Undeletion is a feature for restoring computer files which have been removed from a file system by file deletion. Deleted data can be recovered on many file systems, but not all file systems provide an undeletion feature. Recovering data without an undeletion facility is usually called data recovery, rather than undeletion. Although undeletion can help prevent users from accidentally losing data, it can also provide a computer security risk, since users may not be aware that deleted files remain accessible.
Graphical user environments often take a different approach to undeletion by introducing a "holding area" for files to be deleted. Undesired files are moved to this holding area, and all of the files in the holding area are periodically deleted. This approach is used by the Trash can in Macintosh operating systems and by the recycle bin in Microsoft Windows. This is a natural continuation of the approach taken by earlier systems, such as the limbo group used by CP/M
Another approach is offered by programs such as Norton GoBack (formerly Roxio GoBack): a portion of the hard disk space is set aside for file modification operations to be recorded in such a way that they may later be undone. This process is usually much safer in aiding recovery of deleted files than the undeletion operation as described below.
When a file is deleted on a FAT file system, its directory entry remains stored on the disk, slightly renamed in a way that marks the entry in FAT table as available for use by newly created files thereafter. Most of its name, time stamp, file length and — most importantly — location on the disk, remain unchanged in the directory entry (root directory which is represented using . or .. in FAT 16 or FAT32). The list of disk clusters occupied by the file will be erased from the File Allocation Table, however, marking those sectors available for use by other files created or modified thereafter.
When undeletion operation is attempted, the following conditions must be met for a successful recovery of the file:
Chances of recovering deleted files is higher in FAT16 as compared to FAT32 drives, fragmentation of files somehow is less in FAT16 due to large cluster size support (1024Bytes, 2KB, 4KB, 8KB, 16KB, 32KB and 64KB which is supported only in Windows NT) as compared to FAT32 (4KB, 8KB, 16KB only).
If the undeletion program can not detect clear signs of the above requirements not being met, it will restore the directory entry as being in use and mark all consecutive sectors (clusters), beginning with the one as recorded in the old directory entry, as used in the File Allocation Table. It is then up to the user to open the recovered file and to verify that it contains the complete data of the formerly deleted file.
If the data of the recovered file is not correct, parts of the file may still be stored in other sectors of the disk, but recovery of those is not possible by automatic processes but only by manual examination of each (unused) block of the disk. This is usually unfeasible and can only be performed by specialists that have very good knowledge of both the disk structure and the data being searched.
Best utility software: PC Tools for Windows from Dustin Discount Software. (Central Point Software) (Brief Article)
Jan 01, 1994; Dustin Discount Software 20969 Ventura Blvd. Woodland Hills, CA 91364 1-800-766-2896 Price: $99 There is something about Windows...