owenc@hpindwa.HP.COM (Owen Cheung) (10/25/89)
A friend of mine accidentially deleted some important files from his floppy. Does anybody know any way of recovering these files? I don't know how the MS-DOS file system works, but some of the other file systems that I know only marks a bit in the directory when a file is deleted. Thus, if someone knows how the file directory is structured, it would be very easy to reset that bit and recover that file. Does the MS-DOS file system works the same way? Does anybody know any public domain or commercial programs that can recover deleted files? Any help is appreciated. Owen
fredex@cg-atla.UUCP (Fred Smith) (10/25/89)
In article <36440001@hpindwa.HP.COM> owenc@hpindwa.HP.COM (Owen Cheung) writes: > >A friend of mine accidentially deleted some important files from his floppy. >Does anybody know any way of recovering these files? I don't know how the >MS-DOS file system works, but some of the other file systems that I know >only marks a bit in the directory when a file is deleted. Thus, if someone >knows how the file directory is structured, it would be very easy to >reset that bit and recover that file. Does the MS-DOS file system works >the same way? Does anybody know any public domain or commercial programs >that can recover deleted files? Any help is appreciated. > > >Owen THIS IS IMPORTANT !!! DO N O T do anything on this diskette that involves writing to it,or you may not be able to recover those deleted files! If your friend does not have Norton Utilities or PCtools or a similar package he should get it. They contain several tools which will easily restore deleted files, as long as they have not yet been overwritten by subseqauent disk writing.
dchun@aludra.usc.edu (Dale Chun) (10/26/89)
I would recommend getting a copy of Mace Utilites. I have found this program to have the most idiot-proof undelete utility on the market today. Check it out. Dale
carlson@gateway.mitre.org (Bruce Carlson) (10/26/89)
In article <36440001@hpindwa.HP.COM> owenc@hpindwa.HP.COM (Owen Cheung) writes: > >A friend of mine accidentially deleted some important files from his floppy. >Does anybody know any way of recovering these files? I don't know how the >MS-DOS file system works, but some of the other file systems that I know >only marks a bit in the directory when a file is deleted. Thus, if someone >knows how the file directory is structured, it would be very easy to >reset that bit and recover that file. Does the MS-DOS file system works >the same way? Does anybody know any public domain or commercial programs >that can recover deleted files? Any help is appreciated. > > >Owen DOS changes the first letter of the file name to a special character and marks the file's space as available. I think the special character is hex E5. If you haven't written to the disk since the erasure all the data will still be there, but you have to do a little work to recover it. Norton Utilities has a file unerase program and there are several other commercial programs that offer this feature. I also recall seeing a public domain program of this type, but I don't remember its name. If you want to play around with DOS DEBUG you might be able to figure out how to recover a file. Use diskcopy to make an exact copy of the erased disk and then see what you can do about getting the file back. Peter Norton's book Programmer's Guide to the IBM PC provides a brief explanation of how files are stored and what happens when they are erased. Bruce Carlson
dougm@palomar.SanDiego.NCR.COM (Doug Marshall) (10/26/89)
In article <36440001@hpindwa.HP.COM> owenc@hpindwa.HP.COM (Owen Cheung) writes: > >A friend of mine accidentially deleted some important files from his floppy. >Does anybody know any way of recovering these files? I don't know how the Try Norton Utilities. >MS-DOS file system works, but some of the other file systems that I know >only marks a bit in the directory when a file is deleted. Thus, if someone As I understand it, DOS simply makes the first character of the file name a question mark. If you don't have NU or some other commericial product, I think that there are 'track' editors in PD that you could use to change the first letter of the filename from a question mark to a letter. ---- Doug Marshall <Doug.Marshall@SanDiego.NCR.COM> +1 619 485 3494 <...!ncr-sd!palomar!dougm> "All of us is smarter than each of us!"
unkydave@shumv1.uucp (David Bank) (10/27/89)
In article <36440001@hpindwa.HP.COM> owenc@hpindwa.HP.COM (Owen Cheung) writes: > >A friend of mine accidentially deleted some important files from his floppy. >Does anybody know any way of recovering these files? I don't know how the >MS-DOS file system works, but some of the other file systems that I know >only marks a bit in the directory when a file is deleted. Thus, if someone >knows how the file directory is structured, it would be very easy to >reset that bit and recover that file. Does the MS-DOS file system works >the same way? Does anybody know any public domain or commercial programs >that can recover deleted files? Any help is appreciated. > > >Owen Relax. Help is as near as your corner software store. First things first. Slap a write-protect on that floppy until you get the recover software. Whatever you do, DO NOT write to it. Now, the following info comes straight from IBM's DOS Technical Reference Manual: All directory entries are 32 bytes long and have the following format: BYTES 0-7 - Represent the filename. The first byte indicates the status of the file, as delineated below 00h - Filename that is never used for performance reasons (limits the length of directory searches) 05h - Indicates that the first character of the filename actually has the E5h character E5h - The filename was used, but has been erased (aha!) 2Eh - The entry is for a directory. If the second byte is 2Eh, the cluster field contains the cluster # of the parent directory (0h if the parent directory is the root) Any other character - First byte of a filename BYTES 8-10 Indicate the filename extension. BYTE 11 - File attribute byte. You don't want me to Post all that info BYTES 12-21 - RESERVED FOR DOS (We're using it, but we won't tell you what for) BYTES 22-23 - Time and date of creation Now, when you tell DOS to "Erase" or "Delete" a file, it does not (as you know) actually destroy the data in the file. Instead, it changes the first character of the filename to E5 (hex) which tells DOS the file is deleted. It also marks the space in the FAT as unallocated and available for use. How do you recover this?? Well, NORTON UTILITIES offers several file recover tools in just about every version he's put out. PCTools does so as well. And I understand that Paul Mace puts in his $0.02. DOS's RECOVER.COM allegedly can recover deleted files, but I wouldn't trust it as far as I could throw a transfer truck. Use something you know'll work and not that pathetic utility. PC Magazine's DOS Powertools also offers an undelete utility. And I;d be surprised if there aren't a few out there in the public domain that work just as well. The biggest thing is that you not write to that disk AT ALL until you have recovered those files. Any writing you do can and will destroy data that was "erased" Slap a write-protect on that puppy, hurry down to your local dealer, grab Norton or PCTools or Paul Mace or DOS Powertools and scurry on back, read the instructions, and recover those files. The data's there if you haven't overwritten it. Oh, yeah...make some backups. :-) <GRIN> Ooopps...almost forgot. Run back down to the store and pay them and explain why you left in such a rush with their software package........ <BIG GRIN> Unky Dave unkydave@shumv1.ncsu.edu