Recovering deleted files. (using DOS 6.0's Delete Sentry) (Introdos) (Column)
by Tony Roberts

One of DOS 6's best features is the expanded functionality of the Undelete command. The new Delete Sentry feature makes recovering deleted files as close to a sure thing as possible.

Before we discuss how to undelete files with Delete Sentry, it's helpful to know what actually happens when you issue the command to erase a file. First, the initial character of the filename in the File Allocation Table FAT) is changed to a special character that signals DOS that the file has been deleted. Second, a series of pointers that describe the file's position on the disk are zeroed out. This tells DOS that the clusters occupied by the file are now available for other use.

Immediately after a file has been deleted, most of the filename, as well as all of the file's data, remains intact on the disk. Another data tidbit that isn't affected by the deletion is the FAT reference to the file's size and starting cluster number.

With these bits of information, you can recover a deleted file--as long as you haven't overwritten the disk clusters occupied by the file.

At its basic level, this is how Undelete works: It scans the FAT for a file that's been marked as deleted, it shows you the filename with the missing first letter and asks you to fill that in, and then it goes to the starting cluster and locates an amount of data that corresponds to the file's size. This works well if the undelete procedure occurs immediately after the deletion and if the deleted file wasn't scattered all over the disk.

A step up from basic undelete protection is Delete Tracker, a version of which first became available in DOS 5. Every time Delete Tracker is activated (usually through a command in your AUTOEXEC. BAT file), the system makes a snapshot of your disk's FAT. This procedure makes deleting a file a little less risky. That picture of the FAT gives the Undelete command full information about the characteristics of your file as of the last boot-up. This information includes the first letter of the filename plus a list of every cluster that was occupied by the file. Even if the file was strewn all over the disk, Undelete can recover it if the clusters haven't since been occupied by another file.

The new feature in DOS 6--Delete Sentry--makes undeleting almost foolproof. Under this system, deleted files are not actually deleted but are moved to a hidden subdirectory on your disk where they remain fully intact. When you need to undelete a file, DOS simply moves it back to its original directory.

As effective as this protection is, it too is only transient. Deleted files don't stay in the hidden subdirectory forever, so it's always best to recover deleted files as soon as possible after the deletion. When you configure Delete Sentry, you decide how much disk space it can use, how soon to purge files from the hidden directory, and which files should be protected.

For example, on my 200MB hard disk, I allow Delete Sentry 5 percent, or 10MB, of space. Once I've deleted more than 10MB of files, Delete entry starts deleting the oldest files in its holding area to make room for the new deletions. Also, I set Delete Sentry to purge files that have been on hold over seven days. Finally, I've configured Delete Sentry not to save files with extensions such as TMP, BAK, and the like.

There are a couple of ways that you can configure Delete Sentry. If you're running Windows, run Undelete and select Options, Configure Delete Protection, Delete Sentry. Enter your preferences into the resulting dialog box. Alternatively, you can edit the UNDELETE. INI file directly. This file is in the same directory as UNDELETE.EXE unless you've set the environment variable MSDOSDATA to point to a different subdirectory.

The entries in UNDELETE. INI are straightforward. For more information, type help undelete at the DOS prompt to get a full rundown on configuration options. If you use Delete Sentry, be aware of how the program uses disk space. Although it can use up to several megabytes of disk real estate, Delete Sentry tells programs. such as the DOS Dir command and File Manager that the space is available. You have to use Chkdsk to see the true amount of unused disk space.

Delete Sentry is programmed to give back the space it's using if this suddenly becomes necessary. If one of your other programs creates some huge data files that demand the space, Delete Sentry gives it up physically deleting the files it's been holding, starting with the oldest. The freed clusters are then overwritten with the new data, making a recovery of the original file impossible.

Delete Sentry provides a terrific insurance policy against accidental deletion of important files, but be careful not to rely too heavily on this protection, especially if your system is chronically low on disk space. The best procedure to follow is to make regular backups of important files. That way, you can restore those files if Delete Sentry can't.