Undelete for Win95 etc.

[coox]

Rotten old windows 3.1 had an undelete function, which seemed to work. Windows 95 has the "fabulous" recycle bin, which I never use - just use the shift+delete thing all the time. Now supposing (as a guy here in the office has) you delete something really important. Unless you buy Norton or something, you're knackered. So... is it possible to write something in VB to recover deleted files? I'd love to write my own thing so I don't have to install Norton (although it does seem to be pretty good)...

[coox]

What, none of you BRAINS knows? Well, does anyone know how the old undelete thing does it? Someone must, I just can't find any sample code or even anything explaining it...

[SteveS]

The old Undelete command, was only released with previous versions of MS-OS.

You could try copying the undelete.exe file from an old MS-OS to your WINDOWS\Command Directory, then run a dos prompt and see if it works, probably will give an OS Version error.

Also you could make a Floppy-Bootdisk for the old OS, with an Autoexec that automatically runs the Undelete.Exe, which would also have to be on the disk.

The undelete function, worked by removing the 1st character and replacing it with a non-printable character, therefore the FAT sees this space now as free, but the file is still there, so undelete looks in the FAT for files begining with this non-printable character and that's why it asks you to type in the first character of the file you want to undelete.

Hope this helps,

Steve.

PS: If you do get it working for current OS's, could you send me a copy.

[coox]

Hi Steve, well I did try pinching the old exe from a 3.1 system some time ago. It worked to the point where you could see the deleted files (tantalising!) but it crashed big-style when you tried to undelete them.

So is there no way of querying the FAT? There MUST be a simple-ish way of doing this. HAYELP!!!!

[coox]

Please, somebody give me a hint...

[rino_2]

Listen up guys, I think you have got the wrong end of the stick!

The undelete did'nt bring back deleted files although thats what it led you to believe. The Undelete worked just like the Recycle Bin. When you deleted a file it sent it to a space on you harddrive which you could not acess and when you undeleted something it just brought it back. Believe me, it would be imposible to bring a deleted file back because all the magnetism from that file has been removed from the harddrive.

[Yonatan]

Actually when you kill a file it goes to the (wrong) end of the hard-drive, after the terminator. How can I explain this...

Ok, take a C++ string.
Set it to:
"ABC\0DEF"
Whenever you want to read it, you get "ABC" - because the "DEF" is after the null-terminating character.

Same with the hard-drive...
Somewhere there's some terminator. When you kill a file, the file's contents are dumped after this terminator. Whenever you read your hard-drive, the system reads up to the terminator and stops there, as if whatever is behind it doesn't exist.

Utilities like the Norton thing (I forget its name...) read past the terminator, and find:

Rest In Peace
Some-Document-I-Really-Need-But-Deleted-By-Mistake
Last words: Are you sure you want to delete this document?

The utility brings all this data to behind the terminator and suddenly the document starts living again... The End

(How to do this in VB? Who knows?)

------------------
Yonatan
Teenage Programmer
E-Mail: RZvika@netvision.net.il
ICQ: 19552879 (http://www.icq.com/19552879)
AIM: RYoni69

[Gerald]

Coox,

Do you know how to write in assembly language? The reason I ask is that in order to recover a deleted file the way Norton Unerase did, you will need to use very low level (sector level) disk IO routines that are not available in Visual Basic.

When a file is deleted, the first character of its name in the directory entry is set to Hex value of E5. Then all the FAT entries for the file are set to Null--just as Yonanta described. Since the directory entry is basically still intact, which still contains a reference to the file's first FAT entry, an undelete utility can be written to somehow rebuild the FAT chain from this information--as long as the disk clusters the file once occupied have not been overwritten by another file.

So the answer to your question is that you can't do it with VB alone--you'll need to somehow access the BIOS's Interrupt 25H and 26H routines for sector level disk access.

Gerald M.

*Update* I was doing some further reading on this topic and learned that the interrupts mentioned above are not supported in Windows protected mode.


[This message has been edited by Gerald (edited 12-11-1999).]

[DiGiTaIErRoR]

I have undelete.exe. it works.
na ner na ner na ner =P
here d/l if u like http://members.xoom.com/tagsclan/undelete.exe
note: u can't do it unless u allow direct disk access so type:
lock c:
undelete c:\*.*
unlock c:
otherwise won't work prolly crash etc.

------------------
DiGiTaIErRoR