovery services on computers not owned or controlled by you.

If you have downloaded this software or had it given to you on disk to try out, you are allowed to use the limited version of the software for free, in order to use the full version you have to register the software immediately.

You may distribute the software (on CD-ROMs, Books, Catalogs, Internet etc.) as long as you follow each and every one of the following:

1. You distribute only exact, unmodified copies of the original unregistered shareware version of the software incl. the DISCLAIMER.
2. You do not monetarily charge or otherwise request any compensation for any copy, however made, without prior permission from Runtime Software.
3. You include the phrase "Copyright by Runtime Software" with any copy of the software.


Glossary

Attributes

Attributes are usually referring to the DOS attributes Archive, Read/Only, Directory, Hidden, System, Volume.
In NTFS attributes are structures entirely describing a file (see: NT Attributes).

Boot record

A Boot record is a special sector describing the file system following this sector.

Cache

A cache is an area in RAM that holds a copy of disk data. This speeds up accessing this data.

Cloning a drive

Making an exact sector-by-sector image of a drive. This is recommended when you want to perform a data recovery or a forensic investigation of a drive or when the drive has physical damage (bad sectors). With the image you can work as you could work with the original drive.

Cluster

A cluster is the smallest unit addressable by the file system. A cluster is always a multiple of a sector. Typical cluster sizes are 1, 2, 4, 8, 16, 32, 64, 128 sectors.

Data recovery

The process of retrieving files from a drive that cannot be accessed from its operating system anymore.

Default link

The DiskExplorer uses this term for the most obvious link when navigating through a drive.

Deleted file

A file is deleted in a FAT file system by overwriting the 1st character of its directory entry with xE5 and by releasing the FAT entries of the clusters it used. In NTFS a file is deleted by removing its reference in the MFT.

Direct Read/Write mode

DiskExplorer uses this term to indicate that all changes are directly written to the drive. (See: Read/Write Modes)

Directory

In NTFS a directory is a list of Index Entries.

FAT file system

Name of a file system using a "file allocation table". Introduced with DOS and used in all Windows versions.

File Entry (MFT entry)

A file entry in NTFS is an entry in the MFT.

File system

The file system (such as FAT or NTFS) is the scheme how a file is store on a disk. Do not confuse it with the operating system (such as Windows95 or WindowsNT).

Hexadecimal

The hexadecimal system is based on the number 16, other than the decimal system which is based on 10. The supplemental digits are A, B, C, D, E and F. Example: hex AA = dec 170. (10*16 + 10*1).

History List

DiskExplorer uses this concept to provide browser-style back and forward capabilities (see Navigation).

Index Allocation

An index allocation is the outside value of the non-resident $A0 attribute, which contains a list of file names establishing a directory.

Image File

An image file is a sector-by-sector copy of a drive. It can be used as a source for DiskExplorer

LFN

NTFS uses attributes to store the LFN (long file name).

Link

The DiskExplorer uses the term link for the jump targets you can navigate to from the current position.

Logical Drive

Logical drives are drive like A:, B:, C:, ... They are accessed using the according operation system routines.

Media Descriptor

Flag byte in the boot record describing the kind of drive. Usually xF8 for hard drives.

MFT (Master File Table)

The MFT is a database containing information about every file or directory on a NTFS volume. An entry is called MFT entry or file entry.

MFT Number

The MFT number is the position of a file entry within the MFT.

Navigation

DiskExplorer's concept of navigating through a drive.

Non-resident Attribute

see: NT Attributes

NTFS

NTFS is a file system introduced with WindowsNT, used by Windows NT, Windows 2000 and Windows XP.

NT Attributes

The NT Attributes describe every aspect of a file in NTFS, such as file names, time stamps, file sizes, data allocations and more:

Number | Name | Description
$10 | Standard information | contains time stamps and DOS attributes
$30 | File name | contains the file's name for different name spaces (usually NT's native Unicode file name and DOS compatible DOS file name)
$80 | Data | if the entry represents a file, this attribute contains the file's data
$90 | Index root | if the entry is a directory, this attribute describes the root of a binary tree in which the directory entries are located
$A0 | Index allocation | if the entry is a directory, this attribute contains a list of file names

NT Attributes can be resident or non-resident. Resident attributes are stored within the MFT entry. Non-resident attributes are store outside using run lists.

Offset

Offset describes the position within a sector, 0..511.

Partition Entry

A partition entry describes type, location and size of a partition.

Partition Table

The partition table is a list of partition entries located in sector 0 of a drive. If a drive contains "extended partitions", there is a linked list of several partition tables on the drive.

Physical Drive

Physical drives are tangible media like hard drives and diskettes. They are accessed through low-level BIOS functions.

Read/Only mode

DiskExplorer uses this term to indicate that the drive is write-protected. (See: Read/Write Modes)

Resident Attribute

see: NT Attributes

Root Directory

A file system's root directory constitutes the root of the directory tree.
In NTFS the root directory is described by the index buffer of MFT entry #5.

Run List

A run list is a list of clusters used for an NT Attribute. If the attributes are too large to fit into the MFT entry, some of them will be non-resident, meaning the value part the specific attribute will be found outside of the entry. In this case the outside data allocation will be described by a run list.

Sector

A Sector is the smallest unit that can be accessed on a drive. The size of a sector is always 512 bytes. Multiple sectors are grouped to "clusters".

Sectors Per Cluster

This term describes the cluster size the file system is using. It is essential for translating a cluster number into a physical sector number.

