Topic: Recovering important data off a drive hit by CIH

I just rebuilt two hard drives taken out by CIH.  Fortunately this version
of the virus didn't attack my clients' BIOS as well.  We were also
fortunate in that the clients had no data worth taking the time to perform
a recovery on.  Hence, the rebuilds.  I did get a look at the FATs and the
virus did indeed write all over them.  They were wrecked.

I was prepared to use ONTRACK's TIRAMISU if I had to perform any data
recovery.  This is a passive data recovery program.  It does not alter any
data (write to) the drive at all.  I've used both the FAT16 and FAT32
versions of the TIRAMISU and it's pretty effective.  You may have to go
through some trial and error runs of the program depending upon what FAT(s)
were on your drive and if you had used any 3rd party partitioning programs
like Partition Magic.

You can download a free trial of this program from http://www.ontrack.com.
 It's fully functional except - after it performs its recovery and you view
what files can be rescued, you cannot take the final step and copy the
files to another hard drive.  For that, you need to purchase the program.
 You can do this on line and have the program up and running on your system
w/in an hour.  (They'll e-mail the key to you once you've paid online).

Good Luck!

Joan Rapier
[log in to unmask]

            Do you want to signoff PCBUILD or just change to
                    Digest mode - visit our web site:
                    http://nospin.com/pc/pcbuild.html