PDA

View Full Version : Deleted Files



12-12-2001, 03:49 PM
If a file is 'deleted', it was my understanding that it is only marked in a special way so as not to be seen rather than actually deleted. When the disk requires more space then those files that are marked in this way are used for additional space.
If I am correct, is it possible to recover those 'deleted' files?

12-12-2001, 04:44 PM
This used to wwork, up to a point in DOS. What happened in dos was that the first character of the filename in the directory was replaced with an illegal character (Greek lowercase delta?).

That made the file invisible, and the FAT cluster chain was left alone, and the directory entry still pointed at the starting cluster.

IF the system had not reused any of the clusters of the dleted file, it could be recovered by changing the first character back.

Norton's NU had an undelete function, which worked; there were a lot of shareware and freeware progs which did it too. Sometimes the 'chance of recovery' was given as 'none'. If you had defragged the disk, or written a lot of files, it was all over.

Windows copied the Apple Mac trash bin idea, which actually protects the file, by not deleting it, just moving it. When it is removed from the recycle folder, it is gone.

With the amount of disk busyness of the new OS's, I suspect that there is not much chance if the files have been zapped out of the recycle bin.

Of course, 'you can do anything with software', and it is just *possible* to treat a whole disk as one data file, and search for clusters containing text, then edit them to recover (at least parts of) a lost text file. I don't think it would be a quick process with a 20GB disk ... and a binary file would be rather difficult.

12-12-2001, 09:58 PM
It is somewhat possible to recover the old files, but can be quite expensive. There are programs such as 'Final Data' which is a file recovery program which can recover all sorts of deleted/lost/destroyed/formatted stuff. There is a demo which can be downloaded which can find three files per session (exit and restart for each new session)... I recovered about 500mb using this after I had a problem switching between FAT16 and FAT32... took HOURS but got everything that was vital :)
however the full-version is quite expensive, and for a once off, if its absolutely vital data, it may be more worth your while to visit Computer Forensics than try to recover the files yourself.

12-12-2001, 11:35 PM
If you know anyone who has Norton Utilities, it contains a file called unerase.exe which is a stand alone DOS program of 600kb, with an accompanying Help file.
If you have an OS which can boot to DOS, unerase.exe can be run from a floppy and will recover files on the HD.

13-12-2001, 02:07 AM
Good old windows 3.11 came with a program called undelete and it was very handy. It is a pity it did not make the move to win95. What ever happened to 3.11 anyway?

13-12-2001, 09:18 AM
The answer is yes it is possible... up to a point.

I believe now what happens is when a file is ultimately deleted from your hard drive, the FAT entry is deleted, but until the disk space is needed again, the actual binaryh pattern is still resident on the disk.

To recover files, all you need to know is the exact location on the harddrive that the file was stored, and using a program called debug, you can retrieve the binary pattern stored at that particular location.

Simple in theory, but not very practical for real usage unfortunately.