Hi Karen,

> let me simplify this some.
> I just did this about three hours ago.  I have done nothing to the drive 
> where the file was, in an  effort of being very very sure it can be
> recovered.

As mentioned, the 2002 version of FreeDOS undelete avoids to write
the drive FROM which you extract data, but newer versions may. The
(Norton) version shipped with MS DOS also does. If you want to be
"very very sure", then the best way would be to make a disk image
of the drive which contains the damaged file and then do all other
steps in a read-only fashion only using that disk image. Forensics
tutorials should be available online - for example people tend to
accidentally overwrite pictures on their digicam memory cards, so
the problem is sort of common.

> granted dos 7.1 does not have undilute.  dos 6.22 did, and I still have 
> that on a different drive.

Note that the undelete of MS DOS 6 does not support FAT32, so if
your partition is FAT32, it would be a different story. FreeDOS
also has only experimental support in a newer undelete version.

> additionally I have the entire set of norton utilities for dos v 8.0, 
> the last full edition.

I am not familiar with that, but Wikipedia says that only from
Norton Utilities for Win 95 version 2 on, FAT32 is supported.
In general, I think Norton Utilities for DOS version 8 are more
powerful and professional than the undelete included in MS DOS.

> I have really slept since running ms dos undilute.
> anyone have a copy of this?
> its only one file around 125k in size, but it is profoundly important.

Please explain in more detail: Which partition type is the
partition where the damaged file resides? Is it is the root
directory or in a subdirectory? Do I understand correctly
that it did not get deleted, but rather overwritten? If so,
how big is the file by which it got overwritten? Were there
other copies of the file at other locations at some time?

Maybe undeleting a  deleted copy of the file works better
than recovering only the end of the file, now that you may
have overwritten the start of the main copy by accident.
If there were different copies at different places, some
of which are now deleted, undeleting them can help you to
recover different parts of your file. As with all delicate
repair work, the best way would be using a disk image in
read-only mode to avoid degrading available data further.

I think that the default way of overwriting a file is to
re-use the same disk area, so if you overwrote X.TXT of
125kb with another X.TXT of 5kb, you probably can recover
only the 120kb at the end. In addition, if you have 4kb
cluster size, you can at most recover 117kb directly, as
the first 2 clusters got partially overwritten. It may
help to additionally "extract" the new small file to a
new place, with size extended to 8kb, though: It should
have the missing 3kb appended...

Of course working on a disk image can be a pain: Often,
you do not have enough space for a raw copy of the whole
partition (whole disk should not be necessary) and you
may not have the tools either. Comercially, people often
used Ghost for this. However, that got discontinued now.

Experienced Linux users might just use the "dd" command,
risking a copy in the wrong direction when making a typo.

Both Ghost and Linux partimage have had no update for 3
years now. PING and "Redo Backup and Recovery" also are
not very up to date. Clonezilla and "Mondo Rescue" seem
to be the most promising options at the moment. For G4L
(Ghost for Linux) English Wikipedia has no description,
but German Wikipedia does...




If you feel insecure about the process, you may want
to ask somebody with disk imaging experience to make
the image for you. If the partition is small, they
can burn a copy of the image file on DVD which then
is implicitly read-only. Otherwise, you may want to
make more than one copy if you are worried about the
read-only part of your repair attempts. If you cannot
find sufficient disk space for a disk image, you may
want to get or borrow an extra drive, depending on
how optimistic you are about the repair in general.

Of course you can also always limit yourself to some
preferrably read-only analysis and rescue attempts
on the original disk, in particular if you only want
to try a limited number of things and then move on.

Regards, Eric

PS: Given that you have the complete Norton Utilities
for DOS, you can use their disk editor (in read-only
mode, as viewer, preferrably) to investigate the area
of your damaged file to ponder further repair steps.

PPS: The https://en.wikipedia.org/wiki/Norton_Utilities
page says MS DOS 5 UNDELETE is from the Norton Utilities
version 6 and MS DOS 6 DEFRAG is from Norton version 7.
Also, MS may have licensed modified / smaller versions.

November Webinars for C, C++, Fortran Developers
Accelerate application performance with scalable programming models. Explore
techniques for threading, error checking, porting, and tuning. Get the most 
from the latest Intel processors and coprocessors. See abstracts and register
Freedos-user mailing list

Reply via email to