Browse Prior Art Database

Recovery of Erased Files

IP.com Disclosure Number: IPCOM000121559D
Original Publication Date: 1991-Sep-01
Included in the Prior Art Database: 2005-Apr-03
Document File: 1 page(s) / 37K

Publishing Venue

IBM

Related People

Brooks, MW: AUTHOR

Abstract

This article describes a process for recovering erased or deleted files and data. It is software implemented for the OS/2 environment. The process is quick and easy to use and can be mouse driven. It will recover an erased file with the implementation of the following steps: (1) Read in the boot sector from the selected disk that contained the file before it was erased. (2) Calculate the starting address of the FAT (file allocation table), root directory and file data areas on the disk from the boot data. (This information is not normally accessible in OS/2 protect mode). (3) Find and list all erased files that could be recovered from the disk in relation to their original directory entries.

This text was extracted from an ASCII text file.
This is the abbreviated version, containing approximately 80% of the total text.

Recovery of Erased Files

      This article describes a process for recovering erased or
deleted files and data.  It is software implemented for the OS/2
environment.  The process is quick and easy to use and can be mouse
driven.  It will recover an erased file with the implementation of
the following steps:
(1)  Read in the boot sector from the selected disk that contained
the file before it was erased.
(2)  Calculate the starting address of the FAT (file allocation
table), root directory and file data areas on the disk from the boot
data.  (This information is not normally accessible in OS/2 protect
mode).
(3)  Find and list all erased files that could be recovered from the
disk in relation to their original directory entries.
(4)  Once an erased file has been selected for recovery, the program
will ask for a new file name (on a different disk drive) and then
recover the file data and place that data into the new file.  The
data is recovered as follows:
      (a)  The original size of the file is recovered from the erased
file directory entry.  The starting cluster number in the erased
file's old directory entry is used to locate the first cluster of the
erased file data.
      (b)  If the cluster's FAT entry indicates that it is not
currently in use, then this cluster's data is written out to the new
file and the amount of data written is recorded.  If the cluster is
in use, then the recovery of the file is halted and the recovered
file is trun...