Re: Can it be recovered???

[John Denker <jsd@MONMOUTH.COM>]

At 09:39 AM 3/6/00 -0500, Ludwik Kowalski wrote:
> While inserting something at the beginning of a long
> document (Microsoft Word, 98 on Mac OS-8.5) I
> accidentally deleted all the rest and simply saved
> the document.
>
> Is there any way to recreate the document as it was
> before the last saving? My computer is still on. What
> software would make the recovery possible? I read
> that criminal investigators often recover deleted files.

At 09:52 AM 3/6/00 -0500, I wrote:
> In a word, yes, it is very likely that all or most of the file can be
> recovered.
>
> URGENT:  Do not do _anything_ on that computer.  Any other program that
> writes a file on that disk greatly decreases the chance of recovery.  As
> the saying goes, do not move an injured patient.
>
> Details to follow.

Sorry I couldn't get back to you sooner;  I had prior obligations.

Here's the deal:  Buy a copy of Norton Utilities.  (They have a Mac version
as well as a windoze version.)  They've got tools for undeleting
files.  (I've read the instructions but never actually used the
tool;  usually when my relatives have such a problem I attack using the big
guns on my Linux laptop.)  There are other things on the same CD that make
the package particularly attractive.

Remember, it is important not do cause any disk activity between the time
of the accident and the time of rescue.  This includes fetching email!

===================

I'll bet a few fizzlers are wondering how it is possible to undelete a
file.  Here's a rough sketch.

Obviously deleting a file is _not_ like erasing a chalkboard.

The key concept is that the disk is a _random access device_ with a
_directory_.  The directory is roughly analogous to the card catalog in a
library;  given the name of a file you can get pointers to which blocks on
the disk surface actually contain the data.  To delete a file, it suffices to
  a) remove the corresponding entry from the directory, and
  b) take the pointers to the newly-free blocks and add them to the
_free-list_.

Note that as soon as the blocks are on the free list, they are eligible to
be overwritten.  They might be overwritten by the very next file that is
created, or they might not, depending on what else is going on in the system.

Similar remarks apply to updating versions of a file.  Most applications do
_not_ update a file in place; instead, they write out the new version and
then delete the old version.

=======

To prevent (or at least alleviate) such problems in the future, you should
get into the habit of checkpointing your files.  That is, take the file
foo.doc and copy it to foo-1.doc.  A little later, copy the current version
(always foo.doc) and copy it to foo-2.doc.  Then foo-3.doc.  (The first
thought that comes into many people's mind is to use the highest-numbered
checkpoint as the current version, but don't do it.  You want the current
version to have an unchanging unnumbered name.)

Disks are about $10.00 per gigabyte these days, so there's not much sense
in economizing on disk space.  Only if/when the disk fills up should you
bother to rampage around and delete some of the ancient checkpoints.

Oh, and you should back up the whole disk to tape (or some other offline
storage) every so often.