Media Share 9/MEDIASHARE_09.ISO/private/mpc93mar.zip/DELUNDEL.DAT

Text File | 1993-02-16 | 21KB | 504 lines

     Beginners Column
     DELete And UNDELETE


     by Kenneth Johnson
     Chicago Computer Society

     This month's column will continue to look at the basic DOS commands
     by considering DEL (and ERASE), UNDELETE and MIRROR. DEL and ERASE
     delete files from your disk. UNDELETE (added in DOS 5.0) will attempt
     to restore deleted files; sometimes it is successful, sometimes not.
     You can improve UNDELETE's chances by using MIRROR (also added in DOS
     5.0) to monitor and record all deletions. We'll review how to use DEL
     and ERASE safely, and ways to increase the chances of a successful
     recovery with UNDELETE and MIRROR.

     By the way, DEL and ERASE do the same thing. They have the save
     command syntax, except the command name itself. For simplicity sake,
     in this column we'll use DEL. But remember you can substitute "ERASE"
     for wherever "DEL" appears.

     To understand why UNDELETE works, it is important to know how DOS
     "deletes" a file. DEL and ERASE do not physically remove data from
     the disk, rather the file is "logically" deleted. The information is
     still there, but the space it occupies is marked as free for reuse.
     When DOS writes to the disk again, it may write over the "deleted"
     data. Then it is gone forever.

     When a file is deleted, the first character in the file name directory
     listing is altered (actually replaced with a sigma "σ" character).
     The file's entries in the file allocation table (FAT) are also cleared,
     though the data on the disk itself is unchanged. Since the FAT entries
     tell DOS where the file is physically located, from DOS' perspective
     the file is now "gone."

     Unerase utilities such as UNDELETE find logically deleted files by
     look for the "sigma" directory entries. They ask you to enter the
     correct first character of the file name, then attempt to reconstruct
     the FAT entries. How successful the reconstruction is varies,
     depending on how fragmented the file was and whether DOS has written
     over any of the data. Files that are fragmented are much harder to put
     back together since the program has to guess how the clusters go
     together, much like a jigsaw puzzle. If DOS has written over any of
     the data, it is impossible to completely recover a file. A partially
     recovered file is likely worthless.

     The means that if you accidentally delete a file, it is important to
     undelete it as soon as possible. If DOS writes anything to the disk,
     there is a chance that the deleted file's data will be physically
     overwritten. Do not save or copy files to the disk; stop everything
     and use UNDELETE or another unerase utility. This ensures the best
     chance of recovery.

     Another important consideration is that DEL (and ERASE) will not
     delete files that have the Read-only, Hidden, and/or System attribute.
     So one easy way to guard against accidental deletions is to use the
     ATTRIB command to make files Read-only. Of course, you only want to
     make files Read-only if they are rarely or never modified. For example,
     the following will make all .SYS files on the C: drive Read-only:

    ATTRIB +R C:\*SYS /S

     The "+R" parameter turns on the Read-only attribute. The "/S" switch
     tells DOS to make the change on the selected directory (here the root
     since we've only specified "C:\") and all child subdirectories. Once
     the Read-only attribute is set, any attempt to delete a file will
     return an "Access Denied" message from DOS. To turn off the Read-only
     attribute use the "-R" switch, such as:

    ATTRIB -R C:\CONFIG.SYS

     The syntax for the DEL and ERASE commands are:

    DEL filespec [/P]
    ERASE filespec [/P]

     where filespec is the name of the file(s) to delete. The filespec can
     include the drive designation and/or path if the file is not in the
     current directory, and it may contain wildcard characters. However,
     since a wildcard file specification could include files you don't
     really want to delete, you may want to do a DIR command with the
     filespec first. That way you'll see exactly what will be deleted.

     There are a couple of special considerations with the DEL and ERASE
     filespec. If the file specification to delete is the name of a
     directory, then DOS will consider it as a request to delete all files
     (*.*) in that directory. For example, if you have a subdirectory under
     the current directory called WPWIN, and issue the following command:

    DEL WPWIN

     If will be interpreted as

    DEL \WPWIN\*.*

     You will be prompted with the standard DEL/ERASE warning message when
     using *.* as a filespec:

    All the files in directory will be deleted!
    Are you sure (Y/N)?

     You'll have to type "Y" and press Enter for the deletions to take
     place.

     Another special filespec is the single period, which stands for the
     current directory and all files in it. So indicating:

    DEL .

     is equivalent to:

    DEL *.*

     and again you'll be prompted with the "Are your sure (Y/N)?" message.
     The same goes for the double period (..) filespec, which stands for
     the parent directory and all the files in it.

