Back from the dead. (file recovery using MS-DOS) (Column)
by Tony Roberts

The latest versions of DOS--MS-DOS 5.0 and DR DOS 6.0--include utilities that help you recover accidentally deleted files. It's a relief to have this insurance on hand, but to use this software most efficiently, you have to do a little pre-delete preparation.

To get the most out of the file-recovery utilities, it helps to know a little about how DOS stores and deletes files. DOS keeps track of each of its files through a directory entry and a table called the File Allocation Table (FAT). The directory entry includes the file's name, size, and starting cluster number. When a file is opened, the system checks the directory for the filename and the starting cluster number. It then uses the data in the FAT to locate the file's subsequent clusters.

Disk files are usually stored in sequential sectors. Other times, particularly on a cownded disk or one on which files are constantly being added and deleted, disk files are scattered around, filling in the nooks and crannies of unused space. The FAT's job is to keep track of the links to all of those scattered sections so that the entire chain can be recalled when the file is opened.

When a file is deleted, the FAT entry that points to it is changed, but the file's data is untouched. The space occupied by the file is made available to the system for reuse. Therefore, it's possible to recover a deleted file by reconstructing its FAT entry and reclaiming the file's disk space. This operation can only be successful, though, if the file is recovered before new information is written to the disk in the areas previously occupied by the deleted file.

So how do the new undelete utilities help? First, both MS-DOS and DR DOS now include the UNDELETE command. At its very basic level, UNDELETE can use a deleted file's directory entry to recover all or part of the file. UNDELETE stands a better chance of making the recovery if the file isn't fragmented or saved in more than one spot on the disk.

The best time to do something about a mistakenly deleted file is immediately after the deletion. Any operation that writes to the disk reduces the chances of your being able to recover a file completely.

UNDELETE is your first level of protection. Even if you take no additional steps to protect yourself, UNDELETE will bail you out of some mistakes.

Both MS-DOS 5.0 and DR DOS 6.0, however, offer additional tools that can make UNDELETE work better and more reliably. MS-DOS has the MIRROR command, and DR DOS has a similar utility called DISKMAP. These utilities take a snapshot of the disk's FAT and set it aside for safekeeping.

When you delete a file, changes are made to the disk's active FAT, but the backup copy of the FAT that was made with MIRROR or DISKMAP is unchanged. If you need the deleted file back, UNDELETE can use MIRROR's or DISKMAP's information to reconstruct the file's chain of clusters and increase the likelihood of a full recovery.

If you use the MIRROR or DISKMAP commands regularly, you give UNDELETE a better chance to succeed. Include the appropriate command in you AUTOEXEC.BAT file, and you'll always have a fairly current backup version of the FAT handy.

Although using MIRROR or DISKMAP along with UNDELETE provides more protection than has been available with any previous version of DOS, DR DOS offers an even more foolproof safeguard against deleted files --DELWATCH.

If DELWATCH is running, the DEL command doesn;t actually erase files; it only marks them for deletion. The filename is removed from the visible directory listing, but the file continues to exist and continues to occupy allocated disk space.

DELWATCH, which is a memory-resident utility that runs in the background, keeps track of a specified number of deleted files (200 is the default). Once that limit is reached or the disk becomes full, DELWATCH performs an actual deletion of the oldest file in its pending delete list.

With DELWATCH operating, your chances of recovering a deleted file are almost 100 percent--even if you've saved other data to the disk. The security of DELWATCH comes at a cost, though. First, it occupies memory, and second, the files in the pending delete list still occupy disk space.

As you may have discovered, it's easy to make a mistake and delete the wrong file. If you're using one of the new DOS versions or if you have other undelete utilities, take a few minutes to learn how to recover from a mistake.

Keep in mind, though, that the ability to retrieve accidentally deleted files is no substitute for keeping current backups of your data. also, because undelete utilities cannot always recover an entire file, they aren't too helpful at recovering deleted program file, should be able to restore program files from your original disks or their backups.

But even a partial recovery of a data file can be useful. Wouldn't you rather have 18 pages of your 20-page report than nothing at all?