Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!rutgers!clyde!cbatt!neoucom!wtm
From: wtm@neoucom.UUCP (Bill Mayhew)
Newsgroups: comp.sys.ibm.pc
Subject: Re: Help with recovering hard disk
Message-ID: <580@neoucom.UUCP>
Date: Sat, 9-May-87 12:56:00 EDT
Article-I.D.: neoucom.580
Posted: Sat May  9 12:56:00 1987
Date-Received: Sun, 10-May-87 08:54:24 EDT
References: <203@houxj.UUCP> <263@silver.bacs.indiana.edu>
Organization: Northeastern Ohio Universities College of Medicine
Lines: 51
Keywords: HD low level formatter
Summary: additional information about Norton's FR.


FR, the Norton 4.0 format recovery routine *must* be run in the
preventative mode-- ie: FR /SAVE from your autoexec file.  What FR
does is to copy the FAT and directory structure of your disk to a
DOS file.  When you boot from a floppy disk after loosing your FAT
or ROOT directory, you can invoke FR without options.  FR then
reads the HDU sector by sector looking for its unique tag that it
starts its data sectors with.  It can then work backwards and
reconstruct the FAT and file system.

A low level format or a media verification will most certainly
destory any possibility of recovering any of the original data
unless your initials are NSA (grin).  FR operates on the assumption
that most hard disk formatters do nothing more than erase the FAT
and the ROOT directory, then simply do a read verification on the
remainder of the disk.  Some versions of FORMAT-- AT&T previous to
DOS, release 3.01 and the Compaq, damage the data in all the
sectors of the disk, thus rendering FR useless.

Although FR could try to work backwards by scanning the disk for
sectors that were potential subdirectories, and using them to
rebuild the file system, it makes no attempt to do so.  In such a
case, it would be impossible (virtually so, at least) to recover
any to the files as opposed to directories in ROOT since the format
customarily zeroizes ALL of the ROOT area (typically 512 entries).
Just last week, an errant episode of MS-LINK (really, honest)
trashed the ROOT directory of my own computer.  I had not done an
FR /SAVE, but lucky me had recently printed a hardcopy of the file
entries, which I typed back in by hand.  It was also much easier to
locate the clusters that belonged to the files, as I regularly use
a tune-up program to de-fragment my disk.  I also keep the files in
alphabetical order as much as possible to make them easier to find.
I also try to minimize the number of files in ROOT, and keep
everything in subdirectories, since it is very easy to identifify
sectors that are subdirectories and restore their entries in ROOT.
By taking the steps I mentioned above, you can probably recover
from a crash that is not due to hardware error in just a few
minutes.  Norton or another popular disk sector editor is required
to do the patching.  You can use DEBUG, but it is rather
inconvenient compared to programs that are optimized for disk
sector editing.

With floppy diskettes, the entire disk is low-level formatted every
time, thus there is no possibility of recovering a floppy with FR.

The Paul Mace utilities offer essentially the same thing as Norton
with the same caviats as Norton.  My experience has been that
Norton is the better (that is to say easier to use) of the two
utilities.

  --Bill  (wtm@neoucom.UUCP)