     The "/P" switch, added in DOS 4.0, is an important safety enhancement
     to the DEL and ERASE commands. This is the Prompt switch, which
     displays the full path and name of the file to be deleted, and asks
     "Delete (Y/N)?". You must answer "Y" for the deletion to take place.
     When used with a wildcard filespec, DOS will display the path and name
     of every file matching that specification, one at a time, and have you
     confirm the deletion of each. It's a good way of avoiding unpleasant
     wildcard surprises.

     You can make the "/P" switch default whenever executing DEL or ERASE
     by setting up two DOSKEY macros. DOSKEY is a DOS 5.0 TSR (Terminate
     and Stay Resident) program that allows you to create macros from the
     command line. What makes these macros so powerful is that they execute
     before the DOS internal commands (commands that are part of
     COMMAND.COM, the command interpreter -- which DEL and ERASE are). This
     means that DOSKEY macros can redefine and customize DOS commands.

     DOSKEY is normally loaded in your AUTOEXEC.BAT file. To create the
     prompted delete macros, include the following lines in AUTOEXEC.BAT
     after loading DOSKEY:

    DOSKEY DEL=DEL $1 /P
    DOSKEY ERASE=ERASE $1 /P

     The "$1" is a replaceable parameter that stands for the file
     specification to delete. Now whenever you enter a DEL or ERASE
     command, DOSKEY will intercept and reissue it to DOS with the /P
     switch. You'll be prompted with the full path and file name and
     asked to confirm the deletion.

     Let's look at some examples:

     DEL EXPENSES.DB
    Deletes the file EXPENSES.DB in the current directory.

     DEL A:*.BAK
    Deletes all files with the ".BAK" extension in the default directory
     on the A: drive. If any of these files have the Read-only, System, or
     Hidden attributes, they will not be deleted.

     DEL A:*.BAK /P
    Deletes all the .BAK files in the default directory of the A: drive,
     but prompts you with each file name and asks you to confirm each
     delete. Again, Read-only, Hidden, and System files will not be
     deleted; you'll receive an "Access Denied" message.

     DEL *.*
    Deletes all files (except, Read-only, Hidden, or System files) in the
     current directory. You'll be prompted with the following message:

        All files in the directory will be deleted!
        Are you sure (Y/N)?

    Answer "Y" to proceed with the deletions.

     DEL .
    Exactly like the example above, deletes all files (except, Read-only,
     Hidden, or System files) in the current directory. Again you'll be
     prompted with the Are you sure (Y/N)? message.

     DEL ..\CCSBBS.ASP /P
    Deletes the file CCSBBS.ASP in the parent directory, prompting you to
     confirm the deletion.

     ECHO Y | DEL *.*
    This is an interesting, but dangerous one! Deletes all files (except,
     Read-only, Hidden, or System files) in the current directory, without
     giving you a chance to say you are sure. The ECHO command pipes "Y"
     into the DELETE command, which answers the "Are your sure (Y/N)?"
     message affirmatively. This technique is often used in batch files to
     automatically delete all files without requiring user confirmation.

     So what if, despite your best efforts, you accidentally delete an
     important file? Remember that the erased file is probably salvageable
     until new data is written over it. Stop everything and try to recover
     the file as soon as possible. DOS 5.0 includes two recovery programs
     to help get back deleted files: UNDELETE and MIRROR.

     The syntax for setting up MIRROR as a delete tracking TSR is:

    MIRROR /Td[-nnn]

     where "d" is the drive to track and the optional "-nnn" specifies the
     number of entries to keep. MIRROR creates a file name PCTRACKER.DEL in
     the root directory of the specified drive, which contains the names
     and locations of the deleted files. The size of PCTRACKER.DEL depends
     on the number of entries, each of which takes up about 150 bytes. If
     not specified, the number of entries is determined by the size of the
     disk; from 25 for a 360k floppy to over 300 for a 32+ MB hard drive.

     For example, suppose you have a C: and a D: drive and want to track
     deletions on each. You could include the following in your
     AUTOEXEC.BAT file:

    MIRROR /TC /TD

     The delete tracking component of MIRROR can be run from upper memory,
     so if you have a 386 or 486 computer you may want to load it high.

     Whether or not you use MIRROR, the UNDELETE program can help recover
     deleted files. With MIRROR's delete tracking, getting back deleted
     files is almost a certainty -- if the data hasn't been physically
     overwritten on the disk. Without the delete tracking file, recover
     with UNDELETE is less certain but still possible. However, be aware
     that UNDELETE cannot restore a removed directory or erased files in
     a removed directory.

     The syntax for UNDELETE is:

    UNDELETE [filespec] [/DT or /DOS] [/ALL or /LIST]

     "Filespec" is the name(s) of the erased file to undelete; it can
     include the drive and/or path if files are not in the current
     directory and can include wildcards. If no file specification is
     given, all deleted files in the current directory are selected.

