• Author / Uploaded
• sutedjo parto

Citation preview

---------------------------------------------------------------------------INSTALL: If you have previously installed an older version of UnCHK, you MUST install this version in a different directory -or- delete the older version's program and INI file. "Installation" consists of extracting the "UnCHK.exe" and putting it wherever you want. If, when you run the program, it says you are missing MSVBVM50, You need to download this file from Microsoft: ftp://ftp.microsoft.com/Softlib/MSLFILES/MSVBVM50.EXE Save it to a temporary spot and run it. It will install the Visual Basic 5 run-time files you need. After you've finished the installation, you can delete the file you downloaded from Microsoft. ---------------------------------------------------------------------------QUICK START: Drop a CHK file on it -or- just run it. ---------------------------------------------------------------------------FAQ: What are the "Scan Depth" settings? Whole files - In general, if your recovered CHK files are intact and your file system was in good shape (not counting whatever happened to create the CHK files!), you can just try to identify the CHK files. The "Whole files" scan depth setting is the fastest and generates the fewest false recoveries. It also misses the most... because... your file system is NEVER in good shape! Embedded files - If your file system was so fragmented that you couldn't recover any complete files, this might find a few pieces. The "Embedded files" option will check every single byte trying to locate little things that might have been embedded in other documents. For example, pictures that were part of Word documents. You should *NOT* use this scan depth setting unless everything else has failed you *AND* you know you have embedded items that are worth retrieving. The "Embedded files" scan depth setting is the slowest and generates an excessive number of false recoveries. If you really want to use it because you are desparate to try to recover something, you should consider blocking all file types from being recovered except the file type you are trying to recover. See the "What if I only want to recover a single type of file?" FAQ below for instructions on how to block unwanted file types from being recovered. Floppy disk - If the CHK files you are recovering came from a floppy disk (even if you've since copied them to your hard drive), this setting might recover something that the "Whole files" depth setting would miss. It checks inside the recovered CHK files on the 128-byte boundaries looking for cross-linked files. Cross-linked files are fairly rare, and with any luck the recovery program that created your CHK files made copies of and cross-linked files. If so, this setting won't find anything more than the "Whole files" setting. The "Floppy disk" scan depth setting is only slightly slower than the "Whole files" setting and will generate more false recoveries. Hard disk - Same as the above "Floppy disk", except this checks on 512-byte boundaries. Your disk may use much larger clusters, so this might be a bit of overkill, but at least your cluster size isn't going to be *smaller* than 512 bytes.

---------------------------------------------------------------------------FAQ: How do I modify the INI file to add more file types? The easy way is to drop a KNOWN GOOD file onto the UNCHK program. UNCHK will automatically add an entry for that file type to the INI file. From then on, UNCHK will know how to recover files of that type. More or less. To manually edit the UNCHK.INI file, look in the same place as the UNCHK.EXE program file. The INI file format is a file extension followed by the hex-encoded file header, a space, then some hex-encoded text that should appear in all files of that type. For example, a JPG file has a header that always starts with these bytes: ��� Hex-encoded, it becomes: FFD8FFE0 However, JPG files also have a plain-text identifier inside them of: JFIF When we hex-encode that, it becomes: 4A464946 So the INI file entry becomes: JPG=FFD8FFE0 4A464946 If you think that's going to be tough to do without a hex encode program, I agree! I built an encoder and decoder in. Run them by starting the program with either of the following command lines: UnCHK.exe /encode UnCHK.exe /decode You can also use the native "DEBUG" utility to display hex, but only if you are prepared to work around it's short file name and small file size limitations. ---------------------------------------------------------------------------FAQ: What if I only want to recover a single type of file? Every time the UnCHK program runs, it makes sure the standard INI entries exist and aren't blank. And the program always checks every file type listed in the INI file. And that's your clue! Start the program, but don't do anything with the first question it asks. Instead, open the INI file and delete any entries you don't want to search for. Save the INI file, then continue running the program normally. Remember, you have to modify the INI file each time you start the program. Another approach is to make sure the INI file entries exist and aren't blank (which is all it takes to satisfy the startup routines), but put bogus data in them. Since you know the data is suposed to be hex-encoded, put something that can't be decoded properly! For example: EXE=ZZZ