 The magazine of the Melbourne PC User Group PowerQuest Lost & Found Stan Johnstone stanj@melbpc.org.au |
 |
 |
In this case, PowerQuest claim that if the disk is still spinning, Lost&Found can recover just about any file. |
In the past
Back in the very early 1980s, a young actuary accidentally deleted a file from his computer. Not content to just try and recreate the information, he rolled up his sleeves and studied what happened when a file was deleted from a disk. Out of this, this young actuary named Peter Norton developed his famous Recover program that formed the beginning of the famous Norton Utilities.
Later on as disks increased and provided some spare capacity, the deleting of files started to be done in two stages - first to a hidden storage directory, and then finally deleting files as the directory filled. This at least gave the user the opportunity to go back to retrieve that file that was still required.
Most of today's operating systems continue this practice with a Recycle Bin keeping deleted files "just in case" you want to try and recover them again.
Installation and a first glance
In these days of CD-ROM installations it's unusual to receive the software on 1.44 MB diskettes. Lost&Found runs only after starting the PC in MS-DOS, and no installation is required as the program runs direct from the floppy drive.
After a quick glance at the 40-page manual, late in the day, I started the program just for a quick look around. My PC has a drive F:, which is a partition on my second drive used for testing, a temporary backup area, and other irregular use. Just having a quick look around I was amazed to see remnants of directories of files that had been deleted more than two years ago. In fact, this drive had been defragmented at least 25 to 30 times in the intervening years, but it appeared I would still be able to recover some files that were intact after all this time.
Already I was becoming convinced this software was something special!
How it works
Reading the handbook it was clear how it differed from other similar programs. In the early days disks were much smaller, and in most cases only one hard disk was installed. For this reason the rebuilding of a file was attempted by rebuilding the FAT files to recover the individual clusters of the deleted file. Lost&Found uses a different approach by copying the recovered parts to another drive or other safe media.
This means that recovery can be made to or from a diskette, another hard drive, a SCSI adapter, or even a Jaz or Zip drive.
Originally the means of deleting a file was to change the first character of
the filename and make it a hidden file. This was done to avoid overwriting a
nondeleted file with the same filename. After recovery it is still necessary to
rename the file back to its original name by changing its first character. Testing it out
As a first test I copied four directories with a total of 38 files to a
diskette so that it was practically full. Then moving to one of the directories
I deleted three .DOC files to test the recovery.
Next, I restarted the computer in MS-DOS mode. The Lost&Found programs
come on two 1.44 MB diskettes, so after loading the first disk (A:\LF) things
started to happen.
Firstly Lost&Found scans the whole machine and identifies all the drives
it can see, and then identifies and checks the validly of each partition. After
this it asks you to select the drive to be checked, and the drive to be used as
the destination for recovered files. During the next stage it checks the whole
of the source disk and produces an Explorer-type file structure where each
directory is opened to display its contents.
When recovering files from the source, the opportunity is presented to copy
them to the new destination in either their original form, or in a compressed
form which may be necessary to fit the space available.
In this case the three deleted files were listed with the first letter of
each file name replaced with a "ó ". They were also displayed
in yellow, indicating there was a very good chance that these files could be
recovered. Different colours are used in the display to identify the varying
chances of recovery. Moving the cursor it was possible to identify those files
to be recovered, and then the next stage carried out the actual recovery.
Windows could now be restarted, and another routine restored the full filename
for files with long names. The files could now be copied back to the original
directory, and renamed as required, replacing the first character.
A text report is also generated listing the selected files, and is a great
help in identifying the original names of files before renaming. An additional
aid would be always to keep a list of all files in each directory for reference.
I have an old DOS program named TREEDIR.COM, and I am sure there must be later
ones permitting the use of long file names.
Next for something more challenging, I went to my drive F: mentioned earlier.
Although about 500 MB in size, it currently had only two subdirectories with a
total of 31 files. This time I decided to delete a whole directory and see what
could be recovered. Repeating the previous actions, the whole directory and its
files were recovered as shown in Figure 1. Instead of the "ó"
replacing the first character, Windows has used the "^"
character as the first character of the directory name (Backup), and it can been
seen each file still has to be renamed. Some guesswork may be necessary if you
are not familiar with the files, but these can now all be moved back to their
original directory on Drive F:
Can files survive
reformatting?
In my first overview I found files years old on my drive F:. What would
happen if I reformatted this drive completely? It was quite frightening to see
the message "Are you sure? All files will be lost (Y/N)"! Be brave,
let's go for it!
With my 522 MB Drive F: completely cleared of files, Lost&Found was again
put to work. It claimed to have found 5,051 files in 517 directories! Looking at
the report it was rather hard to identify the three directories with my current
files, so by checking "All" I let Lost&Found try and find all it
could. As the FAT files would have been destroyed, all this recovery was done
without using them. In this particular case after defragging most files would
have been contiguous and so easier to recover without the FAT files available.
Figure 2 displays all the files and directories (and subdirectories) that
were recovered, although most of the original directory names were replaced with
a Noname00x. Quickly stepping through it was possible to identify the three
current directories, and restoration by copying directories and files could be
made back to their original location. Copying a whole drive is not what you
would want to do every day, but when you are desperate, anything goes!
Recovery from Virus
In a recent well documented case, the Chernobyl virus, which was responsible
for destroying data from thousands of hard drives throughout the world, taught
everyone a very important lesson about the effects of data loss and recovery.
However it is reported that in all known cases, Lost&Found users were able
to retrieve files from Chernobyl-infected computers recovering 100% of the lost,
deleted or corrupted data. That alone makes it a worthwhile product to have on
hand.
Summary
Lost&Found is an amazing piece of software that did far more than would
normally be expected. Hard disks will fail (as was written in last month's PC
Update), but provided they still spin you can feel confident that Lost&Found
will recover material that has not been overwritten before it is too late.
Data recovery services can successfully recover most material but it is
expensive business. Lost&Found will enable you to do the same without having
to mortgage your house to pay for it.
Information Box
Minimum System:
Availability/Cost: Readily
available with a street price of $110
Reprinted from the June 1999 issue of PC Update, the magazine of Melbourne PC User Group, Australia
