home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Software Vault: The Gold Collection
/
Software Vault - The Gold Collection (American Databankers) (1993).ISO
/
cdr11
/
mpc93jun.zip
/
UN4MAT.TXT
< prev
next >
Wrap
Text File
|
1993-05-30
|
17KB
|
373 lines
The UNFORMAT Command
By Kenneth Johnson, Chicago Computer Society
In February's column we looked at the FORMAT command, and
discussed briefly how to deal with an accidental format. This
month we'll continue with an in depth look at the UNFORMAT
command. Introduced with DOS 5.0, UNFORMAT attempts to recover a
disk that has been inadvertently formatted. Depending on the
type of format and whether any data has been written to the disk
meanwhile, UNFORMAT probably can completely recover the disk.
UNFORMAT can also be used together with the MIRROR program to
restore a hard disk's partition table. We'll look at both
functions.
First, a quick review the FORMAT command. FORMAT prepares a disk
for use by "initializing" the surface; creating the sectors, File
Allocation Table (FAT), and directory; and checking for and
marking bad sectors so they are not used. FORMAT can also be
used to create a bootable floppy disk and to erase an old disk
and check it for physical defects.
A major enhancement in DOS 5.0 is the "safe" format, which is now
the default. If you format a previously formatted disk, FORMAT
will save the FAT and root directory information in a hidden file
(called the "MIRROR image" file) on the disk. The FAT and root
directory are then erased, but the data itself is not deleted or
physically overwritten. The UNFORMAT command can use this MIRROR
file to restore the disk.
If you need to recover an accidentally formatted disk, the key is
to run UNFORMAT immediately. UNFORMAT will attempt to recover
the disk with the MIRROR image file if one exists; if not it will
try to recover based on the data that remains. When the newly
formatted disk is used (i.e., files are written to it), your
chances of recovery drop significantly.
The one situation where UNFORMAT cannot help is a disk that has
been formatted with the "/U" switch. /U does an Unconditional,
full format; the FAT is cleared, and all data on the disk is
overwritten. Because the information is physically gone,
UNFORMAT cannot recover the disk.
Recovering a Disk with UNFORMAT
If you've accidentally formatted a disk using DOS 5.0, and didn't
use the /U switch, the format didn't physically delete
information on the disk and can possibly be undone. The syntax
of the UNFORMAT command is:
UNFORMAT [d:] [/J]
UNFORMAT [d:] [/L] [/P] [/TEST] [/U]
UNFORMAT /PARTN [/L]
d: is the drive containing the disk to unformat. It is
required unless using the /PARTN switch.
/J Verifies the existence of the MIRROR image file and checks
whether it corresponds with the system area of the disk.
This option does not actually do the unformatting.
/L When used by itself, it lists all directories and files
found on the formatted disk without making use of the MIRROR
image file. When used with the /PARTN switch, it displays
the current partition table.
/P Sends output messages of the procedure to the printer
(specifically LPT1, the first parallel port).
/TEST Simulates the unformat without using the MIRROR image
file. UNFORMAT will show what files and subdirectories
will be recovered, but does not do the unformatting.
/U Unformats the disk without using a MIRROR image file. You
would use this switch if the MIRROR file exists but is out
of date.
/PARTN Restores the hard disk partition table based on
information in the file PARTNSAV.FIL, created
previously on a floppy disk with the MIRROR /PARTN
command. We'll discuss this use of UNFORMAT below.
Unless you explicitly tell it otherwise with /U or /L, UNFORMAT
will search the disk for a MIRROR image file. If more than one
is found, you can choose which file to use (you'll be shown the
dates and times each MIRROR file was created). Upon your
confirmation, UNFORMAT will replace the system information on the
disk with that from the MIRROR file. The FAT and root directory
are both restored. If no information has been written to the
disk since the format, the recovery is 100% complete and nothing
else needs to be done.
If the MIRROR image file is not used and the disk wasn't
unconditionally formatted, UNFORMAT will search the disk for
subdirectories and rebuild the disk's directory tree ■ a time
consuming process. First level subdirectories will be restored
as SUBDIR.1, SUBDIR.2, etc. since their original names were lost
when the root directory was cleared. Files in subdirectories
will be recovered as much as possible, but if a file is
fragmented UNFORMAT only can recover the first fragment. You'll
be asked if fragmented files should be truncated or deleted.