Virtual Write Mode

DiskExplorer uses this term to indicate that the drive is using a 10000 sector cache for changes. (See: Read/Write Modes)

Virtual Volume

DiskExplorer uses this term to indicate a volume with its structure stored in memory.


Drives

Runtime’s DiskExplorer accepts five different kinds of data sources to select from:

Physical drives

Logical drives

Image files

Remote drives

Virtual images

See also: Select drive


Physical drives

Physical drives are tangible media like hard drives and diskettes. They have specific names:

FD0 | 1st diskette drive
FD1 | 2nd diskette drive
HD128 | 1st hard drive
HD129 | 2nd hard drive

These drives can have partitions you may select. If you do so you can only browse the part of the drive ("window") that constitutes the partition. This might be helpful if you want to explore a certain partition only. If you want to explore the whole physical drive always select the entry with the [image] Symbol.

See also: Drives


Logical drives

* Logical drives are volumes known to the operation system as A:, B:, C: etc..

You may choose this in order to explore such a volume. An alternative access to these drives is selecting a partition in a physical drive.

See also: Drives


Image Files

*
Image files are files containing raw images of a drive. You can explore an image file as you can explore a physical or logical drive. Select File->Image or Drive->Image file to open an image file as a drive.

Even partitions you can see within physical drives are displayed when contained in the image file.

Clone an entire drive

You can create image files using the Edit->Copy to file command. You can actually clone a whole drive into an image file by

1. issuing the command Edit->Select all
2. issuing the command Edit->Copy to file

or

issuing the command Tools->Create image file

You may use the image file instead of the original drive. This is very helpful if you want to make changes to the data.

Multiple Files

Image files can consist of:

  • one file (e.g. 'drive128.img')

  • multiple files (e.g. 'drive128.img', 'drive128.001', 'drive128.002', ...)

This is helpful when imaging a drive larger than the maximum file size (2GB or 4GB, depending on the operating system). Fragments of a multiple file image are about 656MB in size. A smaller size indicated the end of the file set.

Compression

You can create compressed image files (e.g. 'drive128.imc') by selecting 'Compressed image data files (*.imc)' as file type in the file open dialog. This feature enables you to create drive images much smaller than the original.

Compressed files can be multiple file images too.

See also: Drives


File open and file create

This dialog requires a file name to open or create.

You can choose between the following File types:

  • Image files (IMG) are raw copies of drives.
  • Compressed image files (IMC) are compressed raw copies of drives.
  • Virtual images (VIM) (read/only) are scripts describing an arrangement of several other kinds of drives.

Image files and compressed image files come in two flavors:

  • Multiple file unchecked stores the data in one single file.
  • Multiple file checked stores the data in multiple files with 656MB each. This makes the image more handsome and helps to overcome restrictions on file sizes.

See also: Drives


Virtual images

Virtual Image

*

Virtual Images are short text files describing the data to be loaded. Thus, you can "glue" together different data sources. This is especially helpful if you want to recover RAID arrays. For example, Runtime's RAID Reconstructor creates virtual images that you can use here.

Virtual images always use the extension "vim".

You can also create your own virtual images. Virtual images are XML files with just a couple of commands ("tags"). You can put together any number of drives, as long as the total capacity does not exceed 2 TB.

<virtualimage>

This is the root tag that encloses all other tags.

Example:

<virtualimage>
:
:(other tags)
:
</virtualimage>

<sector>

This tag sets the sector number of the virtual image to a new value. Any gaps you create by that will be filled with 0's.

Example:

<virtualimage>
:
  <sector>1000</sector>
:
</virtualimage>

<drive>

This tag describes a drive that is being used. You can also specify a certain area inside that drive.

Example:

<virtualimage>
  <drive>HD128:</drive>
</virtualimage>

This example of a virtual image uses your first hard drive (HD128:). Make sure you always append a colon to the drive's name.

Another example:

<virtualimage>
  <drive>HD128:0-999</drive>
  <drive>c:\images\myimage.img:1000-</drive>
</virtualimage>

This example maps the first 1000 sectors of HD128 to your virtual image. Sector 1000 and up of your virtual image will come from sector 1000 and up of the image file "c:\images\myimage.img". The ranges are specified by appending two numbers, separated by a dash. If you leave out the second number, the range will extend to the end of the respective drive.

Possible drives names are:

HD128:, HD129:, etc | 1st, 2nd physical drive etc.
FD0:, FD1: | 1st, 2nd floppy drive
C:, D:, etc. | Logical volume C:, D:, etc.
myfile.img, myfile.imc | Image files
NULL: | Virtual drive, delivers empty sectors. Must be followed by a range.

<loop>

Use the <loop> tag to define RAID arrays.

Example definition of a 3 drive RAID-5 with a block size of 128, backward rotation:

<virtualimage>
  <loop>
    <drive>c:\img\raid5\r1.img:</drive>
    <drive>c:\img\raid5\r2.img:</drive>
    <drive>c:\img\raid5\r3.img:</drive>
    <cycle blocksize="128">
      <stripe>1,2</stripe>
      <stripe>1,3</stripe>
      <stripe>2,3</stripe>
    </cycle>
  </loop>
</virtualimage>

After the introducing <loop> tag, specify the drives you will use in the RAID. On the syntax of the <drive> tag see the specification above.

