Path: utzoo!utgpu!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!rutgers!njin!princeton!phoenix!pucc!PKNIGHT From: PKNIGHT@pucc.Princeton.EDU (Paul Knight) Newsgroups: comp.os.cpm Subject: Recovering Erased CP/M Files Message-ID: <6675@pucc.Princeton.EDU> Date: 8 Dec 88 22:45:19 GMT Reply-To: PKNIGHT@pucc.Princeton.EDU Organization: Princeton University, NJ Lines: 55 Disclaimer: Author bears full responsibility for contents of this article A couple of weeks ago, I posted a request for information on how to recover CP/M files that had been erased. I asked that responses be mailed to me and said I would post a summary to the group. I learned everything I needed to know to accomplish the recovery, and I gratefully acknowledge the help of the several NETNEWS readers who responded to my request. The following message from Dave Goodman (dgee@cup.portal.com) was the most comprehensive reply, so I post it here by way of summarizing the contributions of everyone who responded. *Yes, erased cp/m files can be recovered *provided* the disk has not *been written to since the erasure took place. * *When a file is erased, there is no physical erasure of the disk space *used by the file. All that happens is the directory entry(ies) for that *file are marked as erased, with an 0e5h (0xe5 [or E5H], if you prefer) *in the first (user) field of the directory entry. * *Of course, the disk space used by the file is now marked as free, so if *a subsequent write to the disk is done, the space will be reused and *the old file will probably be physically overwritten. * *Provided the disk has not been written to since the erasure, there are *two methods of recovering the file. * * 1) There is a public domain utility, found on many cp/m bulletin boards, * called UNERA.COM or UNERASE.COM. Do A>UNERA fname.typ and the file * will reappear in user area 0. * * 2) Alternatively, if your user has a disk editor such as DU.COM or one * of its many variants, you can look at the actual directory entry(ies) * on the disk, and change the 0e5h which marks the entry as erased to * some other plausible value. For example, just change the 0e5h to * 00h, and the file will reappear in user area 0. * *I realize that the above is a bit abstruse if you're not used to dealing *with the guts of cp/m. If you need more detailed information, feel free *to e-mail. Just about the only thing Dave didn't mention was the possibility of multiple directory entries, to which I was alerted by Bob Bailey, among others: * Note: If the file(s) were long, there will be multiple * directory entries. All of the E5Hs must be changed to * 00H on the lines containing the file names. Actually, * I should say only change the E5H at the beginning of * each line! Again, thanks to all. - Paul Knight