Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
How to modify FAT / undelete file
- Thread starter BaDeVlad
- Start date
Sorry for the bad news:
When a file is deleted, the first character of the file name in the directory entry (not in FAT) becomes 0xE5 (This is the deletion mark) and the clusters are declared free. That means in FAT a 0 is written in the cells corresponding to the clusters of the deleted file. For file recovery you have to replace in the directory entry, not in FAT, the first character of the file name with anything but 0xE5 (deleted) or 0x00 (first free entry in directory) and, in FAT, restore the cluster chain. The first cluster can be retrieved from the directory entry. The next, well, you have to guess either supposing the file was unfragmented, either by data inspection and so on. If the file is smaller than 1 cluster (512 bytes on floppies - Ouch!) then recovery is 100% possible. Otherwise it's like putting together the pieces of a broken glass object. For directory entries and FAT access, use DISKEDIT.EXE in Windows 95/98/ME's DOS mode
When a file is deleted, the first character of the file name in the directory entry (not in FAT) becomes 0xE5 (This is the deletion mark) and the clusters are declared free. That means in FAT a 0 is written in the cells corresponding to the clusters of the deleted file. For file recovery you have to replace in the directory entry, not in FAT, the first character of the file name with anything but 0xE5 (deleted) or 0x00 (first free entry in directory) and, in FAT, restore the cluster chain. The first cluster can be retrieved from the directory entry. The next, well, you have to guess either supposing the file was unfragmented, either by data inspection and so on. If the file is smaller than 1 cluster (512 bytes on floppies - Ouch!) then recovery is 100% possible. Otherwise it's like putting together the pieces of a broken glass object. For directory entries and FAT access, use DISKEDIT.EXE in Windows 95/98/ME's DOS mode
- Thread starter
- #3
- Status