In the <cycle> tag, define the stripes making up the RAID. Each stripe is a sequence of data taken from the previous defined drives. Define the block size as an attribute for the <cycle> tag. You would read the example above as:

  1. Take 128 sectors from the 1st drive (sectors 0-127).

  2. Take 128 sectors from the 2nd drive (sectors 0-127).

  3. Take 128 sectors from the 1st drive (sectors 128-255).

  4. Take 128 sectors from the 3rd drive (sectors 128-255).

  5. Take 128 sectors from the 2nd drive (sectors 256-383).

  6. Take 128 sectors from the 3rd drive (sectors 256-383).

This continues until the end of one drive has be reached. The smallest drive determines the size of the loop. If the smallest drive is 10000 sectors, the total size is 20000 rounded up to a full cycle, which is 20736. You can change the size of the loop in two ways:

1) Specify the number of times the loop should be repeated. You can do this by adding an attribute with the name "repeat" to the <loop> tag, e.g.: <loop repeat="27">. In the RAID example, repeating the cycle 27 times will yield 6*128*27 sectors, which is 20736.

2) Specify a range. Do this by adding the attribute "range" to the <loop> tag, e.g.: <loop range="10-20".

The "repeat" takes precedence over the implicit size as determined by the drives. The "range" takes precedence over the "repeat".

You can even define incomplete RAID-5 arrays. If, in the example above, the 3rd drive would be missing, you could describe the array like that:

<virtualimage>
  <loop>
    <drive>c:\img\raid5\r1.img:</drive>
    <drive>c:\img\raid5\r2.img:</drive>
    <cycle blocksize="128">
      <stripe>1,2</stripe>
      <stripe>1,1x2</stripe>
      <stripe>2,1x2</stripe>
    </cycle>
  </loop>
</virtualimage>

The expression 1x2 will calculate the missing sector, originally on the 3rd drive.

See also: Drives


Remote Drive Access

Remote Drives

This feature enables you to run the DiskExplorer on one computer ("remote") while accessing the drives of another computer ("host").

The "remote" computer runs DiskExplorer, the "host" computer runs HDHost. HDHost is a program available for download at http://www.runtime.org.

On the host side call the program HDHOST.EXE and configure the desired connection. When done click Wait for connection.

On the DiskExplorer side select File->Drive and click Remote on the bottom. A new window will pop up requesting you to select and configure the kind of connection. When done click Connect and another window will pop up displaying the available physical drives on the host computer. Select one and you are back in the drive selection screen. Click Ok and the remote drive is loaded.

You can establish a two different kinds of connections:

  • Serial communication through RS232 (Com port)
  • TCP/IP communication through a network interface card (NIC)

Serial communication is quite slow, therefore you will probably prefer TCP/IP. However, serial communication is easier to setup and every computer is equipped with a serial port.

Serial Communication

Serial communication requires a Null-Modem Cable connecting both computers through the COM port. On both sides select the port number this cable is connected to. Both sides must use the same Baud rate.

TCP/IP Communication

TCP/IP communication in a LAN requires a network interface card (NIC).

As the Connection choose the IP that is associated with your NIC. If this computer does not get an IP address assigned by a DHCP server you might need to assign a static IP address in the Windows network configuration. A typical address is 192.168.1.51 for this machine and 192.168.1.50 for the host.

As the IP of host choose the IP of the host's connection. You might need to specify a static IP address (e.g. 192.168.1.50) in the Windows network configuration of the host computer.

Tips:

  • If you have problems connecting try to PING between host and remote. Go to the command prompt and type ping 192.168.1.50 on this computer. Try ping 192.168.1.51 on the host computer. (This assumes that 192.168.1.50 is the host's IP and 192.168.1.51 this computer's IP). The ping must be successful on both sides.
  • Disable all Firewalls.

See also: Drives


Views

View

You can change between several different views when exploring your drive.

Change between the view

  • as Hex
  • as Text
  • as Index allocation
  • as File entry
  • as File entry details
  • as Partition table
  • as Boot record

by clicking View in the Main Menu or by pressing the corresponding hot keys.

When you are in Partition Table view and the current data area is not a valid partition table, the area will be marked 'Invalid' on the screen. The same applies to the Boot Record view.


Hex

Hexadecimal View

The Hex View is structured as follows:

  • Sector indicates at which sector on the actual drive you currently are.
  • Offset indicates at which offset in the actual sector you currently are.
  • Hex Values shows the entries on the current area of the drive in hexadecimal format.
  • ASCII Values shows the entries on the current area of the drive in ASCII format.

See also: View


Text

Text View

The Text View is structured as follows:

  • Sector indicates at which sector on the actual drive you currently are.
  • Offset indicates at which offset in the actual sector you currently are.
  • Text displays the current data area in Ascii format.

See also: View


Directory

Index Allocation View

An index allocation is the outside value of the non-resident $A0 attribute, which contains a list of file names establishing a directory.

The index allocation view is structured as follows:

  • Name is the name of the file.
    Note: A lot of file names are displayed twice, this is due to the fact that a Unicode and a DOS file name are created when the file name is longer than 8 digits.
  • Mft# is the number of the file or folder in the master file table (displayed in brackets is the sequence number of the file or folder).
  • Size gives the size of the file in bytes.
  • Date and Time states the date and time of the last modification of the file or directory.
  • Attr represents the attributes of the entry (a = archive flag, r = read only, h = hidden, s = system, l = volume name, d = directory, c = compressed).
  • Subs represents the first cluster of the index buffer holding the file entries of the files preceding this file entry.

This view features hotlinks for navigation.

Clicking on the Mft# of a file brings you directly to the file entry details, clicking on the Mft# of a directory entry will bring you to the directory entries of the sub directories and files it contains. To see the MFT entry details for a directory click the Mft# and then check the little "Details" box in the right bottom corner.

To save a directory of file click the "Save" label beneath it, to view a file click "View".

See also: NT File System, View


File entry view

A file entry (or MFT entry) is a record in the MFT (Master File Table). Each file in NTFS is entirely described by a such an entry.

The file entry view is structured as follows:

  • Sector displays the first sector of the file or folder,
  • Name shows the name of the file or folder (the system files can be recognized by the $ in the file name, the root directory's file name is always "."),
  • Type states whether the entry is a file or a directory,
  • Attributes lists the DOS attributes of the file (a = archive flag, r = read only, h = hidden, s = system, l = volume name, d = directory, c = compressed), don't confuse these with the NT attributes,
  • Size gives the size of the file in bytes,
  • Date is the modification date of the file or folder,
  • 1st cluster displays the first cluster of the file, if it is allocated outside the MFT entry,
  • NT Attributes lists the available NT attributes for the file or folder.

In the second row the following information is given for each file or folder entry:

  • No represents the MFT number of the file or folder in hexadecimal and in brackets the sequence number,
  • Parent directory shows the MFT number of the parent directory of the file or folder, in brackets the sequence number,
  • Run displays the run list of the non-resident attributes of the file or folder, or it says "resident' if the attributes are resident.

Double-click a file entry to enter the file entry details.

See also: NT File System, View


File Entry Details View

The file entry details view displays an MFT entry. Any file or directory is described by at least one MFT entry. MFT entries are located in a system file called $MFT. This file can be understood as a data base containing every single file or directory. The default size of an MFT entry is 1024 bytes. MFT entries are addressed by an MFT number. For example: retrieving the 100th entry you have to multiply 100 by the record size of 1024 in order to get the offset of the entry within the MFT. The first 16 MFT entries are reserved, most important is entry number 0, which describes the MFT itself and entry number 5, which describes the root directory (.).

The file entry details view is structured as follows:

In the line underneath the main menu the parent directory of the displayed folders and files is shown with its MFT#, name, attributes, modify date and time, starting cluster of its data area and parent directory's MFT entry #.

On the left side of the screen you see the structure of the MFT entry in a tree with its header, available attributes with the respective header and body.

Clicking on one of these entries will show its interpretation of data in the upper right side and the raw data in hexadecimal on the bottom right side of the screen.

In case the data of an attribute isn't stored resident, the run list is displayed in the "interpretation of data" window. Click on the cluster number(s) to go to the attribute's data.

If the current entry describes a directory, the data interpretation window is enlarged and the following information is given:

  • Name is the name of the file.
    Note: A lot of file names are displayed twice, this is due to the fact that a Unicode and a DOS file name are created when the file name is longer than 8 digits.
  • MFT# is the number of the file or folder in the master file table (displayed in brackets is the sequence number of the file or folder).
  • Size gives the size of the file in bytes.
  • Date and Time states the date and time of the last modification of the file or directory.
  • Attr represents the attributes of the entry (a = archive flag, r = read only, h = hidden, s = system, l = volume name, d = directory, c = compressed).
  • Subs represents the first cluster of the index buffer holding the file entries of the files preceding this file entry.

This view features hotlinks for navigation.

Clicking on the MFT# of a file brings you directly to the file entry details, clicking on the MFT# of a directory entry will bring you to the directory entries of the sub directories and files it contains. To see the MFT entry details for a directory click the MFT# and then check the little "Details" box in the right bottom corner.

To save a directory or file click the "Save" label beneath it, to view a file click "View".

You can view the other windows by checking the "Details" box.

See also: NT File System, View


Partition Table

Partition Table View

The partition table view is arranged as follows:

  • Sector indicates at which sector on the actual drive you currently are.
  • Valid or invalid partition table tells you whether the current data area is indeed a partition table.
  • The partition table has room for four entries (from Partition 1 to Partition 4). Entry No states the number of the partition.
  • System displays the file system type (e.g. FAT 16/32, NTFS) of the partitions on your drive.
    Note: Sometimes System shows an entry (e.g. Linux) in an invalid partition table. This happens when the entry in the present sector by chance is the same as the one for an identifier for a file system. You can have a look at these identifiers when you are in virtual write or read/write mode and click on the System entry in the partition table view.
  • Boot states whether the partition is bootable or not.
  • Starting and Ending mark the beginning resp. the ending of the partition, defined through the number of cylinders x heads x sectors.
  • Relative Start Sector shows the beginning of the partition in LBA mode.
  • Total Sectors displays the total number of sectors in the partition.
    Note: If the partition is bigger than 8GB the multiplication of cylinder x head x sector doesn't result in the correct number of total sectors, due to the binary length of the values. Total Sectors nevertheless will show the correct number of sectors.

The entries in the partition table view are displayed in hexadecimal format in the first row, and in decimal format in the second row.

When you are in Partition Table view and the current data area in not a valid partition table, the area will be marked 'Invalid' on the screen.

Double-clicking on a valid partition entry will move you to the sector this partition begins. See Navigation.

See also: View


Boot Record

Boot Record View

The boot record is located in the first sector of the file system. You can find a mirror boot sector at the end of the file system.