Unfortunately, UNFORMAT cannot recover any files in the root
directory because their directory entries are gone. If you must
recover those files, you'll have to use a third-party utility
like Norton Utilities that lets you examine available clusters
and put them together into files. Doing so is slow and
difficult; Peter Norton himself has likened it to the Iranians
trying to piece together the shredded documents at the American
Embassy!
Let's look at what happens when you UNFORMAT with a MIRROR image
file. Suppose you've accidentally formatted the disk in the A:
drive, but used DOS 5.0 and did not use the /U switch. The
command
UNFORMAT A:
will display the following messages:
Restores the system area of your disk by using the image file
created by the MIRROR command.
WARNING!! WARNING!!
This command should be used only to recover from the inadvertent use
of the FORMAT command or the RECOVER command. Any other use of the
UNFORMAT command may cause you to lose data! Files modified since the
MIRROR image file was created may be lost.
Searching disk for MIRROR image.
The last time the MIRROR or FORMAT command was used was at 11:30 on
02-24-93.
The MIRROR image file has been validated.
Are you sure you want to update the system area of your drive A
(Y/N)? Y The system area of drive A has been rebuilt.
You may need to restart the system.
After the disk is unformatted, the FAT and directories will be
restored to the way they were when the MIRROR image file was created.
If no new data has been added to the disk since then, the directory
and FAT will be correct. If the formatted disk was used there may
be problems with certain files, but at least you
won't have lost everything.
To verify the MIRROR image file without actually doing the unformat,
use the /J switch.
UNFORMAT A: /J
will display the following:
Restores the system area of your disk by using the image file
created by the MIRROR command.
WARNING!! WARNING!!
This command should be used only to recover from the inadvertent use
of the FORMAT command or the RECOVER command. Any other use of the
UNFORMAT command may cause you to lose data! Files modified since
the MIRROR image file was created may be lost.
Searching disk for MIRROR image.
Just checking this time. No changes written to disk.
The last time the MIRROR or FORMAT command was used was at 11:30 on
02-24-93.
The MIRROR image file has been validated.
The system area does not agree with the MIRROR image file.
The system area doesn't agree because it was cleared by the
format. If the MIRROR image file does agree with the system area
the last message will be:
The system area of drive A has been verified to agree with the
MIRROR image file.
Unformatting without using the MIRROR image file is incomplete at
best, but is probably better than losing everything. It may be
necessary if you formatted with an earlier version of DOS, used a
third-party formatting utility that doesn't save the MIRROR file,
or if the MIRROR file itself is corrupt or missing. Remember
that you can't recover files from the root directory but probably
can get back files in subdirectories.
You can use the /L switch to see the directories and files that
can be found.
UNFORMAT A: /L
will display:
CAUTION!
This attempts to recover all the files lost after a format,
assuming you've not been using the MIRROR command. This method
cannot guarantee complete recovery of your files.
The search-phase is safe; nothing is altered on the disk. You will
be prompted again before changes are written to the disk.
Using drive A:
Are you sure you want to do this?
If so, press Y; anything else cancels.
? Y
Searching disk. . . .
x% searched, x subdirectories found.
The count will continue until the entire disk has been searched.
Next, UNFORMAT will "walk the directory tree," searching each
directory for files. You'll see a list of all files and
subdirectories as UNFORMAT finds them. Remember that all first-
level subdirectories will have lost their original names and will
be displayed as SUBDIR.1, SUBDIR.2, and so forth.
You'll then be asked if you're ready to do the unformat. If you
say Yes, UNFORMAT will recover the subdirectories and files. If
a file is fragmented, UNFORMAT can only recover the first
fragment. In such cases you'll be asked if you want to truncate
or delete the file.
When UNFORMAT is complete, you'll want to do a DIR and examine
the directories and files on the disk. If some files are still
missing, you can try the UNDELETE command to attempt recovery of
additional files.
As you can see, unformatting with the MIRROR image file is easier
and much more certain. So when running FORMAT, do a "safe"
format by not using the /U switch. This will ensure the MIRROR
image file is created and that the data isn't physically
overwritten on the disk. If you've accidentally formatted an
important disk, run UNFORMAT as soon as possible ■ certainly
before anything is written to the disk.
Recovering a Partition Table with UNFORMAT
Another, perhaps less obvious use of the UNFORMAT command is to
restore a damaged hard disk partition table. UNFORMAT does this
together with the MIRROR command, which saves a copy of the
partition table and boot record information in a file on a floppy
disk.
