Path: utzoo!mnetor!uunet!husc6!rutgers!sri-spam!ames!necntc!dandelion!ulowell!page From: page@ulowell.cs.ulowell.edu (Bob Page) Newsgroups: comp.sys.amiga Subject: Writing UnDelete (was Gripe about disksalv/diskdoctor) Message-ID: <2339@ulowell.cs.ulowell.edu> Date: 5 Jan 88 20:50:34 GMT References: <2267@crash.cts.com> Reply-To: page@swan.ulowell.edu (Bob Page) Organization: University of Lowell, Computer Science Dept. Lines: 74 Summary: Here's a couple of ways to recover files & data peter@sugar.UUCP (Peter da Silva) writes: >Anyone interested in doing an "Undelete" program? haitex@pnet01.cts.com (Wade Bickel) responds: >Got a spec. for how you think this program should function? I need >to learn about the file system and this seems like a short project, so >I might be interested. [rolling up his sleeves...] The first thing to do is have the AmigaDOS Technical Ref Manual. The second thing to do is learn how the DOS name hashing works. Get Fish Disk 20 (the one with DiskSalv) for an example program that does DOS hashing. OK, now. Two methods for writing UNDELETE... First. The easy, fast way to 'undelete' is to scan the disk, block by block, looking for a file header block that: a. Has the right file name (it's a BCPL string in the block) b. Has a 'parent pointer' that points to the right parent (you want file proj/src/readme, not proj/doc/readme, right?) Found it? Good, remember the block number. Now go to the parent directory (or what will be the parent directory when you undelete it), hash the filename, and put the file's block number in the longword that you just computed. If the existing longword is not zero, you have to add the block number to the hash chain. See the AmigaDOS TRM for info. There! You've just done an UNDELETE. Pretty easy, eh? Second. Maybe you're not sure all the data is intact. If you've done any writing to the disk, this might be the case. In that case, here's two ways to get the data back. You should probably do both, since one of them might not work. 1. Find the first data block, save the data (the first 24 bytes or six longwords are not data), and look at the 'next data block' longword to get the next one. Follow the chain until it ends. Each data block has a serial number, you could check that if you think it would be useful. 2. Look at the block list in the file header block, and get each data block by its block number (contained in the block list). If there is an extension block (also called file list block), read that block for another list of blocks to read. That's all there is to it! This method of data recovery is what DiskSalv/DiskDoctor does, except they do it for the whole disk, know about directories, and other FS gobbly-gook. Do it for just one file and you have FileSalv. Sanity checks when looking at data blocks: a. Make sure it's a data block! The first longword should be T_DATA (something like decimal 8 ... see disksalv.c for the right value, or Leo's bm.c, or something similar). b. Each data block has a pointer to the file header block. If the number doesn't match, something's wrong. c. Make sure you don't automatically save 488 bytes per block, some locks (like the last one) might not have that much data. Check the longword that tells you how much data there is in the block. Two disclaimers: 1. This is off the top of my head. No flames if I've forgotten something. 2. These techniques may not work with new versions of the file system. FileSalv method 1 (follow the data block chain) will NOT WORK with the new (aka fast or HD) file system, since data blocks are always 512 bytes. You also have to worry about the new features... :-) ..Bob (still working on the Amiga FS handbook) -- Bob Page, U of Lowell CS Dept. page@ulowell.edu ulowell!page "I've never liked reality all that much, but I haven't found a better solution." --Dave Haynie, Commodore-Amiga