Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.2 9/18/84; site timeinc.UUCP
Path: utzoo!watmath!clyde!burl!ulysses!mhuxr!mhuxt!houxm!mtuxo!mtunh!mtung!mtunf!ariel!vax135!timeinc!dwight
From: dwight@timeinc.UUCP (Dwight Ernest)
Newsgroups: net.micro.pc
Subject: Re: Norton utilities question
Message-ID: <296@timeinc.UUCP>
Date: Fri, 12-Jul-85 12:01:16 EDT
Article-I.D.: timeinc.296
Posted: Fri Jul 12 12:01:16 1985
Date-Received: Sat, 13-Jul-85 12:56:05 EDT
References: <5507@tekecs.UUCP>
Reply-To: dwight@timeinc.UUCP (Dwight Ernest)
Distribution: net
Organization: Time, Inc. - New York
Lines: 46
Summary: 


Yes, there are utilities available from Norton that do permit one
to recover deleted files under PC DOS. Under the original Norton 
release, this utility was called UNERASE; under the current release,
it's combined in with several other Norton utilities in a large program
called NU. I have seen several programs that are in the public domain
that purport to be able to do this as well, but I cannot remember their
names, nor can I assist you in finding them.

How do they work, you ask, and what are our experiences with recovering
deleted files?

First, it's important to understand that under PC DOS, as under CP/M,
when you delete a file, its contents are not erased; the FAB (file access
block) is simply modified (usually in only a few bytes) to indicate that
the space that used to be reserved for the file on the medium is now
available in the free list. One of the bytes in the PC DOS FAB that
gets changed is the first character of the filename; I think it's
simply nulled-over (a zero is written in its place). When using
UNERASE or NU, the user is presented with a list of these files, with
the missing first character; he/she chooses one, and the program attempts
to determine its chances of recovering all of the data of the original
file. This recovery is, of course, not possible, if the area on the
medium that had been in use by the original file had been remapped to
some other data. That's what the program does--it compares the original
file's allocation of space with the allocation of space of the current
occupants of the FAB (or FABs), and if some other file has already taken
some of the space, it tells you that you may only be able to get a
partial recovery, and allows you the option of continuing or not. If you
proceed with the partial, the Norton utility permits you to dump each
sector of the original allocation in order to determine for yourself
whether you want to include it in the recovered file or not.

Hope this answers your questions. In summary, if you want to recover
a deleted file, your chances are best if you recover immediately after
your mistaken deletion; as you write to the medium, your chances are
significantly lowered over time.
-- 
-----------------------------------------------------------------------------
		--Dwight Ernest	KA2CNN	\ Usenet:...vax135!timeinc!dwight
		  Time Inc. Edit./Prod. Tech. Grp., New York City
		  Voice: (212) 554-5061 \ Compuserve: 70210,523
		  Telemail: DERNEST/TIMECOMDIV/TIMEINC \ MCI: DERNEST
"The opinions expressed above are those of the writer and do not necessarily
 reflect the opinions of Time Incorporated."
-----------------------------------------------------------------------------