     The "/DT" and "/DOS" switches determine how the undelete will be
     performed. "/DT" indicates to use MIRROR's delete tracking file; only
     those specified files in the PCTRACKR.DEL file will be undeleted, and
     you will be prompted to confirm the undelete of each. To use this
     option, you must be running MIRROR with delete tracking when erasing
     the file you need to recover.

     The "/DOS" switch tells UNDELETE to recover based on the directory
     entries, without the aid of a delete tracking file. UNDELETE will find
     the logically deleted directory entries, and ask you to provide the
     correct first letter of each file name (it will be shown as a question
     mark). UNDELETE will replace the name in the directory, then try to
     restore the file's FAT entries as best it can. The success of UNDELETE
     depends on the size of the file and the degree of fragmentation. Use
     the "/DOS" option if you believe that the delete tracking file is out
     of date and should not be used.

     The "/ALL" switch will undelete the specified files without prompting.
     If using delete tracking, UNDELETE will automatically recover all
     deleted files using the names and FAT information in the PCTRACKR.DEL
     file. If the original name of a deleted file already exists in the
     directory, you'll be asked for a new name for the undeleted file. When
     no delete tracking file exists, or if you are using the "/DOS" switch,
     UNDELETE will try other symbols (%&-), then numbers, then letters
     until it finds a unique name.

     The "/LIST" switch shows what files can be undeleted, without
     performing the undelete. Try this first to see exactly what files are
     available for recovery.

     Let's look at some examples of using UNDELETE with and without delete
     tracking. Let's say you've accidentally deleted all the *.TXT files in
     the C:\DOCS subdirectory. First we'll see UNDELETE when there is no
     delete tracking We'll start with /LIST to check what can be undeleted
     (in these examples, the italics represent what you type in):

    C:\DOCS>undelete /list

     Directory: C:\DOCS
    File Specifications: *.*

    MS-DOS directory contains   3 deleted files.
    Of those,   3 files may be recovered.

    Using the MS-DOS directory.

        ?eadme   txt  33655  4-09-91  5:00a ...A
        ?ppnotes txt   9701  4-09-91  5:00a ...A
        ?oshelp  txt   1540  5-08-91 12:00p ...A

     Now let's automatically undelete all the files:

    C:\DOCS>undelete /all

    Directory: C:\DOCS
    File Specifications: *.*

    Deletion-tracking file not found.

    MS-DOS directory contains   3 delete files.
    Of those,   3 files may be recovered.

    Using the MS-DOS directory.

        ?readme  txt  33655  4-09-91  5:00a ...A

    File successfully undeleted.

        ?ppnotes txt   9701  4-09-91  5:00a ...A

    File successfully undeleted.

        ?oshelp  txt   1540  5-08-91 12:00p ...A

    File successfully undeleted.

     To see what we got back, do a DIR command on the .TXT files:

    C:\DOCS>dir *.txt

    Volume in drive C has no label
    Volume Serial Number is 3352-15EE
    Directory of C:\DOCS

                 #eadme   txt  33655  4-09-91  5:00a
                 #ppnotes txt   9701  4-09-91  5:00a
                 #oshelp  txt   1540  5-08-91 12:00p
                        3 file(s)   44896 bytes
                                 36917248 bytes free

     Notice that without a delete tracking file and using /ALL, DOS assigns
     the pound sign as the first character of each of the three file names.
     If you undelete files individually, UNDELETE will give you the
     opportunity to supply the correct first letter of the name:

    C:\DOCS>undelete doshelp.txt

    Directory: C:\DOCS
    File Specifications: DOSHELP.TXT

    Deletion-tracking file not found.

    MS-DOS directory contains   1 delete files.
    Of those,   1 files may be recovered.

    Using the MS-DOS directory.

        ?oshelp  txt   1540  5-08-91 12:00p ...A

    Undelete (Y/N)? y

    Please type the first character for ?OSHELP.TXT: y

    File successfully undeleted.

     To make sure we got the file back, do a DIR command on the .TXT files:

    C:\DOCS>dir *.txt

    Volume in drive C has no label
    Volume Serial Number is 3352-15EE
    Directory of C:\DOCS

                 DOSHELP  TXT   1540  5-08-91 12:00p
                        3 file(s)    1540 bytes
                                 36917248 bytes free

     Now let's look at the same examples when MIRROR has been used to track
     the deletions. You should notice that not only is it easier, but you
     also get additional information about the deletion:

    C:\DOCS>undelete /list

    Directory: C:\DOCS
    File Specifications: *.*

    Deletion-tracking file contains   3 deleted files.
    Of those,   3 files have all clusters available,
                0 files have some clusters available,
                0 files have no clusters available.

    MS-DOS directory contains   3 deleted files.
    Of those,   3 files may be recovered.

