DMDE
DM Disk Editor and Data Recovery
Manual (version 01.39)

Updated version of the manual on Internet

The most recent version of the program on Internet

dmde.ru – program site
techdm.narod.ru – site mirror

dmdeinfo@dmde.ru, dmdeinfo@gmail.com – e-mail

http://dmde.ru/order.en.html – purchase the full version

Contents

Open volume

up |main page

A volume is formatted for a special file system, say, FAT or NTFS, and is addressed by a letter (C:, D:, ...). The volume usually covers a continuous area on a physical device (e.g., on a hard disk).

Before read, edit or recovery files and folders you should open the volume where they were located. Depending on the damage you can use one the following methods to open the volume.

If the volume is addressable by a letter (C:, D:, ...), you can open it via the dialog box "Select drive", Logical Disks/Volumes (DOS Services for DOS version);

If the volume has not a letter, first, you should select physical device, where the volume is located, – from the dialog box "Select drive", Physical Devices (ATA Interface or BIOS Services for DOS). Then open the dialog box "Partitions", select the item "found", select the volume from the list (according to the size, the label or its location) and open volume.

If it is impossible to open the volume from the dialog box Partitions", try "NTFS or FAT volumes search" depending on the file system type of the volume, (under Windows NT/2K/XP/Vista, NTFS is the default file system for volumes on hard drivers).

It is possible that more than one volume will be found. The necessary volume may not be the first found. You can open the volume just from the search dialog box. For – NTFS, it is recommended to wait until found files number is enough. For – FAT, you can open the volume as it is found, and then search directory fragments via the menu command.

If the volume opened does not contain the necessary files, you can open search dialog box again and open the next found volume or continue search for volumes if the volume is not found yet or the necessary files are not found (then open the volume again).

If data was moved over the disk, files of one initial volume may belong to different found volumes. Also, the same file may belong to more then one found volumes. Therefore, try to recover files from another volume if they were recovered with errors from one volume.

The additional information on volumes search – "FAT/NTFS volumes search".

Also, the volume may be opened from the Editor Window when viewing the volume boot sector or its copy as "NTFS/FAT/FAT32 Boot sector".

It is also possible to open the volume or entire drive image from the file: Open→Image....

When the new volume is opened the previous volume will be closed.

To find FAT removed and lost folders
use menu command "search all folders fragments (FAT)" after the volume is opened;

To view removed and lost NTFS files
go to the folders tree in the files panel.

Files and folders recovery

up |main page

Before recover files or folders open the volume (and read subject).

To recover select the file

  • from files panel or
  • from editor window
    and execute menu command
    Tools→Recovery... (or press Ctrl+U).
    To recover all files from the files panel, select the upper item ([..]).
    The full version of the program allow to recover files and folders with entire folders structrue.

    Files are recovered from the opened volume to any available drive, no changes to the source volume are made.
    Warning! Be sure to recover files on the volume which does not have any common sectors with the source volume (it is recommended to recover files to other physical device), otherwise the data recovered may be overwritten.

    The maximum file size for FAT volume is 4 or 2 Gb, so save greater files to the volumes with another files systems.

    Drive Images and Clones

    up |main page
  • Copy sectors to...: Create drive image or create clone
  • Write to sectors...: Write image to drive, to partition
  • Open drive image

    Dialog box "Select drive"

    up |main page

    Menu command Open→Drive....

    Open disk/physical device.

    Parameters - you can specify parameters and logical disk geometry manually, (Headers Number, Sectors per Track), (logical geometry is used when search for lost partitions, 255x63 is used almost everywhere for drives greater than 8 Gb).
    Find partitions - when device is selected the dialog box "Partitions" will be opened automatically.

    Dialog box "Partitions"

    up |main page

    Menu command: Open→Partitions...

    Contains partitions list for the base disk (not dynamic).
    Boot sectors (and their copy) information is loaded for FAT, FAT32, NTFS files system.

    Partitions Configuration/Saved Configuration: show current/saved partitions configuration.
    tables: show/hide partitions tables.
    found: show/hide found boot sectors and tables.
    detailed: when detailed mode is checked the following lines of volume information is shown: info from table entry ("E"), info from boot sector ("B"), info from boot sector copy ("C"); the following information of partition table: info from table entry referred ("E") info from the table itself ("T"). When the detailed mode is not checked all the information is displayed in one line.
    Activate/Remove: add/remove partition.
    Scan FAT: start FAT volumes search on the selected partition.
    Scan NTFS: start NTFS volumes search on the selected partition.
    Open volume: open the selected volume.
    Menu:
    Open saved configuration...: open and view partitions configuration saved to file.
    Save current configuration...: save to file current partitions configuration.
    The only information from partitions tables are saved. This will allow to fast recover partitions without formatting when partitions tables is damaged. It is recommended to save to another physical device. Before to save, be sure the program understands partitions properly.
    Apply saved configuration...: Partition the drive according to the saved configuration (command is available when view saved configuration). The saved partitions tables is wrote to the disk.

    FAT/NTFS Volumes Search

    up |main page

    Menu commands: Open→Scan for FAT/NTFS.

