Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Posting-Version: version B 2.10.2 9/18/84; site timeinc.UUCP Path: utzoo!watmath!clyde!burl!ulysses!mhuxr!mhuxt!houxm!mtuxo!mtunh!mtung!mtunf!ariel!vax135!timeinc!dwight From: dwight@timeinc.UUCP (Dwight Ernest) Newsgroups: net.micro.pc Subject: Re: Norton utilities question Message-ID: <296@timeinc.UUCP> Date: Fri, 12-Jul-85 12:01:16 EDT Article-I.D.: timeinc.296 Posted: Fri Jul 12 12:01:16 1985 Date-Received: Sat, 13-Jul-85 12:56:05 EDT References: <5507@tekecs.UUCP> Reply-To: dwight@timeinc.UUCP (Dwight Ernest) Distribution: net Organization: Time, Inc. - New York Lines: 46 Summary: Yes, there are utilities available from Norton that do permit one to recover deleted files under PC DOS. Under the original Norton release, this utility was called UNERASE; under the current release, it's combined in with several other Norton utilities in a large program called NU. I have seen several programs that are in the public domain that purport to be able to do this as well, but I cannot remember their names, nor can I assist you in finding them. How do they work, you ask, and what are our experiences with recovering deleted files? First, it's important to understand that under PC DOS, as under CP/M, when you delete a file, its contents are not erased; the FAB (file access block) is simply modified (usually in only a few bytes) to indicate that the space that used to be reserved for the file on the medium is now available in the free list. One of the bytes in the PC DOS FAB that gets changed is the first character of the filename; I think it's simply nulled-over (a zero is written in its place). When using UNERASE or NU, the user is presented with a list of these files, with the missing first character; he/she chooses one, and the program attempts to determine its chances of recovering all of the data of the original file. This recovery is, of course, not possible, if the area on the medium that had been in use by the original file had been remapped to some other data. That's what the program does--it compares the original file's allocation of space with the allocation of space of the current occupants of the FAB (or FABs), and if some other file has already taken some of the space, it tells you that you may only be able to get a partial recovery, and allows you the option of continuing or not. If you proceed with the partial, the Norton utility permits you to dump each sector of the original allocation in order to determine for yourself whether you want to include it in the recovered file or not. Hope this answers your questions. In summary, if you want to recover a deleted file, your chances are best if you recover immediately after your mistaken deletion; as you write to the medium, your chances are significantly lowered over time. -- ----------------------------------------------------------------------------- --Dwight Ernest KA2CNN \ Usenet:...vax135!timeinc!dwight Time Inc. Edit./Prod. Tech. Grp., New York City Voice: (212) 554-5061 \ Compuserve: 70210,523 Telemail: DERNEST/TIMECOMDIV/TIMEINC \ MCI: DERNEST "The opinions expressed above are those of the writer and do not necessarily reflect the opinions of Time Incorporated." -----------------------------------------------------------------------------