CASE HISTORY # 9 by the Disk Doctor -------------------------------------------- Copyright (C) 1987, the Disk Doctor. First published in the Rochester (PC)^3 News: Picture City PC Programming Club PO BOX 20342 Rochester, NY 14602 The Disk Doctor may be contacted at this address, or via CIS [73147,414]. This material may be reproduced for internal use by other not-for-profit groups, provided this copyright notice is included. ---------------------------------------------- 1:17pm I was reading the meeting minutes in the Rochester PC^3 News, when TW ran into my office. "Doctor, come quick. Something terrible has happened." I grabbed my bag, jumped to my feet, and we raced to her desk. 1:21pm "My spreadsheet files are all messed up." She panted, out-of-breath. "I'm in a terrible bind. I've got to have a report finished by 3:00 and now I discover that everything on this disk is lost!" "TW, calm down. Can you tell me what happened?" "When I tried to retrieve the file from within Lotus, it said no files on the disk. So I exited Lotus, and I did a DIRectory and it listed a bunch of hieroglyphics, and I don't know where that came from... And I did a CHKDSK, and the errors just went on and on. So that's when I came to get you..." "Okay, okay. I can see you're upset. I just want to examine your disk." She handed me the suspect disk. I inserted it in the drive and closed the door. CHKDSK reported 119 lost chains and several bad File Allocation entries. 1:29pm "Is this your original copy?" I asked. "Huh? What do you mean? That's my data disk..." "Before I go any further, I am going to make an exact copy of this disk. I don't want to mess up your disk further. A lot of these disk recovery methods are irreversible." I inserted an empty disk and ran DISKCOPY. A message from DISKCOPY alerted me to one possible symptom. "Hmmm. That's an interesting discovery. DISKCOPY is reformatting my disk." "Oh no, what does that mean!??" 1:32pm I loaded my favorite disk utility. "Something is strange here. Norton's Disk Information reports 320KB basic storage capacity, but it also shows 9 sectors per track. With 9 sectors, you should have 360 KB. That means the Media Identifier Byte doesn't match the Disk Parameter Block..." I turned to TW, who was wailing and gnashing her teeth, "When was the last time you used this disk?" "This morning." "Did anything out-of-the-ordinary happen this morning?" "No.... Oh wait, I did make one tiny boo- boo. I went to copy a spreadsheet file from someone else's disk on to mine. " "A tiny boo-boo? What happened?" "Oh, silly me. I put her disk in drive B: and entered the COPY command. Only then I discovered I still had the Lotus system disk in drive A:. Fortunately, I had a write-protect tab on, so it didn't hurt anything. I simply..." "...placed your data disk in drive A: and pressed 'R' for Retry," I finished her sentence for her. "That was not a tiny boo-boo, that was the reason for your trouble now." "I don't understand. What happened?" 1:34pm "There is a subtle bug in DOS. DOS can't determine that a disk is write-protected until after it tries to write on the disk. The problem is that DOS doesn't know enough to flush its buffer when you change disks. If you simply press 'R' for Retry, DOS resumes the operation on the second disk, writing the FAT and directory from the first disk over on to the second disk." "What should I have done?" "Anytime you see the 'Abort, Retry, or Ignore' message and you change disks, you must press 'A' for Abort." "Can you fix it, doctor?" "Maybe it's not to late for this one. I'll see whether anything can be salvaged. Let me look at your FAT." "I beg your pardon!" "Oops. I mean the File Allocation Table. It's commonly abbreviated F.A.T." 1:39pm After some extensive inspection, I was happy to report, "You're very fortunate, TW. There's a good chance we can get it all back. Here look." I sketched on a notepad: 320KB format sectors 0 1 2 3 4 5 6 ---------------------------------------- | BOOT| FAT1| FAT2| DIR....... ---------------------------------------- 360KB format ---------------------------------------- |BOOT| FAT1..... | FAT2..... | DIR.... ---------------------------------------- updated ---------------------------------------- | | XXX | XXX | | XXX | ---------------------------------------- She looked at me, puzzled. "But what does it mean?" "Because it is so vitally important, DOS maintains 2 copies of the FAT. In the 320 KB format each FAT is 1 sector long. In the 360 KB format each FAT is 2 sectors long. By coincidence, given the way your disk was overwritten, the first half of the second FAT should be intact!" "Does that mean you can unerase my files?" "No, UNERASE won't help us, but RECOVER can. First of all, I will zero out sectors 2 and 4 with DEBUG, like this.... Then copy sector 3 over to sector 1.... Then I simply run RECOVER..." 1:47pm I printed out a DIR listing. FILE0001.REC 58368 FILE0002.REC 41984 FILE0003.REC 39936 FILE0004.REC 55296 ... TW examined the list. "How can we find my... Wait! I printed out the directory earlier this morning, before I did that copy mistake." TW reached into her waste basket and pulled out a crumpled-up printout. As she read the listing, she frowned. "Those aren't the right files..." "Sure they are. RECOVER just renamed them with dummy names." "No. The dates and file sizes are all different. " "These files all show today's date, because that's when they were reconstructed. The filesizes shown on your printout are simply rounded up to the next highest integer multiple of 1024 bytes, which is the size of a cluster on a 360KB floppy disk. You see, the disk directory stores the specific size of the file, but that information was lost. RECOVER has reconstructed the clusters containing the file, so it rebuilds the directory with the file size based on the number of clusters it occupies." "All right. The file I want, SALES.WKS, was 55160 bytes." I punched it in the calculator on her desk. "The file will now contain 55,296." "But which file is it? There are three files that same size..." "Let's look at all three and see." I renamed all the files with the command REN *.REC *.WKS . "There. Now start up Lotus and look at FILE0004, FILE0015, and FILE0022. The file you want should be one of those. Later, when you have time, you can load in the others, find out what they are, and rename them." ========================================== MORALE OF THE STORY: [As always, this is a dramatization of an actual case history. Total recovery was possible only by coincidence. The important thing is prevent this type of mishap from ever occuring to you. When you see the disk-error message 'Abort, Retry, or Ignore' and you have swapped diskettes, you must select ABORT, or you risk wiping out your disk!!! !!!!!!!! EXPERIMENT with RECOVER at your OWN RISK! The results are irreversible. Beware! There are two forms of the command. Never practice on the only copy of any disk you want to keep. Unless you understand completely what is going on, better leave heavy-duty disk recovery to the experts.-D.D.]