Diamond Edge Demo Version Extendible Help System File: UNDEL.HLP Topics covered: ù Configuring Diamond Mirror ù Choosing your Undelete method ù Undeleting Files ù What to do after you undelete a file ù Configuring Diamond Mirror One of the keys to successful recovery of deleted files is knowledge of the FAT structure prior to deletion. Diamond Mirror is an auto folder program provided to save FAT and directory structure information at user specified intervals. Diamond Mirror can be configured either from within Diamond Edge by selecting Configure DMIRROR from the Undelete menu or by running DMIRROR.PRG from the GEM desktop. The following items need to be specified to configure Diamond Mirror: ù What drive to Mirror: Select the drives that you want Mirrored by clicking on the appropriate drive buttons. You may select as many or as few of your active devices that you want to Mirror. ù How often to Run Mirror: You can select to have Diamond Mirror execute every time your machine is booted up, once per day, or once per week. It is usually best to keep your Mirror files reasonably current. You can bypass any scheduled Mirroring by pressing ALT-S just before Diamond Mirror is scheduled to run. ù Where to put your Mirror files: Specify the path that the Diamond Mirror files will be stored. After you are satisfied with your configuration, select Save Configuration. If you want to exit without changing the existing configuration, select Cancel. If you are configuring Diamond Mirror from within Diamond Edge, you can run Diamond Mirror by selecting Run DMIRROR from the Undelete menu. If you are running Diamond Mirror from the GEM desktop, you have the option of running Diamond Mirror by selecting Run Mirror. ù Choosing your Undelete method Two methods of recovering deleted files are provided by Diamond Edge: Simple Undelete and Mirror Undelete. Select Mirror Undelete if you have a recent Mirror file for the drive that contains the deleted file. Otherwise, you should select Simple Undelete. A Simple Undelete calculates the number of clusters the file would have occupied on the disk. Then it locates the starting cluster of the deleted file and calculates the number of consecutive clusters from the beginning cluster that are not currently allocated to other files. These unused clusters are then recovered. A Mirror Undelete uses FAT and directory information stored in the disk Mirror files to determine exactly what clusters the file occupied prior to deletion The clusters that the file occupied, that are still not allocated to other files, are recovered. This is the only method that can fully recover a fragmented file. Both of these methods can assist you in recovering deleted files even if you regularly run DMIRROR.PRG. ù Undeleting Files When you select Undelete Files from the Undelete menu, the Undelete control screen is displayed. The Undelete File Selector functions exactly like the normal GEM file selector, except that only subdirectories and deleted files are shown. To open a subdirectory shown in the control screen click on the entry. To move up to the parent directory again, click on the close box in the Undelete File Selector window. If you want to change the active undelete drive, then select the desired drive button from the available drive buttons. Each file that appears in the Undelete File Selector has an additional entry that indicates whether or not the file will be recoverable. If all of the clusters belonging to a file can be recovered then the recoverable entry is: Yes. If none of the clusters belonging to the deleted file can be recovered, then the recoverable entry is: NO. However, if only some of the clusters belonging to the file are recoverable, then a ratio of the recoverable clusters to the total number of clusters will be shown. Diamond Edge provides a general purpose deleted file finder within the Undelete control screen. To search for deleted files enter a deleted file search mask in the editable field in the Undelete Control screen labeled Search Mask. You can search for a specific file or enter a general purpose wildcard to find all files that match the wildcard criteria. The two standard wild cards on the Atari ST are * and ?. The * appearing in a wild card search mask will backup all files containing a character string in the *'s position. The ? appearing in a wild card search mask will backup all files containing a single character in the ?'s position. For example, if you wanted to search for all deleted files with a .PI1 extension., you would enter s*.PI1 for the Undelete Search Mask. If you had wanted to search for all deleted files with extension of PI1, PI2, or PI3 you would enter s*.PI? as the Undelete Search Mask. To initiate the deleted file search, select Find from the Undelete Control Screen. You can also press the return key to initiate deleted file search. The program will search the current drive for the first file that matches the wildcard specification. If a match is located, the Undelete File Selector will automatically move to the directory containing the file and select the file. If you want to find additional deleted files that match the current wildcard mask, select Find Next from the Undelete Control screen. To select a file to undelete, click on the file name in the Undelete File Selector. When the entry appears selected it is marked for undeletion. You may select as many files as you want to to undelete in the same directory by holding the shift key down while selecting the file. After you have selected all of the files that you want to undelete in the current directory, then select Undelete from the Undelete control screen. For each file that you select you will be prompted to enter the first character of the deleted filename. The program then checks to see if there is another file in the directory that already has that name. If a conflict is found, you will be prompted to enter a different first character. In order to undelete files from a subdirectory that has also been deleted, you must first undelete the directory. When you have finished undeleting all of the files that you require, select Cancel to return to the Diamond Edge basic window. ù What to do after you undelete a file After you have undeleted all of the files that you require, you should verify the validity of the recovered files. If you have a current validation file for the drive, then perform a validation pass to assess the state of the undeleted files. This will tell you if the undeleted file is the same as before or if the files data has been corrupted. If you do not have a current validation file, then you should manually examine the files you just undeleted to determine if they are valid.