Command: undelete

 UNDELETE attempts the recovery of deleted files.

Syntax:

  Basic Syntax:
  undelete [path] [/ALL|/LIST] [/Edrive[:directory]]
  Prompts to undelete recoverable files from the current working
  directory, or from the given path.
           directory  The location where the file to be undeleted is.
                      If no directory is given, the current working
                      directory is assumed.
  Advanced Syntax:
  undelete [/action] [what] [destination] [optional size]

Options:

    /ALL         Automatically undelete ALL recoverable files without
                 prompting first.
    /LIST        Lists the recoverable files without prompting for
                 recovery; no action is taken.
    /E           Exports any undeleted files to an external disk and
                 optional directory. With this option the source disk
                 isn't modified.
  Possible (advanced) [/action]s:
    follow       Looks for a deleted file (skips over used clusters!)
                 starting at the cluster [what] and saves data to a file
                 given as [destination]. The output of DIRSAVE helps you
                 to find the right cluster number.
    extract      Like FOLLOW but follows a still existing file according
                 to FAT.
    dirsave      Like all above, but saves a directory to a file.
                 Directory [what] must be given by absolute path
                 (starting with \) OR by cluster number. Also shows a
                 technical directory listing on the screen!
    syssave      Saves the 1st or 2nd FAT, boot sector or root
                 directory. No [size] allowed. Select fat1, fat2, boot,
                 or root in [what]. "Mirror" mode.
    size         Specifying no [size] or [size] 0 will cause auto-
                 detection. Unit of [size] is clusters for FOLLOW,
                 sectors for DIRSAVE. DIRSAVE works the same for both
                 existing and deleted directories.
    destination  Must be on a drive other than the current drive. Data
                 is always read/recovered from the drive from which
                 undelete is invoked.

Comments:

  Using UNDELETE:
    1. Finding undeletable files and directories:
       Run undelete in DIRSAVE mode. You will see deleted directory
       entries specially marked, and you will see their cluster numbers
       on the screen. You can redirect screen output to a file, for
       example:
         undelete /DIRSAVE \ x:\rescued.dir >y:\logfile
       Where logfile will contain the screen output.
       If you have the FreeDOS utilites installed on your system, you
       could use something like one of the following instead:
         undelete /DIRSAVE \ x:\rescued.dir | TEE y:\logfile
         undelete /DIRSAVE \ x:\rescued.dir | TEE y:\logfile | MORE
       These will display the information on screen as well as store it
       in the logfile.
    2. Recovering an undeletable file:
       Find the starting cluster of the file using DIRSAVE, as explained
       above. Then use FOLLOW on that cluster, for example:
         undelete FOLLOW 1234 x:\rescued.bin
       would save the contents of the deleted file starting on cluster
       1234 to the file rescued.bin on drive x.
  Advanced Uses:
    - Recovering from within deleted directories
      Run DIRSAVE on an existing directory to find the starting cluster
      of the deleted directory. Then run DIRSAVE on that cluster to find
      deleted files and directories within the deleted directory... and
      so on with successive cluster numbers as required.
    - Recovering partially overwritten files
      Use FOLLOW on the existing new files and override the size value
      (in clusters, undelete tells you how big a cluster on the current
      drive is when you start undelete). So, if you have accidentally
      overwritten a long file "OLD" with a short new file "NEW":
      * find the cluster number of "NEW".
      * give the size of "OLD" when using FOLLOW.
      * The recovered output will begin with the contents of "NEW" but
        should contain the not-overwritten end of "OLD" as well,
        hopefully.
    - Using undelete to "mirror" important drive data
      If your filesystem gets completely broken, you can try to write
      back the important data saved by SYSSAVE. The saved information
      has to be stored on a separate disk. You may also wish to use the
      MIRROR command, which is simpler to use but stores the saved
      information at the end of the disk.
      * Run undelete in SYSSAVE mode for all 4 sources: fat1, fat2,
        boot, root.
      * Keep the files in a safe place.
    - Restoring the "mirror" data:
      This may be necessary in some cases of disk disaster.
      WARNING: This is for experts, repair-men and very desperate people
      only! Doing this incorrectly or unnecessarily could make things
      worse!
      * Glue the 4 sources together in the order "boot fat1 fat2 root"
        to reconstruct the first part of your partition, starting with
        the first sector.
      * you could use DEBUG (w command) to restore this info
      * You can also merge saved and existing data with a hex editor.

Examples:

  - see COMMENTS above -

Command: undelete

Syntax:

Options:

Comments:

Examples:

See also: