Path: utzoo!utgpu!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!rutgers!njin!princeton!phoenix!pucc!PKNIGHT
From: PKNIGHT@pucc.Princeton.EDU (Paul Knight)
Newsgroups: comp.os.cpm
Subject: Recovering Erased CP/M Files
Message-ID: <6675@pucc.Princeton.EDU>
Date: 8 Dec 88 22:45:19 GMT
Reply-To: PKNIGHT@pucc.Princeton.EDU
Organization: Princeton University, NJ
Lines: 55
Disclaimer: Author bears full responsibility for contents of this article

A couple of weeks ago, I posted a request for information on how to
recover CP/M files that had been erased.  I asked that responses be
mailed to me and said I would post a summary to the group.
 
I learned everything I needed to know to accomplish the recovery, and
I gratefully acknowledge the help of the several NETNEWS readers who
responded to my request.
 
The following message from Dave Goodman (dgee@cup.portal.com) was the
most comprehensive reply, so I post it here by way of summarizing the
contributions of everyone who responded.
 
*Yes, erased cp/m files can be recovered *provided* the disk has not
*been written to since the erasure took place.
*
*When a file is erased, there is no physical erasure of the disk space
*used by the file.  All that happens is the directory entry(ies) for that
*file are marked as erased, with an 0e5h (0xe5 [or E5H], if you prefer)
*in the first (user) field of the directory entry.
*
*Of course, the disk space used by the file is now marked as free, so if
*a subsequent write to the disk is done, the space will be reused and
*the old file will probably be physically overwritten.
*
*Provided the disk has not been written to since the erasure, there are
*two methods of recovering the file.
*
*  1) There is a public domain utility, found on many cp/m bulletin boards,
*     called UNERA.COM or UNERASE.COM.  Do  A>UNERA fname.typ  and the file
*     will reappear in user area 0.
*
*  2) Alternatively, if your user has a disk editor such as DU.COM or one
*     of its many variants, you can look at the actual directory entry(ies)
*     on the disk, and change the 0e5h which marks the entry as erased to
*     some other plausible value.  For example, just change the 0e5h to
*     00h, and the file will reappear in user area 0.
*
*I realize that the above is a bit abstruse if you're not used to dealing
*with the guts of cp/m.  If you need more detailed information, feel free
*to e-mail.
 
 
Just about the only thing Dave didn't mention was the possibility of
multiple directory entries, to which I was alerted by Bob Bailey
, among others:
 
*    Note: If the file(s) were long, there will be multiple
*    directory entries.  All of the E5Hs must be changed to
*    00H on the lines containing the file names.  Actually,
*    I should say only change the E5H at the beginning of
*    each line!
 
Again, thanks to all.
 
                                   - Paul Knight