undelete

Attempts the recovery of deleted files.
   undelete [directory] [options]
Where [directory] is the location where the file to be undeleted is. If no directory is given, the current working directory is assumed.

There are also more advanced undelete options:
 
   undelete /action source destination [size]
See below for details of the advanced actions and parameters.

Options

   /ALL
   Undelete ALL files in the given directory without prompting for each file

   /LIST
   Lists files that can be undelete without prompting to undelete; no action
   is taken.

Advanced Actions

   /SYSSAVE
   Saves a copy of the given source, which can be:
      fat1    the FAT (file allocation table), 1st copy
      fat2    the FAT (file allocation table), 2nd copy
      boot    boot sector (part of drive used to start the computer)
      root    root directory

   /FOLLOW
   Looks for a (possibly deleted) file starting at the source cluster
   and saves data to the destination file. The output of DIRSAVE
   helps you to find the right cluster number.

   /DIRSAVE
   Like FOLLOW, but saves a directory to a file. The source
   directory must be given by absolute path starting with \ OR by cluster
   number. Also shows a technical directory listing on the screen.

Other Parameters in the advanced actions

  source
  The exact nature of the source depends upon the action (see above) but
  it is always on the current working drive.

  destination
  The file which will store the recovered data.
  Cannot be on the current drive.

  size
  Optional.
  Overrides the autodetected size (which is sometimes too big).
  The value should be given as the number of:
    - clusters (for action FOLLOW)
    - sectors (for action DIRSAVE)

Using Undelete

1. Finding undeleteable files and directories:

Run undelete in DIRSAVE mode. You will see deleted directory entries specially marked, and you will see their cluster numbers on the screen. You can redirect screen output to a file, for example:

   undelete DIRSAVE \ x:rescued.dir >logfile
Where logfile will contain the screen output.
If you have the FreeDOS utilites installed on your system, you could use something like one of the following instead:
   undelete DIRSAVE \ x:rescued.dir | tee logfile
   undelete DIRSAVE \ x:rescued.dir | tee logfile | more
These will display the information on screen as well as store it in the logfile.

2. Recovering an undeleteable file

Find the starting cluster of the file using DIRSAVE, as explained above. Then use FOLLOW on that cluster, for example:

   undelete FOLLOW 1234 x:rescued.bin
would save the contents of the deleted file starting on cluster 1234 to the file rescued.bin on drive x)

Advanced Uses

- Recovering from within deleted directories
Run DIRSAVE on an existing directory to find the starting cluster of the deleted directory. Then run DIRSAVE on that cluster to find deleted files and directories within the deleted directory... and so on with successive cluster numbers as required.)

- Recovering partially overwritten files
Use FOLLOW on the existing new files and override the size value (in clusters, undelete tells you how big a cluster on the current drive is when you start undelete). So, if you have accidentally overwritten a long file "OLD" with a short new file "NEW":

- Using undelete to "mirror" important drive data
If your filesystem gets completely broken, you can try to write back the important data saved by SYSSAVE. The saved information is to be stored on a seperate disk. You may also wish to use the mirror command, which is simpler to use but stores the saved information at the end of the disk.

- Restoring the "mirror" data
This may be necessary in some cases of disk disaster.
WARNING: This is for experts, repair-men and very desperate people only! Doing this incorrectly or unnecessarily could make things worse!

See Also

Mirror
Unformat

Copyright © 2003 Eric Auer
This file forms part of The FreeDOS HTML Help Documentation, and is covered under its terms: see index.htm