The Boot Record View is arranged as follows:

  • Sector indicates at which sector on the actual drive you currently are.
  • Valid or invalid boot sector tells you whether the current data area is indeed a boot record.
  • NTFS signature shows which operating system formatted the drive.
  • Bytes per sector displays the number of bytes per sector (usually 512).
  • Sectors per cluster displays the number of sectors per cluster (usually 1-8, possible numbers -128, compression works only -8).
  • Media descriptor describes the kind of drive (F8 - Hard Drive).
  • Sectors/FAT is an unknown entry in the boot record.
  • Sectors per track represents the value of max. head x sector used when the volume was created.
  • Heads gives the head value used when the volume was created.
  • Hidden sectors is the number of sectors preceding the first sector of the volume.
  • Physical drive displays the number of the drive (1st HD = 128, 2nd HD = 129, 1st Floppy drive =0).
  • Sectors in volume gives the total number of sectors in the volume.
  • 1st MFT cluster is the cluster number of the start of the Master File Table.
  • 1st MFT mirror cluster is the cluster number of the start of the mirrored MFT.
  • Clusters/file record indicates the size of the MFT record (F6 means the MFT record size is 1024 bytes, any other number means the MFT record size in bytes is this number x cluster size).
  • Clusters/Index block indicates the index block size (F4 means the index block size is 4096 bytes, any other number means the index block size in bytes is this number x cluster size).
  • Serial number is the serial number of the volume.

The entries in the boot record view are displayed in hexadecimal format in the first column, and in decimal format in the second column.

When you are in Boot Record view and the current data area in not a valid boot record, the area will be marked 'Invalid' on the screen.

See also: View


Print

Clicking File->Print lets you print a certain data area of your drive. Specify the view and the sector numbers and press Print.


Navigation

There are several different ways to navigate through your drive.

  • Scroll bar: Use the vertical scroll bar to scroll through your drive. A small window attached to the cursor will show you at which sector you currently are.
  • Mouse scrolling: With the left mouse button click on a data area in the main window, and scroll up or down by moving the cursor out of the data area. The scrolling speed will increase the further you move the mouse up or down.
  • Jumping: In order to jump to the next or previous page or to the beginning or end of your drive, use the arrows in the top tool bar or click Goto->Start or Goto->End in the main menu.
  • Goto sector: If you need to find a certain sector or byte on your drive, click Goto->Sector in the main menu. There you have the option to specify either the sector or the byte in hexadecimal or decimal format. Press OK and the cursor will jump to the selected sector.
  • Goto cluster: If you need to find a certain cluster on your drive, click Goto->Cluster in the main menu. There you have the option to specify the cluster in hexadecimal or decimal format. Press OK and the cursor will jump to the selected cluster.
  • Goto: To go directly to the partition table, the boot record, the MFT, a certain MFT No. or the root directory of a drive click Goto in the main menu, then choose the desired destination.
    Note: The destination' s boot record, MFT, MFT No. and root directory are grayed until you have mounted a volume.
  • Links: The [image] Default Link property sets the next useful step while navigating through the drive. For example, the next useful area the cursor can jump to after the partition table area is the boot record. When you click on the small arrow beneath the default link icon, the next possible areas will be shown. Select one and the cursor will jump to this area, or just click the icon and the first choice on the list will be shown on the main screen.
    Navigating with the links is the most efficient way of moving through the drive.
  • Hotlinks: These are links similar to hyperlinks in html. They are blue-colored and allow context-sensitive jumping.

Path bar

Every step you take (e.g. switch from partition table to boot record, from boot record to root directory and back to partition table) will be visualized in the Path bar at the bottom of the screen. It works like a web browser, you can use the back and forth
arrows beneath the default link icon to switch between your selections.

History List

Click on the small arrow between the back and forth arrows and a history list will pop up.

Remember

Whenever you want your current position to be included in the history list and the path bar, just press the [image] Remember icon or click Link->Remember.

See also: Links, Main Screen, Introduction, Mount a volume


Links

Navigating with links is the most efficient way of moving through the drive. Depending on the current context links provide a list of areas where you can jump next.

You can invoke the link list in two different ways:

  1. Click on the small arrow beneath the default link icon.

  2. Right-click the mouse while over the main screen. On the popup menu select Links.

The next possible links will be shown. Select one and the cursor will jump to this area. There is always one default link that will be followed if you click the Follow link icon or type CTRL-ENTER.

DiskExplorer features the following links:

View | Link | Default | Action
Partition table |  |  |
 | Partition 1 | (*) | jump to 1st partition
 | Partition 2 | (*) | jump to 2nd partition
 | Partition 3 | (*) | jump to 3rd partition
 | Partition 4 | (*) | jump to 4th partition

(*)Default link is the partition that currently captures the cursor.

View | Link | Default | Action
Boot record |  |  |
 | Master file fable (MFT) | yes | jump to start of the Master File Table (MFT)
 | Root directory ('.') | no | jump to the MFT entry describing the root. This entry's MFT no is 5. Its name is '.'
View | Link | Default | Action
File entry |  |  |
 | Entry details | yes | display this file entry's details
 | File's data (resident or 1st cluster) | no | if data attribute is resident: view the entry as text if data attribute is non-resident: jump to 1st cluster of data and view as text

Hotlinks

The following views use a different kind of navigating. Instead of clicking onto the Link button you navigate by clicking onto context-sensitive blue colored Hotlinks:

  • File entry details
  • Index allocation

Example:

Clicking on Hotlink1 will bring you to cluster x0caffa, clicking on Hotlink2 will bring you to the directory containing this file (MFT#5 = root).

