Recovering lost data from a hard disk


Tip
You need luck -- without it, expect to spend lots of time and quite possibly tons of money!
Unerasing a file. The good news is that when Windows 95 deletes a file, it only changes one letter in the file's name; the actual data are untouched. The bad news is that if the clusters holding the data aren't contiguous, programs like Norton's Unerase or DOS's Undelete may not find all the data. Your data can also be written over by a new file before you undelete it.
Windows 95 doesn't come with an undelete utility. Apparently Microsoft felt that once you empty the Recycle Bin, you don't deserve another chance.
I think you do. If you don't have Norton's Unerase or something similar, look for an old copy of undelete.exe that came with pre-Windows 95 DOS. It will work with Windows 95, but Win 95 needs to secure the hard disk properly before it can let Undelete have its way with the disk. Here's what to do:
Restart Windows 95 in MS-DOS mode, and from the DOS prompt type lock C: (or whatever drive letter you're using). Now Undelete will work. When you're done unerasing files, type unlock C: to return Windows 95 to normal.
Recovering data from a damaged hard disk. First, try to determine how badly the drive is damaged. Boot from a floppy and try to read the drive. If you can, you should be able to copy important files to safety. Your first priority should always be to save your data, not fix the drive. A "sector not found" message indicates that the disk may soon be useless.
On the other hand, key disk configuration information, like the master boot record (the very first sector of the disk, where vital partition and boot-up information is stored) or FAT, may have been corrupted by a virus or a power surge.
If you think you've got a boot sector virus, don't use the fdisk /mbr command. This rewrites the master boot record and is often suggested as a cure for a hard disk with a boot sector virus -- and it works. But some viruses move vital configuration data to different parts of the disk, rather than destroy it. Kill the virus, and you won't know where to look for your data.
To restore the boot record or the FAT yourself means resorting to surgery with a tool like Disk Edit. Unfortunately, Symantec provides no documentation for Disk Edit in Norton Utilities 2.0. Your best bet is to find the docs for an older copy of Norton Utilities or an after-market manual.
- Kirk Steers

Category: Hardware, Win95
Issue: Aug 1997
Pages: 179

These Web pages are produced by Australian PC World © 1997 IDG Communications