Undelete a file

Srinand · External Since: Apr 21, 2006 Posts: 2

Hello, Am actually trying to write a program to undelete a file in
windows. For that I need to get the details of the files that are
deletd. Coudl someoen give me some inputs as to how should I do that.
Just wanted to know where will that list be stored in the clusters. I
mean in which table ? In the FAT, or in Date Area ? And also what would
be the offset to get that location. Kindly help me out asap ..

Srinand · External Since: Apr 21, 2006 Posts: 2

Thanks for the quck reply richards. But how do I get the offset of the
first directory entry in a partition ? And from thereafter how do i get
offsets of the next directory entry ?

Jeff Richards · External Since: Mar 14, 2004 Posts: 1333

You should be looking in the directory, not the FAT. The directory entries
for deleted files have the initial character of the filename overwritten.
See, for instance:
http://www.seas.ucla.edu/classes/mkampe/cs111.sq05/docs/dos.html
(Section 4)
--
Jeff Richards
MS MVP (Windows - Shell/User)
"Srinand" <srinandsk DeleteThis @gmail.com> wrote in message
news:1145682914.453654.198340@g10g2000cwb.googlegroups.com...
> Hello, Am actually trying to write a program to undelete a file in
> windows. For that I need to get the details of the files that are
> deletd. Coudl someoen give me some inputs as to how should I do that.
> Just wanted to know where will that list be stored in the clusters. I
> mean in which table ? In the FAT, or in Date Area ? And also what would
> be the offset to get that location. Kindly help me out asap ..
>

Jeff Richards · External Since: Mar 14, 2004 Posts: 1333

A DOS directory is a file (of a special type) that contains a series of
fixed sized (32 byte) directory entries. The location of the root directory
is specified in the BIOS parameter block (by default, it follows the FATs).
The root directory contains references to sub directories as files.

See, for instance:
http://support.microsoft.com/kb/q140418/
http://www.pcguide.com/ref/hdd/file/fat.htm
The code that calculates the location of the root directory (as an LBA) is
here:
http://www.ata-atapi.com/hiwdos.htm
--
Jeff Richards
MS MVP (Windows - Shell/User)
"Srinand" <srinandsk DeleteThis @gmail.com> wrote in message
news:1145684226.493052.266850@t31g2000cwb.googlegroups.com...
> Thanks for the quck reply richards. But how do I get the offset of the
> first directory entry in a partition ? And from thereafter how do i get
> offsets of the next directory entry ?
>

msegura501 · Joined: Nov 25, 2007 Posts: 1

Hi,

Have you tried FilesLost?
They can recover files deleted in a FAT32 and NTFS.
Hope this helps.
Cheers,

Marc