Hi!

> I did this dirty deed with FreeDOS 1.0 FDISK & format...
> I immediately looked at unformat, but I noticed
> that the message displayed after running format was
> something like "unformat data not saved" or "..unavailable".
> The format process was extremely quick, like maybe 5 seconds
> or less.

Indeed. You can try FORMAT /Z:UNFORMAT X: or similar,
but format with saving unformat data would be, say,
15 seconds compared to your format in 5 seconds. Much
slower than a full format with surface scan and wiping
of data clusters, of course. And indeed much of your
data should still be there.

What you probably did was delete a partition and create
a new partition - maybe of same size and type - at more
or less the same location. Still FORMAT noticed that the
partition was "new", so it did not save unformat info:

It only made an empty root directory, marked all clusters
as free, and declared the disk to be formatted then. This
would give you good chances to find back a fair amount of
your data as soon as you have gathered enough skills and
tools to un-zombie and undelete everything.

Maybe you had unformat info from before you did all this,
but it would only be useful if it would be fairly fresh.
If many file locations etc changed since saving the data,
unformatting will actually do more damage than repair!

It is hard to find out what can be done and when. If you
really want to try your best to get back your data, the
FIRST thing to do is make a diskimage of the whole stick
and backup that. Then you can bring back the state at
which you start the repair attempts as often as you want,
and find out how to repair more and more, avoiding the
risk of breaking things more / making them unrepairable
while trying to repair.

If your partition had exactly the same size, type and
location before and after the incident, then only your
root directory is really gone. The other direct sub-
directories still float around as unnamed zombies, and
you can undelete as many files and subdirectories as
your luck allows after you undeleted those. However,
unfortunately, FreeDOS UNDELETE cannot un-zombie, so
you would have to use a disk editor or some more fancy
undelete tool for the subdirectories directly under the
root directory. Undeletion also depends on two things:

It cannot deal well with fragmented files, and it cannot
know which things can really be undeleted. Sometimes it
can happen that you have several candidates which are
all at the same or at least overlapping space of your
disk. If you undelete the wrong candidate, you cannot
undelete the other candidate any more - while only one
candidate will have useful data inside afterwards. Well
in FreeDOS undelete you are a bit safer, maybe: It does
not only have "classic undelete" where you give back a
deleted file his filename. It also has "extract" style:

There you COPY the data of a deleted file to ANOTHER
drive, as if the file was not deleted. THAT works even
with overlapping files, but you have to think and type
more on the command line. Please read the documentation
of UNDELETE for details :-).

I hope somebody can also point you to other nicer
and more fancy undelete tools. In particular, quite
a few seem to do content based undelete. In other
words, they scan the disk for beginnings of JPEGs
and other known file types and then fetch the whole
file, a bit like extract style of FreeDOS UNDELETE
but, as said, guided by remaining file contents.

> There seems to be a wide variety of data recovery
> products that profess to work on FAT32 partitions
> after a format.  But before I download, buy, try
> something out:
 
> 1. To those who know this OS and the nuances of what FreeDOS's format
> actually does, do you have any particular suggestions?

There are no really undelete / unformat relevant
FreeDOS specific properties of FAT32 I could think
of right now, but I guess if you HAD unformat data
then it MIGHT be that ours does not follow exactly
the format of MS DOS UNFORMAT. I did try to follow
specs about unformat data when adding "unformatability
and unformatting" to FORMAT, though, where available.
  
> 2. Anything I should avoid?  Any data recovery programs recommended
> or that I should avoid (i.e. might make the situation worse)?

Anything CAN make the situation worse, so depending
on your data and resources, a backup of a full disk
image of the raw disk is always a good idea. Even if
it is only because disk space is cheap today and you
may find a cool and easy to use unformat-all tool in
the future, at some time, maybe by accident :-).

You can also search the web for howto and best practice
docs about data forensics, because trying to make sense
of damaged data is exactly that. Many people do it and
many people have tools around. However, high cost tools
do not necessarily do anything better than low cost or
manual repair.
  
Please keep us updated about your attempts, and maybe
give some more details on how exactly things broke and
which type of data was backed up and which type of data
still has to be recovered and so on. Thanks and good luck!

Eric




------------------------------------------------------------------------------
SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada.
The future of the web can't happen without you.  Join us at MIX09 to help
pave the way to the Next Web now. Learn more and register at
http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/
_______________________________________________
Freedos-user mailing list
Freedos-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/freedos-user

Reply via email to