[<<]Message[>>]    [<<]Author[>>]    [<<]Subject        [<<]Thread[>>]

Number   :  3705
Date     :  2003-02-14
Author   :  james sadler
Subject  :  Re: undoing /clone
Size(KB) :  7


 For the purpose of various "find" operations I
create a nonstandard word such as bullfrog44. If I
need to search through docs, txts etc. the ones that
have importance to me are tagged with the nonsense
word. That way the search only returns a few dozen
files rather than thousands.
--- meirman@e... wrote:
> At 02:55 PM 2/13/03 -0000, jamesvmerrill
>  wrote:
> >When files are deleted from a directory, all that
> happens is that the 
> >first byte of the name is changed to something that
> means "this entry 
> >in the directory is available for use." When a new
> file is copied to 
> >that same directory, that available-for-use entry
> in the directory is 
> >written over.
> 
> I forgot that there are both directory entries and
> general file space. My
> question about file space still is worthwhile, even
> if it likely does not
> apply here.
> 
> >If you had copied files to a different directory,
> you probably would 
> >have been able to recover the data.
> >
> >What was lost is the directory entry saying where
> the data from the 
> >deleted file is stored on the disk. The data
> itself is probably 
> >still on the disk. If you really need to get it
> back, examining 
> >the "free space" on the disk might find the bytes. 
> (But that's quite 
> >a PITA.)
> 
> I should have thought of this earlier. I'm sorry. 
> 
> I actually have a lot of experience with this. The
> bug is fixed now, but
> it used to be that if the OS crashed, posts and
> emails that one had "saved"
> in Agent weren't fully saved. (Closing all the
> windows saved everything,
> but I didn't know that for quite a while, and I had
> a lot more crashes than
> most do.)
> 
> So if I could recall some key words, I did go
> through the tedious procedure
> of finding the data. This pretty much only works
> with text files because
> non-text is too hard to recognize, and you may find
> several copies of the
> same file, only one of which is the newest. Once I
> found one article that
> I had saved, they were all grouped together and I
> could find the rest in
> one chunk. That was at the beginning. Later, the
> chunk was too small to
> have everything I was looking for. Defragging or
> running SpeedDisk (in
> advance, before the crash) didn't seem to help. The
> partition was getting
> close to almost full, and I'm assuming that it
> stored things in scattered
> clusters because of that.
> 
> From Norton utilities, run "diskedit /M". /M
> bypasses dos and looks at
> the disk directly. Although I never did this from
> windows, I think you can
> do this from windows because I think you don't need
> to go into Update mode.
> You're copying things out instead of updating the
> data you find. So at
> least if you copy things to another harddrive or a
> floppy, you can probably
> use windows, a dos-box. (not that it works easier
> in windows, but you
> might already be in windows.)
> 
> Say alt-O (For the O column, you only have to hit
> O, but for other
> columns, you must hit both keys at the same time,
> not like in Windows) and
> then choose "Drive". It gives you the option of
> going by logical disks
> of physcial disks. Since I had several partitions,
> logical disks would
> have given me much less to search, but somehow it
> wouldn't work at all that
> way. I forget the details. So choose which
> harddrive you want to search.
> 
> Alt-tools-find (cntl-S) will enable you to look for
> text that you remember.
> When you find one occurrence, write down the
> numbers in the bottom right,
> and bottom left. One of them is what you need to
> get back to where you are
> at the moment, and one, maybe the same one is what
> you need to copy the
> data out..... If you want more detail, I'll provide
> it, but you need to
> check for later occurrences of the same files, if
> you have in any way saved
> them more than once and the copies are different.
> 
> You probably need to use the alt-view-text command
> (I used to use the
> hex/text view, but text is easier to read.) You
> need to use the alt-edit
> mark command and the alt-tools Write To command). 
> You need to scroll up,
> using the mouse and the scroll bar iiir (or maybe
> it's the page up key.
> One of them is no good.) to find the earliest piece
> of data that you are
> interested in, note the cylinder, side, sector
> numbers at the start. Then
> scroll down to the end and note the C,S,S there,
> write them down, and
> calculate the total number of sectors, add a couple
> just to be sure, and
> Write To an external file. DON'T CONFUSE THIS with
> the
> alt-edit-Write-Changes command, which should be
> greyed out anyhow since
> edits shouldn't be permitted. I did this probably
> 20 times or more and it
> took a while to get good at it. But if you're not
> in edit mode when you're
> in Diskedit, I don't think you do any harm. When
> you are in /M,
> maintenance mode, I think the default is Not Edit
> mode.
> 
> I'm sorry I didn't think of this earlier. Just the
> Finding can take a
> long time in a big drive. Although later I learned
> that the area was
> always about 75% down, and I could move the scroll
> bar indicator half way
> down or more and skip much of this. I couldn't skip
> as much as I wanted to
> or it sprang back.
> 
> 
> >--- In xxcopy@yahoogroups.com, "S.Y.Lye
> "  
> >wrote:
> >> --- In xxcopy@yahoogroups.com, meirman@e...
> wrote:
> >> > I"m actually not sure how the OS handles this. 
> Does it leapfrog 
> >> file after
> >> > file all the way to the end of the partition
> before it starts 
> >using 
> >> freed
> >> > up space (from deleted files) at the start of
> the partition? Or 
> >> does it
> >> > use the first empty space it can find that is
> big enough to hold 
> >> the file
> >> > being written?
> >> > 
> >> > Meir 
> >> > 
> >> > meirman@e... Baltimore, MD, USA
> >> 
> >> Well, yup, I was quite wondering how does the OS
> really do this. As 
> >> for your guys info, I'm using Win98SE. As a wil
> guess, the OS 
> >> just 'randomly' select the space that's available
> and write new 
> >data 
> >> on to it? 
> >> 
> >> Another weird thing is, I've just done an
> experiment just now, and 
> >> find out that files being deleted by xxcopy
> /clone is not seen at 
> >all 
> >> by using some of the Data Recovery software out
> there, such as "PC 
> >> Inspector", "R-Studio". I run through those
> software once the 
> >> destination files were deleted by xxcopy /clone,
> without saving any 
> >> extra data into my machine. But I can't see any
> files in the 
> >> destination folder. 
> >> 
> >> And then, I did another experiment, which, I
> manually permanently 
> >> delete some files in a folder, then immediately I
> save some other 
> >new 
> >> files into the same folder, I found out that by
> using the recovery 
> >> tools, I can't find those deleted file too. As a
> conclusion, 
=== message truncated ===


__________________________________________________
Do you Yahoo!?
Yahoo! Shopping - Send Flowers for Valentine's Day
http://shopping.yahoo.com



This message if part of XXCOPY's message Archive.
The archive contains all the messages posted at Yahoo!Groups: XXCOPY.