Introduction

Captain Nemo Pro © 2003-2014 by Runtime Software LLC

75-6082 Alii Dr., Suite A, Kailua Kona, HI 96740, USA
Phone (USA): 1-888-777-6960, Fax: 1-818-475-1741
Phone (Germany): +49-30-2180 1016
Email: info@runtime.org , Web: http://www.runtime.org

Captain Nemo is widely used by law enforcement personnel, forensic investigators as well as network administrators. Captain Nemo enables you to access any Novell, NTFS, EXT2FS, EXT3FS, or XFS drive from your Windows computer without requiring a network setup.

Just connect the drive to your machine and Captain Nemo will automatically mount your Netware, NTFS, EXT2FS, EXT3FS, or XFS partitions in Windows. You can read, search and view all files from on these partitions and copy them to another location.

Mount images you previously created with another software, such as DD, RAID Reconstructor, GetDataBack or DiskExplorer. Captain Nemo can mount any raw image of a disk that was formatted with NTFS, Novell or Linux EXT2FS, EXT3FS or XFS. Captain Nemo accepts raw images (.img), compressed raw images (.imc) and virtual images (.vim).

While Captain Nemo is not a data recovery tools in a strict sense, you can often use the Captain to mount an image or virtual image that you created with RAID Reconstructor. Once a RAID is reconstructed its file system is usually in good enough shape to be simply mounted in Captain Nemo, saving you many hours recovering your files.

Captain Nemo does not require the installation of any Netware, NTFS or Linux drivers, programs or files!

The foreign file system will be mounted automatically and you can copy files from it to the Windows partition.

Captain Nemo looks like and is as easy to use as the Windows Explorer, but allows you to access all the data on the Novell, NTFS or Linux drive.

Check out our installation hints.

Look at our comprehensive example showing how to mount a virtual image of a RAID.

Quick Start - Mount a drive:

Attach the drive containing the NOVELL, NTFS or Linux data to your Windows system. Make sure you set the jumpers correctly and informed the BIOS about the new drive. As soon as the program is started you will see a directory tree on the left side containing the accessible NOVELL, NTFS and Linux drives. After choosing the desired entry, the corresponding drive will be mounted. you can mount further drives by entering this tree again.

Quick Start - Mount an Image:

Click on Image if you wish to load an image you previously created with another software, such as DD, GetDataBack or RAID Reconstructor. Captain Nemo accepts raw images (.img), compressed raw images (.imc) and virtual images (.vim). See GetDataBacks' or RAID Reconstructor's documentation for more information about these image types.

Captain Nemo Feature List:

  • Supported file systems:

    • Netware 3.x, 4.x, 5.x

    • Windows NTFS

    • Linux EXT2FS/EXT3FS

    • XFS

  • Read, copy, access, search and recover files from foreign file systems without a network setup or cabling. You do not need any Novell, Windows-NT or Linux software. Simply add the drive containing the Novell, NTFS or Linux volume to a Windows machine, reboot, and start Captain Nemo Pro. The foreign file system will be mounted automatically and you can copy files from it to another location.

  • Mount raw drive images you previously created of disks containing NTFS, Linux or Novell file systems.

  • Mount virtual images that describe broken RAID sets in order to copy files off that RAID.

  • Not only does Captain Nemo Pro mount RAID's, but images in general such as forensic images.

  • Captain Nemo Pro can mount all physical disks, and any images you manually load.

  • Captain Nemo Pro is read-only. It will not try to fix your file system. It will simply mount it and allow you to copy the data to another location.

  • Easily see file system information as well as file and folder information by right clicking on a file system, folder, or file and selecting Info.

  • Sort your files by selecting from the tabs when your files are displayed.

  • Use the file viewer to see the content of almost any file.

  • Use the Search function, which enables you to do extensive search for containing text or files.

  • Display of the owners and attributes of every file.

See also: System requirements, Installation

Images, Virtual images (VIM Files), RAID Example, Physical drives, Options, Search, Register, Purchase


Installation

Do not install the Captain Nemo to the drive(s) you want to recover! It is recommended to proceed as follows:

Install the program to a computer, which doesn't have any problems. If you have a choice, choose the computer which has the most RAM and is the fastest.

If you intend to mount a RAID image you will need your virtual image (.VIM) file or image file, as well as the drives from the array attached to this computer with a non-RAID controller. You should have already done this if you have run RAID Reconstructor.

After downloading the Captain Nemo Pro run the SETUP.EXE. The setup wizard will guide you through the installation process.

NT/XP users: You must have Administrator rights to run this program.
Vista/Windows 7 users: You must switch User Access Control (UAC) off or you right-click the program icon and select "Start as administrator".