    Using the deletion-tracking file.

    DOSHELP  TXT    1540  5-08-91 12:00p ...A
        Deleted: 11-12-92  1:30p
    APPNOTES TXT    9701  4-09-91  5:00p ...A
        Deleted: 11-12-92  1:30p
    README   TXT   33655  4-09-91  5:00p ...A
        Deleted: 11-12-92  1:30p

     Now we can undelete all files with the file names intact:

    C:\DOCS>undelete /all

    Directory: C:\DOCS
    File Specifications: *.*

    Deletion-tracking file contains   3 deleted files.
    Of those,   3 files have all clusters available,
                0 files have some clusters available,
                0 files have no clusters available.

    MS-DOS directory contains   3 deleted files.
    Of those,   3 files may be recovered.

    Using the deletion-tracking file.

    DOSHELP  TXT    1540  5-08-91 12:00p ...A
        Deleted: 11-12-92  1:30p

    File successfully undeleted.

    Using the deletion-tracking file.

    APPNOTES TXT    9701  4-09-91  5:00p ...A
        Deleted: 11-12-92  1:30p

    File successfully undeleted.

    Using the deletion-tracking file.

    README   TXT   33655  4-09-91  5:00p ...A
        Deleted: 11-12-92  1:30p

    File successfully undeleted.

     You can also undelete one file with ease:

    C:\DOCS>undelete doshelp.txt

    Directory: C:\DOCS
    File Specifications: DOSHELP.TXT

    Deletion-tracking file contains   1 deleted files.
    Of those,   1 files have all clusters available,
                0 files have some clusters available,
                0 files have no clusters available.

    MS-DOS directory contains   1 deleted files.
    Of those,   1 files may be recovered.

    Using the deletion-tracking file.

    DOSHELP  TXT    1540  5-08-91 12:00p ...A
        Deleted: 11-12-92  1:30p

    All of the clusters for this file are available. Undelete (Y/N)? y

    File successfully undeleted.

     DEL and ERASE are important, yet dangerous commands. We've looked at
     some way to protect yourself from accidental deletions, and how to
     (hopefully) get back deleted files with UNDELETE and MIRROR. Some
     points to keep in mind when using DEL and ERASE:

     -    Undelete ASAP! Since a logically deleted file's data is not
     physically overwritten, there is a chance for recovery. If DOS writes
     anything to the disk, the erased file's data may be physically
     overwritten and thus lost forever. Stop whatever you are doing, don't
     save or copy any files to the disk, and run UNDELETE (or another
     unerase utility).

    If you are at the DOS prompt, go to the subdirectory containing the
     deleted file(s) and run UNDELETE. If you are running an application
     program, quit. In the event you must save your work before exiting the
     program, be sure to save to a different drive. When you are not sure
     you can exit without writing to the disk, reboot the computer. However,
     if your AUTOEXEC.BAT file has any programs that write to the disk (like
     MIRROR or DOSSHELL), you should reboot from a "plain" DOS disk in the
     A: drive.

     -    Remember that UNDELETE cannot get back removed directories or any
     erased files in a removed directory. Make sure that you really don't
     want any of the deleted files before you remove their directory.

     -    Include "mirror /tc" in your AUTOEXEC.BAT to set up delete
     tracking on the C: drive. Include "/td" to monitor the D: drive, "/ta"
     to monitor the A: drive, and so forth. With MIRROR's delete tracking
     you significantly increase the chances of a successful undelete -- as
     long as the file isn't overwritten.

     -    Use the /p switch with DEL and ERASE to confirm each deletion,
     especially when using wildcard specifications. Consider using DOSKEY
     to make the /p the default, by including the following two lines in
     your AUTOEXEC.BAT file after loading DOSKEY:

        DOSKEY DEL=DEL $1 /P
        DOSKEY ERASE=ERASE $1 /P

     -    Be careful with wildcards and directory names with DEL and ERASE.
     Before using a wildcard file specification, use it in a DIR command to
     see exactly what will be deleted. Remember that giving a directory
     name with DEL/ERASE means to delete all files in that directory.

     -    Remember that UNDELETE may be able to recover sensitive data that
     you truly want to stay deleted. If you are concerned about sensitive
     information staying unrecoverable, consider a utility program (such as
     Norton Utilities' WIPEINFO or PCTools' WIPE) that will totally
     obliterate data so that it cannot be recovered by any means. To secure
     a floppy disk, unconditionally format it with FORMAT /U. Neither
     UNDELETE nor UNFORMAT can recover any data from the disk.

     -    Finally, if you are asked "Are you sure (Y/N)?" and you are not
     totally, absolutely, and positively sure, answer N. DOS doesn't give
     you a second chance or understand the verbal "Oops!" command.