Moving the mouse cursor over a hotlink shows the connected action in a hint box:

Here is a list of the possible hotlinks:

Hotlink | Action
go to a cluster number | jump to the displayed cluster number and show the data as text
go to a MFT number | jump to the displayed MFT number and display as file entry detail
go to an index buffer at a cluster number | jump to the displayed cluster number and display as index buffer
Save | Save this file or directory (data recovery)
View | View this file

Not all links are available at all times. Links other than the partition and boot record link require a mounted volume. Following a partition or boot record link mounts a volume automatically.

See also: Navigation, Mount a volume


Select Drive

Select the drive you want to explore by clicking File->Drive in the main menu.

All available physical drives (HDs and their partitions, floppy drives) and logical drives are listed on the left window side.

You can also load an image file or a remote drive by pressing the corresponding buttons at the bottom of the window.

Now select the desired drive or file. Drive or file information containing e.g. the geometry and the no. of LBA (Logical Block Addressing) sectors will be displayed in the right window.

Press OK and you will see the drive or file structure on the main screen.

See also: Drives


Search

The search function enables you to find

  • text,
  • boot records,
  • partition tables,
  • MFT entries and
  • directory buffers (=index allocation)

on your drive.

To enter the search window click Tools->Search on the Main Menu.

Text

To find a text string enter the term either in ASCII or Byte format and press OK.
If you want to find the search term in either case - uppercase or lowercase - select the Ignore Case button.
Use the Fixed offset feature to narrow your search to a certain offset position within one sector. For example: If you know that your search term must be located at the beginning of a file, select Fixed offset and set the hexadecimal and decimal value to 0. Only the 0 offsets on the drive will be searched for the input. The search will be much faster.

Partition Table and Boot Record

To find a partition table or a boot record, select the corresponding button and press Ok.
If you start your search at the beginning of the drive, the partition table will be found first. To find the boot record just click Tools->Continue Search.

MFT entry

To search for a MFT entry select the corresponding button and press OK.

Directory Buffer (Index Buffer)

Search for an directory buffer by selecting the corresponding button and pressing OK.


Mount a volume

Mounting a volume is the process of making the DiskExplorer know a certain file system structure. This is required by some navigation features, such as jumping to a cluster or jumping to directory, and by the advanced recovery features, such as recover file and view file.

A volume normally is mounted automatically when you walk over a partition entry or a boot record using links. You can use Search to find such a sector.

You also can mount a volume with the create virtual volume feature.

See also: Create virtual volume, Navigation


Read

Read/Write modes

You can choose between three different read/write modes when working with the DiskExplorer.

Set the mode by clicking Tools->Options in the Main Menu.

  • The default mode is the Read only mode, which only allows read access to the drive. No data will be modified. Features like Edit current sector, Write changes, Paste and Fill are disabled.

It is strongly recommended that you leave the read only mode as the standard mode, because every write attempt to the drive can cause severe data damage.

  • In the Virtual write mode modifications are allowed, but will be stored in memory.
    Features like Edit current sector, Write changes, Paste and Fill are enabled.
    The modifications are not written to the drive until you click Tools->Options and click the Write button or exit the program and answer "Yes" in the warning window.
    If you want to discard the changes you made while in virtual write mode, choose Tools->Options and click Clear or exit the program and answer "No" in the warning window.
  • The Direct read/ write mode allows full write access to the drive. Modifications will be written directly to the drive.
    Features like Edit current sector, Write changes, Paste and Fill are enabled.

Please be aware that there is no undo of modifications of the data on the drive when in direct read/ write mode, every write access to the drive may result in irretrievable data loss.

You can see which mode is set on the status bar on the bottom. R/O means read only, V/M means virtual write and R/W means direct read/write.

See also: Caches


Edit

In order to write to your drive, you first have to switch from the default read only mode to the virtual write or read/write mode.

Note: Please be aware that write access to your drive may cause irrevocable damage to your data.

Edit

Edit a single sector by selecting the entry you want to edit and clicking Edit->Edit current sector in the Main Menu. The selected sector will be set in edit mode and you can make your changes. The modified area will be marked in red and the last modified sector will be specified on the bottom status bar as 'dirty'.

Edit Partition Table, Boot record

You can edit several entries directly while in Partition Table or Boot record view. Just highlight the entry and click once or press F2.

Fill

In order to overwrite an area on your drive with a certain value, select the area and click Edit->Fill. Define the filler byte either in hexadecimal, decimal or text format and click Ok.

Copy and Paste

To copy a data area to another area on your drive, first select the data to be copied and click Edit->Copy and then select the first byte of the data to be overwritten and click Edit->Paste. Or choose Edit->Paste from file to overwrite the selected position with data from file.

Copy To File

To copy the currently selected area to a file, click Edit->Copy to file. A file dialog will ask you for a file name and file type. Click Ok.

Paste From File

To paste a file's content to the current position, click Edit->Paste from file. A file dialog will ask you for a file name and file type. Click Ok.

Virtual mode

When in virtual write mode the modifications are not written to the drive until you click Tools->Options and click the Write button or exit the program and answer "Yes" in the warning window.
In direct read/write mode all changes are immediately written to the disk.

If you want to discard the changes you made while in virtual write mode, choose Tools->Options and click Clear or exit the program and answer "No" in the warning window.
In direct read/write mode you can't use the clear function, because all modifications are directly written to the disk.

Select

Allows you to select a range of sectors and bytes

See also: Caches, Read/Write modes


Select

You can select a certain data area by choosing Edit->Select. Give in the sector and offset values in either hexadecimal or decimal format and press Ok.

If you need to select the whole drive click Edit->Select All.

In case you want to clone your drive, choose Edit->Copy to file next, and an image file will be created, which you can load into the DiskExplorer and navigate through as if it were your original drive.