See also: System requirements, Introduction

Introduction, Images, Virtual images (VIM Files), RAID Example, Physical drives, Options, Search, Register, Purchase


System Requirements

  • Pentium processor
  • 512 MB RAM
  • Windows 95/98/ME, Windows NT, 2000, XP, 2003, Vista, Windows 7, 2008, 32-bit or 64-bit
  • One problem-free hard disk to boot from
  • If you are going to mount a virtual RAID you need a disk controller card capable of handling all the drives in your RAID individually. See documentation for RAID Reconstructor.
  • Storage space for holding the .vim file or the reconstructed array.

See also: Installation, Introduction


Saving Your Files

You can easily save files and folders in Captain Nemo Pro. From either side of the software, you can save your files once you have registered the software. Here is how you save a folder from the left hand side.

This is how you save a file or folder from the right hand side.

You can also use the Save icon at the top of the screen.

If you want to only recover a single file or folder, right click on the file or folder and click on Save. If you want to copy everything, you can right click on the mounted drive and click Save.

Once you have clicked Save, you need to choose where you want to copy the files or directories.


Sorting Your Files

You can sort your data in many different ways in Captain Nemo.

Once you have your file system mounted, you can click the column headers on the right side of the software in order to sort your files by name, size, type, date or attribute.

You can sort ascending and descending by:

  • File Name
  • File Size
  • File Type
  • Date
  • Attributes
  • Owner (Netware and ExtFS2/ExtFS3 only)

You can also open the sort-by list by right-clicking on a file on the right hand window.


Info

You can right-click on either the left or right side of the of the software pane and see information about what you selected. We are going to start on the left hand side with an NTFS file system. Right-click on the file system and select Info.

You will be presented with a box that will give you all the file system information:

  • Name of the mounted device
  • The s erial number of the drive if it is a physical drive
  • Total capacity of the drive in bytes
  • Free bytes on the drive
  • BIOS Drive #
  • Partition #
  • Volume Name
  • The cluster size of the volume
  • The Index buffer size
  • The file buffer size
  • Sector of 1st cluster
  • Total sectors on the device
  • Total clusters on the device

If you right click on a file or folder, you will get detailed information about that file or folder. We are going to right click a file and select info.

We now get the file information for this file:

  • Name of the file
  • Type of the file
  • Location of the life (this is the mounted drive number)
  • Size of the file
  • Last modification date
  • Last access date
  • Creation date
  • File attributes


Registering the Software

You will need to purchase a license key for Captain Nemo in order to copy files from a mounted drive or image. You can do so now by going to http://www.runtime.org/buy_now.htm. You will receive a license key and registration name you will need to enter into the software by clicking Help->License Captain Nemo...

You will be presented with a box to enter the registration name and license key. Copy and paste the information you received when you purchased the software into the correct areas.

After you enter your registration information, you will be ready to copy your files.

See also: Installation, Requirements, Disclaimer and License Agreement

Introduction, Images, Virtual images (VIM Files), RAID Example, Physical drives, Options, Search, Purchase


Search Function

You have the ability to search for files in Captain Nemo. You will need to click the Search button on the top right of the software.

You will see a number in the search directory, this corresponds to the mounted drive number in the main window of Captain Nemo.

You must enter the search term into the filter section. Do not include them in the search directory. However you can search through a folder by adding the folder name to the Search Directory. For example, you can look into a photos folder that is on the root of the drive by entering 3:\photos\. You can search by Files (with or without the fuzzy logic filter turned on), File date, File size, or Contains text. Once you click Start in the upper left corner, all the files that match the search details will be found below.

If you right-click on a file, you can click Start to start a new search, New to clear the previous search results, Sync to be taken to the location of the file in the main window, View to view the file with the Captain Nemo viewer, or Close to close the search results window.

Introduction, Images, Virtual images (VIM Files), RAID Example, Physical drives, Options, Register, Purchase


License Agreement

License Agreement and Disclaimer

The following are the conditions under which Runtime Software software is sold, supported and may be used. By using or registering Runtime Software software, you are agreeing to these.
This document may be augmented or superceded by conditions included with specific applications.

Neither the author(s) nor Runtime Software assume responsibility for any expense, damage or loss caused by your use of this software, however it occurs.
All the registered trademarks used herein are registered to whoever it is that owns them. This notification is given in lieu of any specific list of trademarks and their owners.

If you register software by Runtime Software, we will assume that you are doing so having tested the shareware version and ascertained that it's suitable for your hardware and requirements. We cannot provide refunds for shareware registration if you subsequently change your mind.