    Search FAT or NTFS volumes.

    The special quick search methods allow to find volumes without complete scanning of the selected area. The volumes with the greatest number of files are found at first. You don't have to wait scanning is complete before open a volume found. You can continue scanning from the current state when you open the search dialog box the next time.

    There some volumes may be found by mistake (e.g., this can happen if some data was moved over drive). Therefore, it is recommended to define the area allocated by the volume as precisely as possible and scan only this area.

    When search FAT volumes the signs "+" in the column "Boot FAT1 FAT2 Root" indicate the precense of the corresponding file system structures (boot sector, clusters table, clusters table copy, root directory). This allows to appreciate the volume damage and the information validness. The column "found" indicates the number of directories found which also is usefull to appreciate the validness.

    When search NTFS volumes the estimate of the selected volume size is shown. You can see also the number of the found files and total number of volume files (in parentheses there are number of files found, duplicates are included). Before open the volume wait until its first sector number is detected. It is recommended to wait until first sectors numbers are detected for all volumes and all $MFT fragments (which contain sufficiently large number of files found) (the column "starting sector") – to avoid wrong adding some files to the volumes.

    Open volume: open the selected volume.
    Save...: save the scan state to a file.
    Load...: load scan state from file (continue scanning from the saved state is possible).
    Start/Stop: start/stop scanning. If the scanning area was not changed the scanning is continue from the last state.
    Scan range: select area to scan. Is is possible to select one of the partitions or any drive extent.

    Files Panel

    up |main page

    Files panel is accessible after volume is opened.

    To show/hide files panel use menu command View→Files panel.
    [Enter], mouse double click – browse directories, open files data in Editor Window.
    Menu command "Tools→Recovery..." or keys Ctrl+U – recovery files.
    To view removed and found NTFS files go to the folders tree at first.

    Disk Editor

    up |main page

    Important information on editing under Windows.

    Editor is for view and edit the selected object. It can be sectors, FAT file, NTFS attibute (e.g., file data), directories.

    You can select an object

  • from the menu item "Editor",
  • from the files panel,
  • from the editor (by pressing [Enter] - see view modes).

    Use [Esc] key to return to the previous object in the editor window.

    Use menu item "View" to select view mode in the editor window.

    Use menu item Edit to edit data within the current sector.

    Use menu command Tools→Write to sectors... to write to consequtive sectors.

    To write the editor object or the selected block or sectors to the file or to another disk use menu command Tools→Write object to... and Copy sectors to...

    Open

    Image...

    Open drive image

    Open drive or partition image file. Work with image file as usual drive.

    Lock Volumes...

    The command is for Windows only. It allows to lock volumes and to make them inaccessible for other programs.

    If you edit not blocked volume its file system may be damaged if another program is writting to the volume too. Therefore, it is recommended to lock volumes before edit. Under Windows Vista, volume editing is allowable after it is locked.

    Close all programs using the volume before locking it. The system volume can not be locked. Never write to the system volume otherwise it will be damaged. It is not possible to lock the volume where the program is placed. Volume can be unlocked after it is closed.

    Windows

    Hide/open/go to the window.
    Use Ctrl+Tab also to switch between windows.

    Tools

    Write Object to...

    Copy sectors to...

    Menu commands Tools→Write object to..., Copy sectors to...

    Write object opened in editor/selected block/sectors to a file or to another drive.

    It is possible to create drives, partitions, volumes images, to clone drives, to save seclected block, etc.

    At first you should select drive containing the source data.

    The upper part of the dialog box is for source selecting, the low part is for destination.

    When create images take into account that maximum file size on FAT16 volume is 2 Gb, on FAT32 - 4 or 2 Gb.

    Write to sectors...

    Write file pattern or hex pattern to sectors.

    You can write image drive from the file to the drive, fill drive sectors with file or hex pattern.

    First, you should select drive to write to.

    Hex pattern maximum size is 8 bytes. For large patterns use file.

    fill entire area: when selected, file pattern is written repeatedly until entire are is filled; otherwise file is written once.
    sectors alignment: defines whether to write the next copy of the pattern to the sector start (the rest of the previous sector is filled with zeroes) or to write the next copy just after the previous one and ignore sectors bounds.

    Search string in object...

    Search for string in the editor object from the current postition.

    Search special sector

    Search for special system stuctures.
    Search over all drive sectors beginning from the current sector.

    Boot Signature - search for sector with boot signature 0xAA55.

    Boot Sector - search for boot sector.

    Partitions Table Sector - search for partitions table.

    MFT Record - search for MFT file.

    NTFS Dir Record - search for NTFS directory INDX-record.

    FAT Table Sector FAT16,
    FAT Table Sector FAT32 - search for clusters table (files allocation table).

    FAT Directory - search for FAT directory.

    Search again

    Repeat the search from the current position.

    Logical disk:

    Update files allocation information: use this command to update allocation information after modifying the volume; this information is displayed on the clusters map.

    Search all folders fragments (FAT): search for lost and removed FAT folders fragments.

    Update folders tree (NTFS): read all MFT fragments and compile folders tree.

