File Recovery Using DOS Undelete



Contributed by Andrew Whitehead

First Steps in DOS File Recovery

The first three steps in file recovery are quite easy and require no specific knowledge:-

1)Don't panic! Your information is still there, and safe.

2)Don't touch the keyboard! Your information is safe...until your operating system writes over it.

3)Don't switch off! A lot of temporary files are created during start up, and you don't want them to be created over the top of your accidentally deleted files.

File Recovery Levels in DOS

Later versions of DOS (DOS 5.* and onwards) have three possible levels of file recovery, Delete Sentry, Delete Tracker, and the basic Undelete.

Delete Sentry offers the highest degree of protection, and works in a similar fashion to Recycle Bin in that it keeps copies of all your deleted files in a hidden file. This protects them from being overwritten and more or less guarantees file recovery will be possible. The down side is that the file can end up being huge. In DOS 5 the maximum size is 7% of your hard drive capacity, in DOS 6 it can go to 20%!

Those values can be changed by fiddling with UNDELETE.INI but it is quite a tedious job, as is the purging routine to get rid of all those files permanently.

The next level of file recovery is Delete Tracking, which stores the location of deleted files in a file called PCTRACKR.DEL. This uses less disk space, but the price you pay is that the stored locations may be overwritten if you don't act promptly, and then your files will be impossible to recover.

The third level of file recovery is the standard UNDELETE method. This is the one where DOS brings back a list of your deleted files, all with the first letter of their names replaced by #. It then asks you to supply the missing first letter. Fortunately it doesn't matter if you can't remember it, just type any letter at random and DOS will go ahead and tell you that your file has been successfully recovered, even if it does have some unpronounceable name.

Using DOS File Recovery

In theory, to use DOS file recovery all that is required is for you to type in 'UNDELETE' at the DOS prompt, but when you do don't be too surprised if nothing happens or your efforts are rewarded by nothing more than a reply saying something like '38 files can be recovered', but with none of the promised file recovery actually taking place.

If this happens, it is because you have those three levels of file recovery to choose from. The level of file recovery protection is configured by editing the AUTOEXEC.BAT file so only one level can be enabled at a time, and the UNDELETE command requires the relevant switch to run it.

Luckily this is not as horribly complex as it sounds; the UNDELETE switches are fairly simple. If you have the basic level enabled, just use UNDELETE with no switch. If you have specified Delete Tracker the switch is /DT, and logically enough for Delete Sentry it is /DS.

Andrew Whitehead is a contributor at Free-backup.info -- the home of the popular Amazon S3 based tool for online file backup -- Back2zip. This article can be found at http://free-backup.info/file-recovery-using-dos-undelete.html



very      not
 
Did you find this article helpful? 36 other readers gave it an average usefulness of 56.7%.
Tell us what you think!!

Some Other Contributions by Andrew Whitehead

A Trip into the World of Computer Forensics (2005-08-08)  »

Computer forensics is the investigation and analysis of a suspects computer, to uncover evidence of a crime. For instance, theft of trade secrets, theft or destruction of intellectual property, or fraud.

Advantages and Problems with Online Backup Systems (2005-08-08)  »

Having an online backup system will save your day should your premises ever burn down, or the fireproof box containing your backup disks get stolen. The easiest means of backing up online is to set up a leased line to a remote server, and transfer da...

Alternate Site Disaster Recovery (2005-08-08)  »

In considering alternate site disaster recovery, the two main issues are the reconfiguring or rebuilding infrastructure, and moving data between the primary site and the alternate site.

Backup Software for Larger Systems (2005-08-08)  »

For a systems administrator, one of his most important roles is backing up, and being able to restore, the organizations data. When he chooses his backup software, to ensure that they meet his requirements he must evaluate the product's backup featur...

Backup Software Functions (2005-08-08)  »

It's probably true to say that most backup software applications available will do a reasonable job of making a backup. That does not mean that all backup software is created equal, and choosing the one that suits your requirements is worth spending ...

Backup to CD (2005-08-08)  »

If you have ever wondered about the importance of keeping a backup, imagine how you would feel if a virus destroyed the contents of your hard drive? Or a problem could only be solved by using a system recovery CD, wiping out all your data in the proc...

Basic Data Recovery (2005-08-07)  »

Have you ever wondered how much data is stored in your PC, and how much time and energy would go into its recovery? Your computer almost certainly contains a lot of personal data - financial data, names, addresses, and telephone numbers, bank account...

Brief Overview of Online Backup (2005-08-07)  »

Online backup is possibly the most convenient form of backing up files, leaving you with few excuses not to do it. Losing your files is something that is going to happen to you one day, not something that might happen, and if you do not backup your d...

Choosing Backup Media (2005-08-07)  »

Matching the capacity of the backup medium to the amount of data you intend to backup is very important, especially as hard disks capacities grow. The more disk or tape swaps required to perform a backup, the less likely it is that you will do it rou...

Computer Forensic: Siezing the Evidence (2005-08-07)  »

The computer forensic experts have to conform with many rules and regulations if the evidence they uncover is to be acceptable to the courts. The first step in obtaining computer forensic evidence is obtaining a search warrant to seize the suspect sy...