No portion of the documentation for this software or any of its attendant files may be reproduced in whole or in part in any medium or form of transmission exclusive of the archive file for the software without the express written permission of Runtime Software. You may not modify or patch the software's executable files in any way, including but not limited to decompiling, disassembling, or otherwise reverse engineering the program.

Registering this software buys you a named single-user license to use it in perpetuity, subject to the terms discussed herein. With a named single-user license you are the only user of the license, installed on one computer owned or controlled by you. If you want to have the software installed on more than one computer at the same time, you need to purchase additional licenses. If you want the software to be used by additional users, you need to purchase additional licenses. A single-user license does not permit you to make the registered software available over a network for multiple users to access, to distribute it in any form or to provide it in conjunction with any other product without the express written permission of Runtime Software. The license is not transferable to another party without written permission of Runtime Software. If you have any questions about the software license, feel free to get in touch with us.

A "Technician's License" has the same rights and restrictions as the above "named single-user license", but allows you to perform data recovery services on computers not owned or controlled by you.

If you have downloaded this software or had it given to you on disk to try out, you are allowed to use the limited version of the software for free, in order to use the full version you have to register the software immediately.

You may distribute the software (on CD-ROMs, Books, Catalogs, Internet etc.) as long as you follow each and every one of the following:

1. You distribute only exact, unmodified copies of the original unregistered shareware version of the software incl. the DISCLAIMER.
2. You do not monetarily charge or otherwise request any compensation for any copy, however made, without prior permission from Runtime Software.
3. You include the phrase "Copyright by Runtime Software" with any copy of the software.

See also: Purchase


Options

Captain Nemo Pro Options

There are only two options in Captain Nemo Pro. You can find the options by going to Tools->Options.

Bad sector handling.
The default option when finding bad sectors is: skip block. This means, when the software finds a bad sector it will skip it and try the next block.

If you change this to Retry each sector, it will retry the sector. If you have a lot of bad sectors on a drive, this may increase the time of recovery as it will retry to extract the data from the bad sector.

Boot sector search ranges
 Captain Nemo Pro will try to mount volumes as they are described in the disk's or image's partition table. Captain Nemo Pro will then scan the given range in order to find additional boot records or super blocks (that are not pointed to by the partition table).

Unless you know for a fact that your boot sector is in another range, do not change this!

XFS

Include links will display XFS symbolic links.

Log

Specify a log file if you want to record any information about Captain Nemo's internal processes.

Introduction, Images, Virtual images (VIM Files), RAID Example, Physical drives, Search, Register, Purchase


Drives

Besides Virtual Image Files, Runtime's data recovery programs accept image files and physical drives as a data source:

  • Physical drives
  • Image files
  • Virtual images


Image Files

Image files are files containing raw images of a drive. With programs like Runtime's RAID Reconstructor, GetDataBack and Captain Nemo Pro, you can process these image files like real physical drives.

Multiple Files

Image files can consist of:

  • one file (e.g. 'drive128.img')

  • multiple files (e.g. 'drive128.img', 'drive128.001', 'drive128.002', ...)

This is helpful when imaging a drive larger than the maximum file size (2GB or 4GB, depending on the operating system). Fragments of a multiple file image are about 656MB in size. A smaller size indicates the end of the file set. If there are more than 1000 fragments, the numbering switches from '001', ..., '999' to 'A00', ...'ZZZ'.

Compression

You can use compressed image files (e.g. 'drive128.imc') by selecting 'Compressed image data files (*.imc)' as file type in the file open dialog. This feature enables you to create drive images much smaller than the original.

Compressed files can be multiple file images too.

We do not recommend that you use compressed images.

A special kind of images are virtual images.

See also: Drives, Physical Drives, Virtual images (VIM Files)

Introduction, Virtual images (VIM Files), RAID Example, Physical drives, Options, Search, Register, Purchase


Virtual images

Virtual Image

Virtual Images are short text files describing the data to be loaded. Thus, you can "glue" together different data sources. This is especially helpful if you want to recover RAID arrays. RAID Reconstructor creates virtual images that you can use in Runtime's GetDataBack, DiskExplorer, and Captain Nemo.

Virtual images always have the extension "vim".

You can also create your own virtual images. Virtual images are XML files with just a couple of commands ("tags"). You can put together any number of drives, as long as the total capacity does not exceed 2 TB.

<virtualimage>

This is the root tag that encloses all other tags.

Example:

<virtualimage>
:
:(other tags)
:
</virtualimage>

<sector>

This tag sets the sector number of the virtual image to a new value. Any gaps you create by that will be filled with 0's.

