Hi, as George Bell was looking for a file tonight (luckily, he found it back without my help), I have played with undelete a bit. I have used the LINUX version of it. This means that you must give it a fake drive spec "x:" for output files and that it uses test.img (fixed file name) as source "drive". Otherwise, it works like the DOS version (the DOS version uses the current drive as input, output files must be on ANOTHER drive or undelete will refuse to write to them!). By the way, undelete refuses to overwrite existing files (gives a "write error") ! In general, it is a good idea to backup a partition to an image before you try to fiddle with it. Then, either fiddle with the partition or with the image, not both. Of course you need to have enough space. I could have used: dd if=/dev/fd0 of=test.img to image the floppy in drive A:, but I was lazy and used an old FreeDOS install disk image full.bin file :-). You could also symlink /dev/fd0 to test.img instead of copying it, but this would violate the principle of never fiddling with the original without having a copy. Of course, my UNDELETE currently never writes to test.img, nor to the current partition in the DOS version, but future versions may not have that property. Next, I do: ./undelete.elf follow 2 x:data.bin 2850 Undelete follow automatically skips over used clusters. I tell it to save up to 2850 clusters (more than a floppy contains) starting from cluster 2 (the first cluster that DOS can use) to data.bin ... Data.bin happens to be 999k big, so there are indeed lots of free space on that floppy. I run strings to extract the text from that (I could use an hex editor to find and extract interesting hex data as well, but for the example, I only search for text): strings < data.bin > data.txt I read data.txt (only 3k now! Most of the empty clusters were really empty and never used before...) and see that it contains what looks like a batch file and then what looks like a readme. I cut and paste the parts to data1.bat and data2.txt therefore. Note that I CANNOT recover partially overwritten clusters with undelete in the current version, as undelete automatically skips over used clusters. Tell me if you want me to add a mode for following used cluster chains as well. You can, however, edit the size of a file with a disk editor to cluster size * N - 1 to extend a file to the full cluster and see the end of the cluster. Or you can deliberately delete the file and then undelete it again, with the bigger size. Be careful to have a backup when doing so. Okay, back to the main topic. Next I do this: ./undelete.elf dirsave / x:root-dirsave.bin 0 > root-dirsave.txt IMPORTANT: I needed to give a length of 0 to select "autodetect", otherwise length will default to 1 sector for dirsave and 1 cluster for follow mode!!! The default length is useful at least in one case: When you have several single-cluster files, you do not need to enable autodetect nor to select a length by hand. Call it a bug or call it a feature. The file root-dirsave.txt looks like this (without the > ..., you would see the same stuff on the screen. You can also use | more instead of > logfile): Drive A: info: maxsecinclust=0 shlclusttosec=0 numressec=1, fats=2, rootdirents=224 firstdatasec=33 maxclustnum=2848, secperfat=9 Dirsave: selected root directory DIRSAVE starting with sector 19, cluster 0 Saving DIR until EOF or count reached... FREEDOSB.7FL 20:44:56 07.09.2001 @00000, size 0000000000 label KERNEL .SYS 20:12:04 03.09.2001 @00002, size 0000075663 ro sys COMMAND .COM 01:58:14 15.08.2001 @00150, size 0000086561 ro ... INST .BAT 20:00:04 07.09.2001 @00850, size 0000002244 ... PART .INI 17:33:32 08.07.2001 @00632, size 0000021217 UnDelAble: ?EAD .ME 13:11:46 19.08.2001 @00674, size 0000000819 SYS .COM 21:54:18 20.08.2001 @00676, size 0000008634 ... NLS . 17:14:20 19.08.2001 @00783, size 0000000000 dir Del/Lost: ?ETA7 .TXT 20:17:48 07.09.2001 @00855, size 0000000824 a READ .ME 20:23:04 07.09.2001 @00855, size 0000000819 Seems to be EOF You have to add 1 to the maxsecinclust to know the number of clusters - uhm - sectors per cluster. It is 1 in this example, meaning 512 byte per cluster. So the deleted ?ead.me file is 2 clusters big, starting from cluster 674. And there is a ?eta7.txt which I cannot undelete because read.me uses the same clusters (855 and following). I could, however, use the above trick to recover 824 - 819 = 5 bytes of the end of ?eta7.txt ... To recover ?ead.me, I do: ./undelete.elf follow 674 x:readme.undelete Do I ? NO. I must select 0 to force autodetect or 2 as the manually selected size of the file! Otherwise I would only get the first cluster!!! So I do: ./undelete.elf follow 674 x:read2.me 2 Drive A: info: maxsecinclust=0 shlclusttosec=0 numressec=1, fats=2, rootdirents=224 firstdatasec=33 maxclustnum=2848, secperfat=9 Following FAT chain until EOF or count reached... Reading from empty areas according to FAT 674->NIL/675->NIL/.............................................................. ................................................................................ .................... Done The file read2.me contains some garbage (00 chars) at the end, because it was only 674 bytes and undelete recovered 2 clusters of 512 bytes each. You can fix this with an editor if you want. I use mount -o loop test.img /somewhere to copy the current versions of inst.bat and read.me, for later comparison. I could have used mcopy for a real floppy (no image) or cp for a mounted partition... > diff -a read.me read2.me 10c10 < the subdirectories) to a directory FDBETA7 on your hard --- > the subdirectories) to a directory FDBETA6 on your hard 12c12 < SET NLSPATH=C:\FDBETA7\NLS --- > SET NLSPATH=C:\FDBETA6\NLS 24a25 > \ No newline at end of file Looks as if I have found some old version of read.me! By the way, using wdiff -3 data2.txt read2.me tells me that no words (only whitespace) differ between data2.txt and read2.me, so I have recovered the same data in two different ways. This was the only undeleteable file, but the show goes on! In data.txt I had found a chunk that I have called data1.bat, but for which I could not find any directory entry. Probably the directory entry got overwritten. You would be lost with a normal undelete here. But my undelete found the data, so let us compare it to inst.bat (educated guess :-)): wdiff -3 -c data1.bat inst.bat ====================================================================== REM This batch file require FreeCOM to work correctly. {+REM This batch also makes use of character 255 (nonspace blank) CLS+} ====================================================================== ECHO [-Ripcord Beta06 H10 distribution-] {+FreeDOS Beta 7 ("SPEARS") Distributio ECHO [-.-] {++} ECHO If you have not already created a DOS partition [-ECHO-] then you should {+ECHO run+} FDISK now, otherwise you may [-ECHO-] omit this step. ECHO [-.-] {++} Follow the on-screen prompts to create a new [-ECHO .-] primary partition {+ECHO +} and mark it as active. [-ECHO .-] After running FDISK you will need to reboot. ECHO [-.-] {++} Just boot off the install boot floppy again, [-ECHO . then-] {+&+} select no this prompt. ====================================================================== ? FDISK {+REM We CLS here since if the person ran FDISK but didn't change REM anything, then the screen is cleared but the cursor is midway down. CLS+} ECHO [-.-] {+FreeDOS Installation ECHO FreeDOS Beta 7 ("SPEARS") Distribution ECHO +} ECHO If you just created a new partition for FreeDOS [-ECHO-] then you must FORMAT {+ECHO+} it now. You may also format [-ECHO-] the partition if you wish to wipe it clean. ECHO WARNING: All data on your C: drive will be lost, [-ECHO .-] so only select YES {+ECHO +} if you are sure. {+(You must also type 'Y' at Format's prom pt) ====================================================================== ECHO [-.-] {++} ECHO You now need to make the drive bootable (that is [-ECHO-] copy the KERNEL and {+ECHO+} COMMAND to it along with [-ECHO-] setting up the boot record). ====================================================================== ECHO [-.-] {+ pause+} ====================================================================== REM ... {+CLS+} ECHO To finish the installation (install the included programs) [-ECHO-] run the {+ECHO+} Install progam, ie type: ECHO {++} INSTALL ====================================================================== ECHO [-.-] {++} ====================================================================== ECHO [-.-] {++} Yes, seems that we have found another version of inst.bat! I hope I could clarify the use of my UNDELETE by those examples. I will add this mail to undelete-helpstuff. Undelete, with sources, DOS and Linux version, can be found at: http://www.coli.uni-saarland.de/~eric/stuff/soft/ Note that UNDELETE accepts both / and \ as directory slash, as you can see in the way I dirsave above. You can also dirsave a nameless deleted (!) directory by giving its cluster number. If you dirsave a directory with a name, the name must start with / or \ (NOT with "c:" or something and it may not be a relative name with .. in it, nor may it be a name in the current directory, just start with \ and think about it and you will get it right :-)). By the way, if I had done ./undelete syssave root x:rootsave.bin 0 (hm, sorry. no autodetection please, root dir has fixed size:) ./undelete syssave root x:rootsave.bin I would have gotten a 7k dump file but no user-readable listing of the root directory! All syssave commands are meant as a means to make an exact copy of filesystem internal data, which experts can analyze or copy back later, for example after you accidentally started to format your drive. You do not need them for undeleting files, normally. Project summary: Source: test.img, 1474560 bytes. Step 1: data.bin, 999k, can be compresed to 2.5k, which gives us the hint that not much really undeleteable data is in it. Step 2: data.txt, 2.7k, all text strings found in the "free" clusters. Step 3: data1.bat (1876 bytes) and data2.txt (842 bytes), parts of data.txt Step 4: Comparison shows that we have found inst.bat and read.me versions, diff and wdiff are our friends. If you have less, wdiff -l ... | less can highlight the differences (bold/underline...). Alternative way: NORMAL undelete, not undelete of ALL recoverable data. Step 1: root-dirsave.bin (only useful for experts, 1k, our selected size, using auto-truncate by selecting size 0 is okay, too. This will truncate after finding several empty directory slots) and root-dirsave.txt, 1835 bytes, which gives a verbose technical directory listing. We read in there: UnDelAble: ?EAD .ME 13:11:46 19.08.2001 @00674, size 0000000819 Step 2: read2.me, 1024 bytes (multiple of 512), recovered by undelete follow. We gave the length as 2 clusters, but 0, auto, may have worked, too. If your deleted file is fragmented, the recovered file gets too short in autodetect lenght mode. If lots of empty clusters come after it, those will be included in autodetect length mode and it will get too long. So just calculate 819 / (512 * 1) = 2 clusters needed and use this to select the length manually. Have fun with UNDELETEing with my tool! Cheers, Eric