Caches

Runtime’s DiskExplorer uses several kinds of caches when reading from or writing to a drive.

Read/Only mode

The DiskExplorer uses a double cache (2 x 16 sectors) when performing read operations. When requesting a certain sector, usually 16 consecutive sectors are being read into the cache. Any possible read errors are stored until you actually request that faulty sector.

For example, the request of sector 0 for the partition table will result in a read operation involving sectors 0-15. A following request of sector 5 will not initiate a further read operation. The sector content will be copied from the cache. If there was an error when originally reading sector 5 the error will be displayed now.

The Reload button clears the caches and reloads the current contents.

Direct Read/Write mode

This mode uses the same caches as the Read/Only mode, expanded with write capabilities.

Write operations are using the same caches and will affect the drive when there is either a read or write request that cannot be satisfied by the cache’s contents or a flush request. The flush command is issued automatically after completing the write operations Paste, Fill, Paste from file. When modifying a sector by hand the flush is committed by the Write changes command or when you start modifying another sectors. The Discard Changes button lets you undo the changes in the current sector.

The Reload button clears the caches and reloads the current contents.

Virtual Write mode

This mode introduces an additional cache preventing the DiskExplorer from writing changes to the actual disk. This cache can hold up to 10000 sectors. This cache’s content will be written to the disk if you initiate this with Tools->Options->Virtual mode->Write or if you answer YES to the according question when exiting the program. You can clear the cache with Tools->Options->Virtual mode->Clear.

The Reload button clears the caches and reloads the current contents.

See also: Edit, Read/Write modes, Bad Sector Handling


Options

This dialog allows you to modify the following settings:

Security

Select Read/Only, Virtual write or Read/Write as the kind of drive access.
Clear or write the virtual write cache.

Recovery

Specify a default save directory that will be used by DiskExplorer View file and Recover file feature.
Indicate if you want to be prompted for information by the View file or Recover file feature.

NTFS

You can specify some fundamental NTFS settings:

  • Default MFT record size is the size of one MFT entry, usually 1024 bytes.
  • Default Index buffer size is the size of an Index allocation buffer, usually 4096 bytes.

Click Set defaults to reset these values to their defaults.

There is usually no need to change the NTFS settings.


Data Recovery

Runtime's DiskExplorer can be a helpful tool for data recovery, especially when the partition table or the boot record is corrupted or lost, when the drive was formatted, or files were deleted.

When the boot record is missing, try to reconstruct the boot sector in memory with the Create Virtual Volume feature.

When files were deleted try to recover files or view files .

Use the search function to search for text, partition tables, boot records, MTF entries or index buffers.

Take advantage of the find current file feature to detect to which file a certain cluster belongs.

The volume information lets you see what might be wrong with the volume's boot record.

Use the virtual write mode to make safe modifications to your drive.

Actually write changes to your drive by using the direct read/write mode.

Download Runtime's GetDataBack. This product is designed for doing automated data recovery (http://www.runtime.org)

See also: Data Recovery Examples


Recover File

Runtime's DiskExplorer allows for the copying and saving of files or whole directories in several ways.

You can recover a file while in

  • the file entry view: just select the file you want to save and press Tools->Recover File in the main menu,
  • the file entry details view: press Tools->Recover File in the main menu,
  • in the directory view: click the "Save" label beneath the file or folder, check the "include sub directories box, if you want to recover the whole directory,
  • anywhere in the data area of the file or folder: again press Tools->Recover File in the main menu, check the "include sub directories box, if you want to recover the whole directory.

To save the file, choose the destination to save the file to, check the "include sub directories" box if you are recovering a directory and want to include the sub directories, finally press OK.

You can define a default save directory, if you don't want the recover file dialog to appear each time you save a file. Open Tools->Options, choose the default directory and select the box below.

Note: The ability to save files is only available in the registered version of the software.


View File

The file viewer is able to display many text files (.txt, .doc, .rtf, .wri), many graphic files (.htm, .bmp, .ico, .wmf). Binary and unknown formats will be displayed in a hex viewer.

You can view a file while in

  • the file entry view: just select the file you want to view and press Tools->View file in the main menu,
  • the file entry details view: press Tools->View file in the main menu,
  • in the directory view: click the "View" label beneath the file,
  • anywhere in the data area of the file or folder: again press Tools->View file in the main menu.


Virtual Volume

Create Virtual Volume

A virtual volume is usually created automatically when you click your way through the partition table and the boot record (see: Mount a Volume). An alternative is the Create Virtual Volume feature.

This advanced data recovery feature will try to reconstruct the boot sector in memory. If successful you will be able to navigate through the file system and view and save files.

To create a virtual volume go to the beginning of the drive or volume, then click Tools->Create Virtual Volume.

Press Start and the program will try to find the necessary information for the virtual volume. After a while of searching you will eventually get a message, which asks you to confirm the possible cluster size and file system start sector. If these values sound reasonable press Ok, else Retry.

If the creation of the virtual volume was successful, you will get a message accordingly.

Press Close now and try to navigate through your drive.

See also: Mount a Volume, Navigation


Volume Info

Volume Information

To view the volume information choose Tools->Volume Information on the Main Menu or click on the second last bar, labeled Volume

There you see the information of the volume currently in use. It reflects either the volume's boot sector, or a structure retrieved by the Create Virtual Volume feature.

Feel free to make changes to the entries, because they are only stored in memory and are not re-written to the drive.

The volume information button is grayed until the drive is mounted.