Example:

<virtualimage>
:
  <sector>1000</sector>
:
</virtualimage>

<drive>

This tag describes a drive that is being used. You can also specify a certain area inside that drive.

Example:

<virtualimage>
  <drive>HD128:</drive>
</virtualimage>

This example of a virtual image uses your first hard drive (HD128:). Make sure you always append a colon to the drive's name.

Another example:

<virtualimage>
  <drive>HD128:0-999</drive>
  <drive>c:\images\myimage.img:1000-</drive>
</virtualimage>

This example maps the first 1000 sectors of HD128 to your virtual image. Sector 1000 and up of your virtual image will come from sector 1000 and up of the image file "c:\images\myimage.img". The ranges are specified by appending two numbers, separated by a dash. If you leave out the second number, the range will extend to the end of the respective drive.

Possible drives names are:

HD128:, HD129:, etc | 1st, 2nd physical drive etc.
FD0:, FD1: | 1st, 2nd floppy drive
C:, D:, etc. | Logical volume C:, D:, etc.
myfile.img, myfile.imc | Image files
NULL: | Virtual drive, delivers empty sectors. Must be followed by a range.

<loop>

Use the <loop> tag to define RAID arrays.

Example definition of a 3 drive RAID-5 with a block size of 128, backward rotation:

<virtualimage>
  <loop>
    <drive>c:\img\raid5\r1.img:</drive>
    <drive>c:\img\raid5\r2.img:</drive>
    <drive>c:\img\raid5\r3.img:</drive>
    <cycle blocksize="128">
      <stripe>1,2</stripe>
      <stripe>1,3</stripe>
      <stripe>2,3</stripe>
    </cycle>
  </loop>
</virtualimage>

After the introducing <loop> tag, specify the drives you will use in the RAID. On the syntax of the <drive> tag see the specification above.

In the <cycle> tag, define the stripes making up the RAID. Each stripe is a sequence of data taken from the previous defined drives. Define the block size as an attribute for the <cycle> tag. You would read the example above as:

  1. Take 128 sectors from the 1st drive (sectors 0-127).

  2. Take 128 sectors from the 2nd drive (sectors 0-127).

  3. Take 128 sectors from the 1st drive (sectors 128-255).

  4. Take 128 sectors from the 3rd drive (sectors 128-255).

  5. Take 128 sectors from the 2nd drive (sectors 256-383).

  6. Take 128 sectors from the 3rd drive (sectors 256-383).

This continues until the end of one drive has be reached. The smallest drive determines the size of the loop. If the smallest drive is 10000 sectors, the total size is 20000 rounded up to a full cycle, which is 20736. You can change the size of the loop in two ways:

1) Specify the number of times the loop should be repeated. You can do this by adding an attribute with the name "repeat" to the <loop> tag, e.g.: <loop repeat="27">. In the RAID example, repeating the cycle 27 times will yield 6*128*27 sectors, which is 20736.

2) Specify a range. Do this by adding the attribute "range" to the <loop> tag, e.g.: <loop range="10-20".

The "repeat" takes precedence over the implicit size as determined by the drives. The "range" takes precedence over the "repeat".

You can even define incomplete RAID-5 arrays. If, in the example above, the 3rd drive would be missing, you could describe the array like that:

<virtualimage>
  <loop>
    <drive>c:\img\raid5\r1.img:</drive>
    <drive>c:\img\raid5\r2.img:</drive>
    <cycle blocksize="128">
      <stripe>1,2</stripe>
      <stripe>1,1x2</stripe>
      <stripe>2,1x2</stripe>
    </cycle>
  </loop>
</virtualimage>

The expression 1x2 will calculate the missing sector, originally on the 3rd drive.

See also: Drives

Introduction, Images, RAID Example, Physical drives, Options, Search, Register, Purchase


Physical drives

Physical drives are tangible media like hard drives and diskettes. They have specific names:

FD0 | 1st diskette drive
FD1 | 2nd diskette drive
HD128 | 1st hard drive
HD129 | 2nd hard drive

See also: Drives, Image Files, Virtual Images

Introduction, Images, Virtual images (VIM Files), RAID Example, Options, Search, Register, Purchase


Loading a virtual RAID image

Example: Loading a Virtual RAID Image

While attached physical drives are mounted automatically, images must be loaded manually. This process is the same for images, compressed images or a virtual images.

Images can be any kind of raw images as they are created by GetDataBack, RAID Reconstructor, DiskExplorer or third party forensic utilities. Virtual images are created by RAID Reconstructor, allowing you to mount a virtual RAID with Captain Nemo. The following example shows how to load a virtual image.

There are three easy steps to follow:

Input the Virtual Image Into the Software

The virtual image we are going to load was created by RAID Reconstructor. However, it could be any kind of image.

Click File->Image

From the Files of type menu, choose Virtual Image (* .vim)

Locate your .vim file and double-click it or select it in the window and click Open

You will see some information in the Mounted drives section for each drive that is either physical or mounted.

  • The first piece of information is the volume label. This is what you named the drive when you formatted it.
  • Next is the image name or drive number that is mounted.
  • The third piece of information is the path through the partition table.

View and Test Your Data

After loading your .vim file, or physical drive, open a few files in order to test them. You will not be able to test files that need to be imported correctly into their native application, like for example, Outlook PST files.

Select files that are easy to check - for example Word documents, pictures, or mp3's. Use the viewer to have a first look at the files the are displayed. Select the file you want to examine and press the view button or F3. The viewer is able to display the file content for various file types (.txt, .doc, .bmp). If the file type is not supported the file content will be shown in hexadecimal format. Please note: To open files by double clicking them, their associated application needs to be installed on the recovery computer. Do the files open fine. meaning you can see the file content, the text, picture? If so repeat the same process with a couple of more files in different folders. If all or at least the majority of files open okay, your recovery is looking good.

If you do not see your file, be sure do a search for the file.

Legend of File Attributes

Appearance | Meaning
filename.ext | normal file or directory
filename.ext | read/only
filename.ext | system
filename.ext | hidden
filename.ext | compressed
filename.ext | encrypted

Compressed Files

Compressed files are files that are marked as compressed in the file system.

Encrypted Files

Encrypted files are files that have been encrypted by the file system. These files are not recoverable as the idea of encryption is that no one can access the data outside the running operating system with the encryption key in place and in working order.

Copy Your Data

Once you purchase the software and enter the registration information, you will be able to copy the data. Right-click on what you would like to save and select Save.

You can enter the directory directly or you can click on the folder icon to browse for the location to save the data.

That is all you need to do, Once this is finished you are done recovering your data. Be sure to go back to the drive you copied the data to and make sure it is all there and in working order.

Introduction, Images, Virtual images (VIM Files), Physical drives, Options, Search, Register, Purchase


Troubleshooting

These are the most common warnings or errors you might run into:

Access denied

COMCTRL32 outdated

Could not lock drive

DRV16 not found

Bad sector handling

License required

If you get a runtime error, please submit a screenshot to: support@runtime.org.


Access Denied

Error: Access Denied

This message is displayed if you are trying to

  • open a file that is already in exclusive use by another process or
  • open a file in read/write mode that is write-protected.

See also: Image files


Outdated COMCTRL32

Outdated COMCTRL32.DLL

Your Windows version is using an outdated version of 'COMCTL32.DLL'. This component is an extension of the Windows operating system and comes usually with the MS Internet Explorer.

You will most probably have problems with this program's visual controls (you won't see the buttons). But you should still be able run this software.

It is recommended to download a new version at http://www.microsoft.com/msdownload/ieplatform/ie/comctrlx86.asp or to install a recent version of MS Internet Explorer.


Drive Locking Failed

Warning: Could Not Lock Drive

Locking a drive is a low-level feature for preventing several processes from accessing a physical or logical drive at the same time. You should verify no other processes are accessing the drive. If you Ignore the warning your process will possibly continue, but may cause damage to the data on the drive. Therefore, ignoring is not recommended.

See also: Drives


DRV16.DLL not found

Warning: DRV16.DLL not Found

This message is displayed on startup if the program runs on a Windows95/98/ME system and does not find the file DRV16.DLL.

This component provides physical drive access and is required by this program. You should quit the program and re-install this software.

See also: Installation


Bad sector

Bad Sectors Handling

An error was encountered during a sector block read operation.

Sectors are read in chunks of 16 sectors. If this operation fails this might be because of a single bad sector or of several bad sectors. You have the choice:

Skip sector block

All 16 sectors are considered bad. No attempt is made to retrieve possibly good sectors.

Retry accessing single sectors

The program retries reading the sectors one by one. This gives the chance to retrieve possibly good sectors in the neighborhood of a bad one. However, this can be very time consuming, especially if there are not good sectors at all.


Support

You can contact us for support:

USA

Phone | 1-888-777-6960
Fax | 1-818-475-1741
Email | support@runtime.org
Website | http://www.runtime.org

Europe (Germany)

Phone | +49-30-2180 1016
Fax | +49-30-690 88 444
Email | support_europe@runtime.org
Website | http://www.runtime.org

If you have any questions related to the use of this software, please call us or send us an email.

See also: Troubleshooting, License agreement