Each physical hard disk is organized into one or more partitions;
each partition is a logical disk drive. For example, one
physical 130Mb disk drive might be partitioned into two logical
drives, a 100MB C: drive and a 30Mb D: drive. The first sector
on each hard drive contains a partition table, with one entry for
each partition. These entries have information on where the
partition starts, how many sectors it contains, and whether a
particular partition is the one to boot from. The partition
table also includes the master boot record and the "bootstrap"
program that loads the operating system when you turn on the
computer.
A partition table can become corrupted because of a hardware
problem or virus, or if you've been editing disk sectors and made
an error. Viruses particularly like attacking the partition
table since a damaged table makes the entire hard disk
inaccessible. If you can't boot from the hard disk, or get an
"Invalid drive specification" error when trying to access a hard
disk, it might be a damaged partition table.
Before disaster strikes, use the DOS 5.0 MIRROR command to save a
copy of the partition table and boot record to a floppy disk.
UNFORMAT can then use this copy to restore the hard disk
partition table. The command is:
MIRROR /PARTN
You'll be prompted to insert a formatted disk into a specified
disk drive. MIRROR will read the partition information for all
the hard drives and write it out to a file called PARTNSAV.FIL on
the floppy disk.
Ideally you should write PARTNSAV.FIL to your emergency boot
disk. The emergency boot disk allows you to boot your computer
from the A: drive, thus bypassing the C: drive which may be
unaccessible. Include the file UNFORMAT.EXE on the emergency
boot disk also, since you'll need it to restore the partition
table. (See "Creating an Emergency Boot Disk" in the February
1993 Hard-Copy for more information.)
To restore a damaged partition table, use this form of the
UNFORMAT command:
UNFORMAT /PARTN [/L]
You'll be prompted to insert the disk containing the PARTNSAV.FIL
file created by MIRROR. Adding the /L switch will display the
disk's partition table, without doing any recovery. Here is an
example display of the partition table information:
Hard Disk Partition Table display.
Drive # 80h has 1023 cylinders, 9 heads, 17 sectors (from BIOS).
The following table is from drive 80h, cylinder 0, head 0, sector 1:
Total_size Start_partition End_partition
Type Bytes Sectors Cyl Head Sector Cyl Head Sector Rel#
----------- ---------------- --------------- ---------------- ------
Huge Boot 76M 15602 0 1 1 1022 8 17 17
The Type "Huge" indicates a partition greater than 32Mb. You
might also see "BIGDOS," or perhaps "DOS12" or "DOS16" indicating
DOS partitions with 12 or 16 byte FAT entries. "Boot" identifies
this as the partition booted from. If your disk has partitions
for other operating systems (such as Unix) or set up by a non-DOS
disk manager (such as OnTrack's Disk Manager), you'll see other
names here.
Total_size shows the size of the partition in megabytes and the
total number of sectors. Start_partition shows where the
partition starts, End_partition where the partition ends. Rel#
shows the start of the partition in sectors from the beginning of
the disk. If your partition table is damaged, you'll probably
see "garbage" or error messages in this display.
UNFORMAT and MIRROR are important additions to DOS 5.0 to recover
from accidental formats and damage to your partition table. Some
points to keep in mind with UNFORMAT, MIRROR, and FORMAT:
■ For the safest FORMAT don't use the /U switch. FORMAT will
save the recovery information in the MIRROR image file for
possible use by UNFORMAT.
■ UNFORMAT can never restore a disk that was unconditionally
formatted with /U.
■ In case of an accidental format run UNFORMAT as soon as
possible. As long as no new files are written to the disk,
and if you didn't use the /U switch, the chances of recovery
are excellent.
■ If you need to unformat a disk, first do the UNFORMAT with
the /J switch. This will verify the MIRROR image file
exists and checks it against the current system area, but
doesn't do the unformat. It will give you an idea how
successful the unformat might be.
■ If you believe the MIRROR image file is out of date, you can
use the /U switch to tell UNFORMAT to recover the disk
without using the MIRROR file. Remember though that files
in the root directory cannot be restored.
■ If you want to see how UNFORMAT would recover the disk
without the MIRROR image file, and without doing the
unformat, use the /TEST switch.
■ Use the MIRROR /PARTN command to save your hard disk
partition information to your emergency boot disk. Make
sure to include UNFORMAT.EXE on the disk. If your partition
table is corrupted, you can use UNFORMAT /PARTN to restore
it from the floppy disk.
■ And remember ■ particularly with a hard disk ■ there is no
substitute for a good backup of your data.