NetNews Usenet Archive 1993 #3/NN_1993_3.iso/spool/comp/os/msdos/programm/12377

Internet Message Format | 1993-01-24 | 4.0 KB

Path: sparky!uunet!gatech!usenet.ins.cwru.edu!agate!spool.mu.edu!olivea!charnel!sifon!clouso.crim.ca!hobbit.ireq.hydro.qc.ca!beaurega
From: [e-mail] (Denis Beauregard)
Newsgroups: comp.os.msdos.programmer
Subject: Re: Unerase - how does it wor
Message-ID: <[e-mail]>
Date: 23 Jan 93 20:59:30 GMT
References: <[e-mail]> <[e-mail]> <[e-mail]>
Sender: [e-mail] (Netnews Admin)
Organization: Institut de recherche d'Hydro-Quebec, Varennes, Canada
Lines: 62

In article <[e-mail]> [e-mail] (PAULIN MARC) writes:
>In article <[e-mail]> [e-mail] (Denis Beauregard) writes:
>>Now, about the poster question.  How does UNERASE to retrieve the chain?
>>It guesses.  A sequential written file (i.e. after saving a text file)
>>will use the sequential available clusters and the "erased" file entry
>>still contains the 1st FAT entry position.  Thus, the 1st guest is
>>that 1st FAT and the next available clusters.  Is the file is less than
>>one cluster size (i.e. with older DOS versions and larger disks,
>>a cluster was likely 8k, with
>>last DOS or smaller disks, it is more likely 2k), so if the file is small
>>enough (and the UNERASE program knows the size of a cluster) and the cluster
>>is available, then the UNERASE program will say that this file can be unerased.
>>But if the file is larger, then the probability it can be unerased is smaller.
>>To add to confusion, some disk utility will preserve the chains after
>>erasing a file, so the files can be unerased with less guess.  Also, there is
>>probably some method (which I just don't know) to find the chain in DOS
>>memory, but this is a guess.
>
>
>    Es-tu sur?  It guesses?  You mean it guesses the file position on
>the disk?  I doubt it.  What if the file is fragmented?  That's not

Most data is written in the next sequentially available cluster.
In other words, if I read a large file into memory, modify it and save
it to disk, the clusters DOS will use will be each consecutive available
cluster.  Fragmentation will occur later, after you erased files using
the intermediate clusters.

>sequential.  When the file is erased, the pointers in the FAT that points to
>the clusters are not erased.  Only the first character of the filename is.

Yes, they are.  See the FAT format.  A FAT entry indicates either a
free cluster, the next cluster for the same file or the last cluster in
a file.  Nothing to link a free cluster.  Actually, the DOS does this:
in the directory entry, erase the name by overwritting the 1st character;
in the FAT table, replace all cluster links entries by free cluster entries.
From the directory erase operation, the 1st cluster position is known,
but from the FAT operation, the other clusters are unknown.  The guess
is on the other clusters.

>When you use UNERASE or UNDELETE, it checks the directory structure for
>filenames with the first character deleted, then checks the FAT if all the
>pointers are there and intact, then asks you for the character.  Don't

It can't.  Only the first cluster is known.  The chain is missing.

>forget that the filename found in the directory contains the address of the
>first pointer in the FAT.  So it's not a sequential search.  Imagine for a
>500Meg HD, it would take dozens of minutes to sequentially scan all
>available clusters.

So, try this test.  Write many small files.  Delete some of them so as
to create a random pattern.  Re-boot (if you don't, DOS will continue
to write at the next cluster available following the last write).
Write a large file.  Delete the many small files and the large file.
Try to unerase the large file and give me some news...

--
  \_\    Denis Beauregard  *  internet:[e-mail]
 /   \   Ge'ne'alogiste des familles : Beauregard/Jarret/Jarest/Vincent
J   __>  Un Que'bec renouvele' dans une Ame'rique renove'e
\_.-===  Ope'rateur de "Racines du Que'bec" [phone] BBS/Genealogie