In this post I am going to write about how data recovery undelete software and data recovery undelete programs work in the MS-DOS operating system.

In this post I am also going to write about how data recovery undelete software and data recovery undelete programs work in any Windows operating system.

First I am going to write about how data recovery undelete software and data recovery undelete programs work in the MS-DOS operating system.

The MS-DOS operating system uses the Fat(File Allocation Table) file system.

When a file is deleted in MS-DOS the first character of the file name is replaced with E5 hex. The E5 hex lets the MS-DOS operating system know that the file is deleted and the space used on the disk is ready to be overwritten by another file.

The space for the deleted file may not be overwritten right away. Until the space for the deleted file is overwritten you can use an undelete program or any undelete software to undelete and recover the file.

When the file is deleted and the first character of the file is replaced with E5 hex the only other information for the file that is changed on the disk is the Fat(File Allocation Table) entries. The Fat(File Allocation Table) entries are cleared and set to 00 hex.

All of the other information about the file on the disk is unchanged. The directory entry for the file is still there on the disk unchanged with the exception of the first character of the file name being changed to E5 hex and the data that was stored in the file is still on the disk.

All a data recovery undelete software or data recovery undelete program needs to do to undelete the file is replace the first character of the file name which is E5 hex with any valid character for a file name and rebuild the Fat(File Allocation Table) entries for the file.

Some undelete programs will replace this E5 hex with whatever character they want and let you know what the name of the undeleted file is. Some undelete software will ask you to type the character that you would like to use as the first character of the file name.

When E5 hex is replaced with a valid character and the Fat(File Allocation Table) entries for the file are rebuilt then the file is undeleted.

After you have deleted a file in MS-DOS that you would like to recover it is very important that you try to recover the file right away before any data is written to the disk that the file was deleted from.

Two reasons the data could be overwritten when using MS-DOS is below.

Using the defrag built into MS-DOS or any defrag program can destroy the information for the deleted file and make recovery impossible.

Also if you install any program in the MS-DOS operating system or copy any files to the disk MS-DOS is installed on this could overwrite data that you want to undelete or recovery. This assumes that the data you want to undelete was deleted from the drive or partition that MS-DOS was installed on.

Now I am going to write about how data recovery undelete software and data recovery undelete programs work in any Windows operating system.

The Windows operating system can use either the Fat(File Allocation Table) file system or the NTFS (New Technology File System).

Most of the information in this post assumes your windows operating system use the Fat(File Allocation Table) file system. Some of the information below can still be useful if your windows operating system uses the NTFS(New Technology File System).

Any windows operating system from the windows 95 operating system to the current Windows 7 operating system support using long file names.

If you are using any windows operating system that supports long file names then undeleting a file is somewhat different than it is in MS-DOS.

The undelete program would still have to replace the first character of the file name which would be E5 hex for a deleted file with a valid character for the file name and rebuild the Fat(File Allocation Table) entries for the file just like I wrote about above when undeleting a file in MS-DOS. This part of undeleting a file is the same thing you do when undeleting a file in the MS-DOS operating system.

The one thing that is different when a file with a long file name is deleted in an operating system that supports long file names is below.

The directory entries for the long file name are changed to E5 hex.

You can see this change if you look at the long file name information with a disk editor before and after it is deleted.

Any undelete software you use will have to be programmed with long file name support to undelete the file with long file names properly.

Long file names have been around a long time so any undelete or data recovery software should be able to handle long file names properly.

After you have deleted a file in any Windows operating that you would like to recover it is very important that you try to recover the file right away before any data is written to the disk that the file was deleted from.

Any data written to the disk could overwrite the data for the file that you want to undelete.

The information below about how data might be overwritten when using any windows operating system can be useful when your windows operating system is using the Fat(File Allocation Table) file system or the NTFS(New Technology File System).

Some reasons are below that data might be written to the disk if you are using any windows operating system.

Windows update might be enabled on your windows operating system. If it is enabled it could download updates to your computer and also install those updates. Downloading the updates to your computer or installing the updates on your computer could overwrite the information on the disk for the file you want to undelete and recover.

Also If you are using a web browser to go download an undelete data recovery program then you should probably do this from a different computer than the one that you want to undelete and recover your file from.

The reason for this is because Internet Explorer and all web browsers save files to your disk when you are going to different websites. Sometimes the data is cookies. Sometimes the data is cache files. Also I think that internet explorer changes the windows registry to include the url of the websites you are visiting. Doing any of this can overwrite the data you want to undelete and recovery.

Using windows defrag or any defrag program can destroy the information for the deleted file and make recovery impossible.

By default defrag is set to run on a schedule once a week in windows vista and windows 7 when the computer is on but idle.

Also if you install any programs in the Windows operating system or copy any files to the disk Windows is installed on this could overwrite data that you want to undelete or recover. This assumes that the data you want recovered was on the same disk or partition that windows is installed on.

The point I am trying to make is that data is written to the disk in the background all the time in windows operating systems and you need to undelete the file as soon as possible so that the data for the file is not overwritten.

Even if you install undelete programs or data recovery programs on a different drive than what windows is installed on you will still overwrtie some data on the drive windows is installed on because programs that are installed in windows usually write to the windows registry which is on the drive windows is installed on.

If you need to undelete or recover data in the windows operating system and you don’t have any programs already installed on your computer to do this I suggest that you use portable undelete and data recovery programs because these don’t need to be installed and will not modify the registry of the windows boot drive.

If the data for the file you want to undelete is overwritten you will not be able to recover the file.

For information on undeletion see the Wikipedia Undeletion article

About these ads