Hi Karen, > let me simplify this some. > I just did this about three hours ago. I have done nothing to the drive > where the file was, in an effort of being very very sure it can be > recovered.
As mentioned, the 2002 version of FreeDOS undelete avoids to write the drive FROM which you extract data, but newer versions may. The (Norton) version shipped with MS DOS also does. If you want to be "very very sure", then the best way would be to make a disk image of the drive which contains the damaged file and then do all other steps in a read-only fashion only using that disk image. Forensics tutorials should be available online - for example people tend to accidentally overwrite pictures on their digicam memory cards, so the problem is sort of common. > granted dos 7.1 does not have undilute. dos 6.22 did, and I still have > that on a different drive. Note that the undelete of MS DOS 6 does not support FAT32, so if your partition is FAT32, it would be a different story. FreeDOS also has only experimental support in a newer undelete version. > additionally I have the entire set of norton utilities for dos v 8.0, > the last full edition. I am not familiar with that, but Wikipedia says that only from Norton Utilities for Win 95 version 2 on, FAT32 is supported. In general, I think Norton Utilities for DOS version 8 are more powerful and professional than the undelete included in MS DOS. > I have really slept since running ms dos undilute. > anyone have a copy of this? > its only one file around 125k in size, but it is profoundly important. Please explain in more detail: Which partition type is the partition where the damaged file resides? Is it is the root directory or in a subdirectory? Do I understand correctly that it did not get deleted, but rather overwritten? If so, how big is the file by which it got overwritten? Were there other copies of the file at other locations at some time? Maybe undeleting a deleted copy of the file works better than recovering only the end of the file, now that you may have overwritten the start of the main copy by accident. If there were different copies at different places, some of which are now deleted, undeleting them can help you to recover different parts of your file. As with all delicate repair work, the best way would be using a disk image in read-only mode to avoid degrading available data further. I think that the default way of overwriting a file is to re-use the same disk area, so if you overwrote X.TXT of 125kb with another X.TXT of 5kb, you probably can recover only the 120kb at the end. In addition, if you have 4kb cluster size, you can at most recover 117kb directly, as the first 2 clusters got partially overwritten. It may help to additionally "extract" the new small file to a new place, with size extended to 8kb, though: It should have the missing 3kb appended... Of course working on a disk image can be a pain: Often, you do not have enough space for a raw copy of the whole partition (whole disk should not be necessary) and you may not have the tools either. Comercially, people often used Ghost for this. However, that got discontinued now. Experienced Linux users might just use the "dd" command, risking a copy in the wrong direction when making a typo. Both Ghost and Linux partimage have had no update for 3 years now. PING and "Redo Backup and Recovery" also are not very up to date. Clonezilla and "Mondo Rescue" seem to be the most promising options at the moment. For G4L (Ghost for Linux) English Wikipedia has no description, but German Wikipedia does... https://en.wikipedia.org/wiki/Comparison_of_disk_cloning_software https://en.wikipedia.org/wiki/Clonezilla https://en.wikipedia.org/wiki/Mondo_Rescue If you feel insecure about the process, you may want to ask somebody with disk imaging experience to make the image for you. If the partition is small, they can burn a copy of the image file on DVD which then is implicitly read-only. Otherwise, you may want to make more than one copy if you are worried about the read-only part of your repair attempts. If you cannot find sufficient disk space for a disk image, you may want to get or borrow an extra drive, depending on how optimistic you are about the repair in general. Of course you can also always limit yourself to some preferrably read-only analysis and rescue attempts on the original disk, in particular if you only want to try a limited number of things and then move on. Regards, Eric PS: Given that you have the complete Norton Utilities for DOS, you can use their disk editor (in read-only mode, as viewer, preferrably) to investigate the area of your damaged file to ponder further repair steps. PPS: The https://en.wikipedia.org/wiki/Norton_Utilities page says MS DOS 5 UNDELETE is from the Norton Utilities version 6 and MS DOS 6 DEFRAG is from Norton version 7. Also, MS may have licensed modified / smaller versions. ------------------------------------------------------------------------------ November Webinars for C, C++, Fortran Developers Accelerate application performance with scalable programming models. Explore techniques for threading, error checking, porting, and tuning. Get the most from the latest Intel processors and coprocessors. See abstracts and register http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk _______________________________________________ Freedos-user mailing list Freedos-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/freedos-user
