Undelete a file

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Srinand - 22 Apr 2006 06:15 GMT

Hello, Am actually trying to write a program to undelete a file in
windows. For that I need to get the details of the files that are
deletd. Coudl someoen give me some inputs as to how should I do that.
Just wanted to know where will that list be stored in the clusters. I
mean in which table ? In the FAT, or in Date Area ? And also what would
be the offset to get that location. Kindly help me out asap ..

Reply to this Message

Jeff Richards - 22 Apr 2006 06:24 GMT

You should be looking in the directory, not the FAT. The directory entries
for deleted files have the initial character of the filename overwritten.
See, for instance:
http://www.seas.ucla.edu/classes/mkampe/cs111.sq05/docs/dos.html
(Section 4)

Signature

Jeff Richards
MS MVP (Windows - Shell/User)

> Hello, Am actually trying to write a program to undelete a file in
> windows. For that I need to get the details of the files that are
> deletd. Coudl someoen give me some inputs as to how should I do that.
> Just wanted to know where will that list be stored in the clusters. I
> mean in which table ? In the FAT, or in Date Area ? And also what would
> be the offset to get that location. Kindly help me out asap ..

Reply to this Message

Srinand - 22 Apr 2006 06:37 GMT

Thanks for the quck reply richards. But how do I get the offset of the
first directory entry in a partition ? And from thereafter how do i get
offsets of the next directory entry ?

Reply to this Message

Jeff Richards - 22 Apr 2006 22:57 GMT

A DOS directory is a file (of a special type) that contains a series of
fixed sized (32 byte) directory entries. The location of the root directory
is specified in the BIOS parameter block (by default, it follows the FATs).
The root directory contains references to sub directories as files.

See, for instance:
http://support.microsoft.com/kb/q140418/
http://www.pcguide.com/ref/hdd/file/fat.htm
The code that calculates the location of the root directory (as an LBA) is
here:
http://www.ata-atapi.com/hiwdos.htm

Signature

Jeff Richards
MS MVP (Windows - Shell/User)

> Thanks for the quck reply richards. But how do I get the offset of the
> first directory entry in a partition ? And from thereafter how do i get
> offsets of the next directory entry ?

Reply to this Message