Undelete's Levels of Protection
MS-DOS version 6 offers an enhanced Undelete command that helps you recover a file you've deleted. It includes three levels of protection: standard, Delete Tracker, and Delete Sentry. Standard uses information recorded by MS-DOS to recover a deleted file. It works by reinstating the information about the disk location where the deleted file was stored. Of the three levels of guarding against file deletion, standard provides the lowest level of protection. You can use it to recover a deleted file as long as MS-DOS has not placed another file in any portion of the deleted file's location. The standard level of protection is available when you switch on your computer.
Delete Tracker offers the next higher level of Undelete's file protection. It uses a hidden file named PCTRACKR.DEL to hold disk-storage information about the files you delete. Once you start Delete Tracker for a disk drive, Undelete records storage information for all subsequent deleted files. Undelete can then use this information to try to recover one or more deleted files. If MS-DOS has placed another file over part of the deleted file's location, Undelete attempts to restore part of the file. Note that Delete Tracker in version 6 works in the same way as the delete tracking feature in version 5, which is discussed in the next section, "Undelete and Delete Tracking."
To choose the Delete Tracker level of protection, type the Undelete command and specify the /T switch and the drive you want to protect. For example, to activate Delete Tracker on drive A, you would type the following at the command prompt (do not type this command now):
A:\>undelete /ta
Delete Sentry offers the highest level of protection against accidental file deletion. It creates a hidden directory named SENTRY to which a deleted file is moved without changing the record of the file's location. When you undelete the file, MS-DOS moves the file back to its original location. With Delete Sentry protection, you don't have to worry about MS-DOS placing another file in the deleted file's place. The deleted file remains tucked away on your disk, safe and sound. Undelete truly removes the file from your hard disk either after seven days or when Undelete needs more room in the SENTRY directory.
To activate the Delete Sentry level of protection, specify the /S switch and the drive you want to protect. If you're selecting the current drive, you don't need to include the drive letter designation. For example, if the current drive is A, type the following at the command prompt (type this command now after you're sure Microsoft Windows is not running):
A:\>undelete /s
Now delete the test files you created earlier:
A:\>del report.txt
A:\>del bank.txt
A:\>del forecast.txt
A:\>del budget.jan
A:\>del budget.feb
Now check the directory again:
A:\>dir
Volume in drive A is EXAMPLES 1
Volume Serial Number is 1A2C-13F5
Directory of A:\
File not found
If there were other files on the floppy disk you put in drive A, they'll still appear in the report, but the five files you deleted should be gone.
If you have version 6, try using the Undelete command to retrieve all the files you deleted. The following list describes most of the parameters for the version 6 Undelete command. To find out about Undelete's advanced parameters, see Appendix C, "MS-DOS Command Reference."
undelete
/ds recovers only those files protected by the Delete Sentry level, prompting for confirmation on each file. Undelete assumes /ds if the SENTRY directory exists, even if you don't include this parameter.
/dt recovers only those files protected by the Delete Tracker level, prompting for confirmation on each file.
/dos recovers only those files that are internally listed as being deleted by MS-DOS, prompting for confirmation on each file. If a deletion-tracking file exists, this switch causes Undelete to ignore it.
/all recovers all deleted files without prompting for confirmation on each.
/list lists the deleted files that are available to be recovered but does not recover any files. You can restrict the resulting list by using the
/U disables the Delete Tracker or Delete Sentry protection.
/status displays the type of delete protection in effect for each drive. You cannot specify any other parameters when you use /status.
/S
/T
You just deleted several files from the disk in drive A. To request a list of these files, type this:
A:\>undelete /list
The Undelete command responds with a display like this:
UNDELETE - A delete protection facility
Copyright (C) 1987-1993 Central Point Software, Inc.
All rights reserved.
Directory: A:\
File Specifications: *.*
Delete Sentry control file contains 5 deleted files.
Deletion-tracking file not found.
MS-DOS directory contains 5 deleted files.
Of those, 0 files may be recovered.
Using the Delete Sentry method.
REPORT TXT 23 01-05-95 9:16a ...A Deleted: 01-06-95 3:24p
BANK TXT 23 01-05-95 9:16a ...A Deleted: 01-06-95 3:24p
FORECAST TXT 23 01-05-95 9:16a ...A Deleted: 01-06-95 3:25p
BUDGET JAN 70 01-05-95 9:16a ...A Deleted: 01-06-95 3:25p
BUDGET FEB 23 01-05-95 9:16a ...A Deleted: 01-06-95 3:25p
Let's examine this report. Although it's long, it's not difficult to interpret. After three lines of introductory text, Undelete lets you know where it is searching for the deleted files and what type of files it is searching for. In this case, it's looking in the root directory of the disk in drive A, and it's looking for all deleted files.
The next section of the report gives information about each level of protection. You can see that Undelete found five files protected by the Delete Sentry level, no files protected by the Delete Tracker level, and five files protected by the standard level (MS-DOS). Notice that in this case Undelete says that it can't recover the five files by using the standard method. You need to use the Delete Sentry method.
Finally, the report lists the five deleted files, giving their names, sizes, and dates and times of creation. The ...A tells you that the files have not been backed up (archived), and the remainder of each line tells you the date and time the file was deleted.
Suppose you want to use the Undelete command to recover the file REPORT.TXT. By default, Undelete recovers only those files protected by the Delete Sentry level. Because you have been using the Delete Sentry level of protection, all you have to do is type the following:
A:>undelete report.txt
(Because we're now running under the Delete Sentry level of protection, if you had been using Delete Tracker when the file was deleted, you would have had to add the /dt parameter, and if you had been using the standard level when the file was deleted, you would have had to add /dos.) You see the same introductory text as before, and then Undelete displays this:
Directory: A:>
File Specifications: REPORT.TXT
Delete Sentry control file contains 1 deleted files.
Deletion-tracking file not found.
MS-DOS directory contains 1 deleted files.
Of those, 0 files may be recovered.
Using the Delete Sentry method.
REPORT TXT 23 01-05-95 9:16a ...A Deleted: 01-06-95 3:24p
This file can be 100% undeleted. Undelete (Y/N)?
Type y, and in a moment the recovery process ends:
File successfully undeleted.
To recover all deleted files on this disk, or to search through the deleted files and recover only those you want, you would then type undelete. For each file that Undelete could recover, it would display a message and prompt similar to those you just saw. In each case, you would type y or n to tell Undelete whether to recover or to ignore the file.
Before continuing, delete REPORT.TXT once again to return your sample disk to its earlier state.
No comments:
Post a Comment