--------------------------------------------
Copyright (C) 1987, the Disk Doctor.
First published in the Rochester (PC)^3 News:
Picture City PC Programming Club
PO BOX 20342
Rochester, NY 14602
The Disk Doctor may be contacted at this
address, or via CIS [73147,414].
This material may be reproduced for internal
use by other not-for-profit groups, provided
this copyright notice is included.
----------------------------------------------
1:17pm
I was reading the meeting minutes in the
Rochester PC^3 News, when TW ran into my
office.
"Doctor, come quick. Something terrible
has happened."
I grabbed my bag, jumped to my feet, and
we raced to her desk.
1:21pm
"My spreadsheet files are all messed up."
She panted, out-of-breath. "I'm in a
terrible bind. I've got to have a report
finished by 3:00 and now I discover that
everything on this disk is lost!"
"TW, calm down. Can you tell me what
happened?"
"When I tried to retrieve the file from
within Lotus, it said no files on the
disk. So I exited Lotus, and I did a
DIRectory and it listed a bunch of
hieroglyphics, and I don't know where that
came from... And I did a CHKDSK, and the
errors just went on and on. So that's
when I came to get you..."
"Okay, okay. I can see you're upset. I
just want to examine your disk." She
handed me the suspect disk. I inserted it
in the drive and closed the door. CHKDSK
reported 119 lost chains and several bad
File Allocation entries.
1:29pm
"Is this your original copy?" I asked.
"Huh? What do you mean? That's my data
disk..."
"Before I go any further, I am going to
make an exact copy of this disk. I don't
want to mess up your disk further. A lot
of these disk recovery methods are
irreversible." I inserted an empty disk
and ran DISKCOPY.
A message from DISKCOPY alerted me to one
possible symptom. "Hmmm. That's an
interesting discovery. DISKCOPY is
reformatting my disk."
"Oh no, what does that mean!??"
1:32pm
I loaded my favorite disk utility.
"Something is strange here. Norton's Disk
Information reports 320KB basic storage
capacity, but it also shows 9 sectors per
track. With 9 sectors, you should have
360 KB. That means the Media Identifier
Byte doesn't match the Disk Parameter
Block..."
I turned to TW, who was wailing and
gnashing her teeth, "When was the last
time you used this disk?"
"This morning."
"Did anything out-of-the-ordinary happen
this morning?"
"No.... Oh wait, I did make one tiny boo-
boo. I went to copy a spreadsheet file
from someone else's disk on to mine. "
"A tiny boo-boo? What happened?"
"Oh, silly me. I put her disk in drive B:
and entered the COPY command. Only then I
discovered I still had the Lotus system
disk in drive A:. Fortunately, I had a
write-protect tab on, so it didn't hurt
anything. I simply..."
"...placed your data disk in drive A: and
pressed 'R' for Retry," I finished her
sentence for her. "That was not a tiny
boo-boo, that was the reason for your
trouble now."
"I don't understand. What happened?"
1:34pm
"There is a subtle bug in DOS. DOS can't
determine that a disk is write-protected
until after it tries to write on the disk.
The problem is that DOS doesn't know
enough to flush its buffer when you change
disks. If you simply press 'R' for Retry,
DOS resumes the operation on the second
disk, writing the FAT and directory from
the first disk over on to the second
disk."
"What should I have done?"
"Anytime you see the 'Abort, Retry, or
Ignore' message and you change disks, you
must press 'A' for Abort."
"Can you fix it, doctor?"
"Maybe it's not to late for this one.
I'll see whether anything can be salvaged.
Let me look at your FAT."
"I beg your pardon!"
"Oops. I mean the File Allocation Table.
It's commonly abbreviated F.A.T."
1:39pm
After some extensive inspection, I was
happy to report, "You're very fortunate,
TW. There's a good chance we can get it
all back. Here look." I sketched on a
notepad:
320KB format sectors
0 1 2 3 4 5 6
----------------------------------------
| BOOT| FAT1| FAT2| DIR.......
----------------------------------------
360KB format
----------------------------------------
|BOOT| FAT1..... | FAT2..... | DIR....
----------------------------------------
updated
----------------------------------------
| | XXX | XXX | | XXX |
----------------------------------------
She looked at me, puzzled. "But what does
it mean?"
"Because it is so vitally important, DOS
maintains 2 copies of the FAT. In the 320
KB format each FAT is 1 sector long. In
the 360 KB format each FAT is 2 sectors
long. By coincidence, given the way your
disk was overwritten, the first half of
the second FAT should be intact!"
"Does that mean you can unerase my files?"
"No, UNERASE won't help us, but RECOVER
can. First of all, I will zero out sectors
2 and 4 with DEBUG, like this....
Then copy sector 3 over to sector 1....
Then I simply run RECOVER..."
1:47pm
I printed out a DIR listing.
FILE0001.REC 58368
FILE0002.REC 41984
FILE0003.REC 39936
FILE0004.REC 55296 ...
TW examined the list. "How can
we find my... Wait! I printed out the
directory earlier this morning, before I
did that copy mistake." TW reached into
her waste basket and pulled out a
crumpled-up printout. As she read the
listing, she frowned. "Those aren't the
right files..."
"Sure they are. RECOVER just renamed them
with dummy names."
"No. The dates and file sizes are all
different. "
"These files all show today's date,
because that's when they were
reconstructed. The filesizes shown on
your printout are simply rounded up to the
next highest integer multiple of 1024
bytes, which is the size of a cluster on a
360KB floppy disk. You see, the disk
directory stores the specific size of the
file, but that information was lost.
RECOVER has reconstructed the clusters
containing the file, so it rebuilds the
directory with the file size based on the
number of clusters it occupies."
"All right. The file I want, SALES.WKS,
was 55160 bytes."
I punched it in the calculator on her
desk. "The file will now contain 55,296."
"But which file is it? There are three
files that same size..."
"Let's look at all three and see." I
renamed all the files with the command REN
*.REC *.WKS . "There. Now start up Lotus
and look at FILE0004, FILE0015, and
FILE0022. The file you want should be one
of those. Later, when you have time, you
can load in the others, find out what they
are, and rename them."
==========================================
MORALE OF THE STORY:
[As always, this is a dramatization of an
actual case history. Total recovery was
possible only by coincidence.
The important thing is prevent this type
of mishap from ever occuring to you. When
you see the disk-error message 'Abort,
Retry, or Ignore' and you have swapped
diskettes, you must select ABORT, or you
risk wiping out your disk!!!
!!!!!!!!
EXPERIMENT with RECOVER at your OWN RISK!
The results are irreversible. Beware!
There are two forms of the command. Never
practice on the only copy of any disk you
want to keep.
Unless you understand completely what is
going on, better leave heavy-duty disk
recovery to the experts.-D.D.]