  • Type indicates the kind of boot record: NTFS.
  • Boot Record @ Sector tells you the sector where the boot record is located.
  • Cluster0 @ Sector tells you the sector where cluster 0 is located.
  • Cluster Size displays the number of sectors per cluster (usually 1, 2, 4, 8, 16, 32, 64, 128).
  • 1st MFT cluster is the cluster number of the start of the Master File Table.
  • MFT record size indicates the size of the MFT record in bytes.
  • Index buffer record size indicates the index block size in bytes.

See also: Create Virtual Volume, Boot Sector


Find current file

Wherever you are on your drive, Runtime's DiskExplorer lets you determine to which file the current cluster belongs to.

Set the cursor to the data area you are interested in, then click Tools->Find current file. If the cluster is associated with a file, after a while of searching a window will display the MFT number of the file, the file name and the attribute the data belongs to.

To go to the file entry just click Go there in this window.


Data Recovery Examples

Lost Partition Table
Should the partition table be missing or corrupted, try the following:

Use the search function to search for a boot record. Just call the search window, push the Partition/Boot record button and click OK. If the program finds a valid boot record you can start to explore your drive from there. Double-clicking the boot record area or following the default link should bring you to the MFT of the drive, or click Goto->Root directory to go to the root directory.

Lost Boot Record
If the boot record of your drive is lost - for example, after you have run Fdisk - try the following:

Choose Tools-> Create virtual volume. This advanced data recovery feature will try to reconstruct the boot sector in memory.
If successful you will be able to navigate through the file system and view and save files.

Press Start. After a while of searching you will eventually get a message, which asks you to confirm the possible cluster size and file system start sector. If these values sound reasonable press OK, else Retry.

If the creation of the virtual volume was successful, you will get a message accordingly.

Press Close now and try to navigate through your drive by choosing Goto->Root directory or Goto->MFT etc.

Find current file
Wherever you are on your drive, Runtime's DiskExplorer lets you determine to which file the current cluster belongs to.

Set the cursor to the data area you are interested in, then click Tools->Find current file. If the cluster is associated with a file, after a while of searching a window will display the MFT number of the file, the file name and the attribute the data belongs to.

To go to the file entry just click Go there in this window.


Troubleshooting

These are the most common warnings or errors you might run into:

Access denied

Number of Bytes Exceeds Maximum

COMCTRL32 outdated

Could not lock drive

DRV16 not found

I/O Error

Bad sector handling

R/W Warning

If you get a runtime error, please submit a screenshot to: support@runtime.org.


Access Denied

Error: Access Denied

This message is displayed if you are trying to

  • open a file that is already in exclusive use by another process or
  • open a file in read/write mode that is write-protected.

See also: Image files


Bytes exceed maximum

Warning: Number of Bytes Exceeds Maximum

When pasting to a drive you can get these warning messages:

Specified source range exceeds source maximum

You are trying to paste more bytes than there are available from the source. You can cancel this operation. If you click ok, the source range is adjusted and the operation continues.

Specified number of bytes to copy exceeds target maximum

You are trying to paste more bytes than there is space on the target. You can cancel this operation. If you click ok, the number of bytes to be copied is adjusted and the operation continues.

See also: Edit


Outdated COMCTRL32

Outdated COMCTRL32.DLL

Your Windows version is using an outdated version of 'COMCTL32.DLL'. This component is an extension of the Windows operating system and comes usually with the MS Internet Explorer.

You will most probably have problems with this program's visual controls (you won't see the buttons). But you should still be able run this software.

It is recommended to download a new version at http://www.microsoft.com/msdownload/ieplatform/ie/comctrlx86.asp or to install a recent version of MS Internet Explorer.


Drive Locking Failed

Warning: Could Not Lock Drive

Locking a drive is a low-level feature for preventing several processes from accessing a physical or logical drive at the same time. You should verify no other processes are accessing the drive. If you Ignore the warning your process will possibly continue, but may cause damage to the data on the drive. Therefore, ignoring is not recommended.

See also: Drives


DRV16.DLL not found

Warning: DRV16.DLL not Found

This message is displayed on startup if the program runs on a Windows95/98/ME system and does not find the file DRV16.DLL.

This component provides physical drive access and is required by this program. You should quit the program and re-install this software.

See also: Physical drives


Read Error

Error: I/O Error

This message is displayed if the program encounters an error reading from or writing to a drive. This error is not recoverable, but you can ignore it.

You have the following choices:

Click Yes: the error is ignored and the operation continues.

Click Yes to all: the error is ignored and the operation continues. Future errors will be suppressed and ignored as well; you won't be prompted this message again. This condition is cancelled at the next regular prompt for a user input.


Bad sector

Bad Sectors Handling

An error was encountered during a sector block read operation.

Sectors are read in chunks of 16 sectors. If this operation fails this might be because of a single bad sector or of several bad sectors. You have the choice:

Skip sector block

All 16 sectors are considered bad. No attempt is made to retrieve possibly good sectors.

Retry accessing single sectors

The program retries reading the sectors one by one. This gives the chance to retrieve possibly good sectors in the neighborhood of a bad one. However, this can be very time consuming, especially if there are not good sectors at all.

See also: Caches


R/W Warning

Warning: DiskExplorer is in Read/Write mode

This message is displayed on startup if the DiskExplorer is currently in Read/Write mode. You should be extremely careful when making any changes to the drive.

It is strongly recommended that you switch to Read/Only mode, because every write attempt to the drive can cause severe data damage.

See also: Caches, Read/Write modes, Options