    NTFS Tools

    up |main page

    Warning! Executing this commands on incompatible NTFS system may damage the file system. Do not use this commands if you see the program does not understand file system properly or you are not sure.
    Never execute the commands on the system volume (where Windows NT/2K/XP/... system files are located) otherwise it will be damaged.
    Under Windows NT/2K/XP/..., it is recommended to lock volume before executing commands in order to disable other programs access to the volume. After executing the commands you may check the volume with system program ChkDsk.
    It is not recommended to create files names containing special symbols.

    At first open NTFS volume and open the necessary folder of files panel,

    Copy file...

    Write file to NTFS volume.

    Read the warning before use.
    At first, select the source file which is to copy to NTFS volume. Then enter the new file name to create (or modify if exists) in current folder of the files panel.
    You can either overwrite or extend the existing file. Onyl long file name is being created, $SECURITY_INFORMATION attribute is not being added.
    There is must be enough continuous free space on the volume to extned the file.

    Create folder...

    Create folder on NTFS volume.

    Read the warning before use.
    Enter the new folder name to create in the current folder of the files panel.
    Only long name will be created, $SECURITY_INFORMATION attribute won't be added.

    Remove file/empty folder...

    Remove file or emptry folder from NTFS volume.

    Read the warning before use.
    Will remove file or folder selected in the files panel.

    Repair folder INDX-records...

    Repair all folder INDX-records which contain files lists.

    Read the warning before use.
    Files lists of the current folder of the files panel will be repaired according to $MFT.

    Menu "Editor"

    up |main page

    Open object to view/edit in editor window.

    Except commands partition tables, physical sectors..., the most of commands require the volume is opened.

    Partitions Table

    Go to the MBR sector (the first drive sector).
    Object is all drive sectors.

    Boot Sector

    Go to the volume boot sector (the first sector of the volume opened).
    Object is all volume sectors.

    Root Folder

    Go to the volume root directory.

    FAT/MFT

    For FAT volume, go to FAT1 (the first copy of the volume clusters table).
    For NTFS volume, go to MFT.

    FAT Copy/MFT Mirror

    For FAT volume, go to FAT2 (the second copy of the volume clusters table).
    For NTFS volume, go to MFTMirr.

    MFT Record...

    For NTFS volume, go to selected MFT file. The object is MFT.

    Volume Cluster...

    Go to the volume cluster.
    The object is all volume sectors.

    Volume Sector...

    Go to the volume sector.
    The object is all volume sectors.

    Physical Sectors...

    Go to the drive sector.
    The object is all drive sectors.

    Clusters Map

    Go to the volume clusters map.

    File data

    Go to the file data of the current sector of the editor window.

    Directory entry

    Go to the directory entry of the current file.

    FAT cluster/MFT record

    For FAT volume, go to the FAT cluster.
    For NTFS volume, go to the $MFT file.

    Clusters Map Cluster

    Go to the clusters map cluster.

    "View"

    up |main page

    Select view mode of editor window.

    Hexadecimal, Text

    View as hex/text.

    Use menu item "encoding" to change view code table.

    FAT directory

    View as FAT directory.

    Press [Enter] to open file data or directory in the Editor window (open FAT volume before).

    FAT12/FAT16/FAT32

    View as FAT table.

    Press [Enter] to go to the corresponding volume cluster.

    Partitions table

    View as partitions table.

    Press [Enter] to go to the boot sector or the next partitions table.

    FAT/FAT32/NTFS Boot record

    View as FAT/FAT32/NTFS volume boot sector.

    To select the next file system execute FAT/FAT32/NTFS Boot record again (or press F7).

    Press [Enter] to open volume.

    NTFS directory

    View as NTFS directory INDX-record.

    Press [Enter] to open file data or directory in the Editor window (open NTFS volume before).

    MFT record

    View as MFT file.

    Press [Enter] to open selected attribute or directory in the Editor window.
    Press [Space] to view attribute details.

    Sectors of NTFS file

    Switch between true sectors data view (as on drive) and file data view.

    Encoding...

    Select code table to translate data in Hexadecimal/Text mode.

    Edit

    up |main page

    Edit commands are accessible from Editor window when view as:
    hex, text,
    FAT directory,
    FAT16/FAT32,
    partitions table,
    FAT/FAT32/NTFS boot sector.

    Switch to edit/view mode with menu command Edit mode.

    Edit data of one sector, then Write changes... to drive or Discard changes with menu commands.

    Use submenu Tools to perform writes to many sectors.

    Before write to the first drive sector switch off BIOS antivirus protection and all programs which perform this protection (like Norton Antivirus, etc.).

    Fill zero block

    Fill selected block with zeroes.

    Copy

    Copy selected block to the internal buffer.

    Paste

    Paste internal buffer to the sector from the current postition.

    Select block

    Switch block selection modes. You may also use [Shift] with arrow keys, mouse.

    Write changes...

    Write last changes to the drive.
    Before leave current sector you should write changes or discard changes.

    Discard/read again

    Reread sector data from the drive.

    Edit mode

    Switch edit/read only modes. See view modes which allow editing.


    last updated – 2008-07-21

    (C) 2008 Dmitry Sidоrоv