Image Map Image Map
Page 1 of 2 12 LastLast
Results 1 to 10 of 15

Thread: How are files undeleted in a FAT filesystem?

  1. #1

    Default How are files undeleted in a FAT filesystem?

    I get that the directory entry is just marked deleted and presumably the entry points to the first cluster in the file, but wouldn't the FAT chain in the FAT have had to be set to "free clusters"?

  2. #2
    Join Date
    Jan 2007
    Location
    Pacific Northwest, USA
    Posts
    34,347
    Blog Entries
    18

    Default

    Yup. Without undelete tracking, you basically do it by hand, collecting clusters starting with the one pointed to. Can get to be pretty nasty.

  3. #3

    Default

    I always thought there was a cluster chain for it to still follow somehow, but I guess this isn't the case.

    Basically did it check the starting cluster and the size of the file against the FAT and make an assumption that the file was contiguous? So if you delete a fragmented file you could really forget about getting it back?

  4. #4
    Join Date
    Jan 2007
    Location
    Pacific Northwest, USA
    Posts
    34,347
    Blog Entries
    18

    Default

    That's about it. That's also why writing to the medium after a delete really screws things up.

    I've done file recovery on messed-up floppies (those that have almost nothing but fragmented files). My approach was to copy the image to a file and work with the image. That way, you still have the original intact. The recovered files were always something where you could connect the pieces--that is, text files. You know; at the end of a cluster you see "The quick brown fox ju" and you look for a cluster starting with "mps over the lazy dog". It could be done with binary executables, but that's a headache I can do without.

  5. #5

    Default

    I'm just blown away by the idea that there was no cluster chain to look at. My "luck" with recovering files was always pretty good considering how much of a gamble it is.

  6. #6
    Join Date
    Jan 2007
    Location
    Pacific Northwest, USA
    Posts
    34,347
    Blog Entries
    18

    Default

    Yup, that was a big drawback of using FAT vs. CP/M's "flat" scheme.

  7. #7

    Default

    I could see that.

  8. #8
    Join Date
    Feb 2017
    Location
    Guildford, U.K.
    Posts
    418
    Blog Entries
    1

    Default

    Quote Originally Posted by alank2 View Post
    I always thought there was a cluster chain for it to still follow somehow, but I guess this isn't the case.

    Basically did it check the starting cluster and the size of the file against the FAT and make an assumption that the file was contiguous? So if you delete a fragmented file you could really forget about getting it back?
    As I remember it (and that's fairly unreliable) the "current FAT" has the deleted clusters marked as unused, but the "other/backup FAT" may still have the cluster chains until the next FAT switch, so reliable undelete is only possible until the next FAT switch.

  9. #9

    Default

    That is interesting. Does anyone know about the technique that was used to determine which FAT is the active one, how it went back and forth when writing, etc.

  10. #10
    Join Date
    Jan 2007
    Location
    Pacific Northwest, USA
    Posts
    34,347
    Blog Entries
    18

    Default

    If so, (I don't think it is). The second FAT was intended as backup, as it holds the file structure. You can lose the root directory and still recover the contents if the FAT is intact, but not the other way around.

    DOS 5 and later did undelete tracking by using a special file, PCTRACKR.DEL. It can hold a certain (configurable) number of entries. DR-DOS took a similar approach, but also included a FAT snapshot utilitiy, called DISKMAP.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •