Using MRECOVER

Using MRECOVER

In this page there is a brief description of how to use MRECOVER. The program was built to be run from DOS mode. If you have been hit by the CIH virus and the hard disk contents are damaged, you should not be able to boot from the hard disk. Inorder to run MRECOVER you'll have to boot from a system disk and run it from there (or another floppy).

The ZIP file provided for download contains, the MRECOVER.EXE file and the README.TXT. It was zipped with PKZIP so, you should have no problem

Phase 1: Recovery of partition table and all logical partitions

You will be first asked to select a physical drive (it you have one or more hard disks you will select the one you want to work on). At this phase MRECOVER will try to reconstruct the partition table by searching the disk for a valid partition chain. First it will show what partitions it finds. If you don't see anything then its time to find out the partitions. If you already have a good partition table you will see the list. If you are sure that the list you see is not the correct one you can continue with the search.

You can assist in the search by entering the estimated size of the first partition. This need not be accurate, but give the least value possible. MRECOVER will search for partitions. If you had one partition then there is no need to search just assign the whole space to one partition.

Once a partition chain is found you will be asked to make confirmation and the changes will be carried out. You should be able to get all you logical partitions back. The first partition will be shown as ASSUMED (as its type is not known). You will be asked for the type - if its FAT16 or FAT32. Be catious in entering this value.

Phase 2: Recovery of first partition if its FAT32

If you selected the first partition to be FAT32, MRECOVER will try to recover it. If MRECOVER sees that it is not marked as FAT32 you can still tell MRECOVER to try to retrieve assuming that it is a FAT32 partition.

You can be sure that it should be recovered fully if its FAT32 and greater than 1GB. All the tasks of this phase are automated. Once changes are made and data is recovered, the system will reboot. If this stage is successful you should be able to boot right from your hard disk (remember to remove the floppy).

Home
Introduction to MRECOVER and features of version 1.85
Data storage in hard disks
The CIH virus and its damage
Using MRECOVER