CASE HISTORY # 8
     by the Disk Doctor



--------------------------------------------
Copyright (C) 1987,  the Disk Doctor.

First published in the Rochester (PC)^3 News:
   Picture City PC Programming Club
   PO BOX 20342
   Rochester, NY 14602
The Disk Doctor may be contacted at this
address, or via CIS [73147,414].

This material may be reproduced for internal
use by other not-for-profit groups, provided
this copyright notice is included.
----------------------------------------------



10:30am
"They're going to fire me."
 
"What's that?"  I turned around to see X
slumped against the door.  I could see he
wasn't kidding.  He was so upset, he could
hardly stand.  I quickly helped him into a
chair.

"I just formatted my hard disk."  He spoke
in a faint, detached voice, "I lost
everything."

"Do you have a recent backup?"

"No."  His voice cracked.

"How full was your hard disk?"

"All of it.  Months of work, down the
drain..."  His glazed eyes were beginning
to well up with tears.

I grabbed his shoulders and shouted into
those lifeless eyes, "X, listen to me!  I
might be able to help.  It depends on how
your disk was organized and what your
files look like, but I may be able to get
back some of your files."

It was if I had tossed a rope to a
drowning victim.  "What do I have to do?"

"I'm going to get my bag.  I'll meet you
at your desk."


10:58am
I have just finished running Mace
Utilities on X's hard disk.  I printed out
the DIR of his sub-directories.

"Doctor, it's a miracle!  I thought all
that was lost when I formatted..."

"When DOS formats a hard disk, it does not
wipe out all the data.  It zeroes out the
FAT and erases the root directory, but the
rest of the disk is left intact.  This
program scans all the sectors, looking for
the characteristic signature of a
directory sector, a period in the first
byte, followed by 2 dots 32 bytes later."

X was studying the DIR listing.
"It looks like you got back all my files.
I can't believe it was that easy!"

"I'm not done yet.  All I've done so far
is retrieve the directory information for
your sub-directories.  This only locates
the first cluster of each file."

"Why did you circle some of these files?"

"The files I circled are all done.   On a
10 MB drive, DOS allocates disk space in
8-sector clusters.  So any file smaller
than 4096 bytes is intact. The next step,
the hard part, is reconstructing the rest
of the big files. Our success depends on
how easily we can find the subsequent
sectors, and piece them together in the
proper order."


11:04 am
"Now, X, I want you to look at this list
of files, and mark out the ones that you
absolutely have to have.  Some of these
files, if they are highly fragmented, will
be practically impossible to reconstruct.
If you have printed copy, or the original
sources, it may be less work to re-type it
than to try and piece it back together
again."

I gave him the printouts.  "Meanwhile, I'm
going to reschedule some of my afternoon
appointments.  We are going to be real
busy for a while."

"What do you need me for?"
 
"You're going to look over my shoulder
thoughout the process and tell me which
sectors get pieced together.  You're the
only one who will recognize the data when
you see it on the screen."




[ To be continued ....  ]