• Please review our updated Terms and Rules here

Help with undelete on IBM 5170

R

roadrash

Experienced Member
Joined
Aug 17, 2011
Messages
128
Location
Huntingdon, U.K
Just made a stupid mistake because of a typo. I was checking the contents and then formatting any disks that had nothing of any good on them ready to do a backup of my hard disk which had some nice menus and software on it. Dont laugh) but just once I didn't notice a typo that said "format C: /q" and I meant to type "format A: /q". I know everything is still there after a quick format as it just wipes out the BAM I think and directory list etc and was wondering is there a DOS program that will scan the hard disk and rebuild the BAM and directory so I can get my files & menus back.?

please help or its gonna be a huge job getting all that back on again.
 
Aha, you're in the UK!

I don't know what system you're running, as you don't say. I know that for DOS 5 there were UNDELETE progs, I used one quite a few times as everyone does something stupid from time to time. I lost count a long time ago of how many times I've deleted something and then realised I OUGHT NOT to have done so.

I think I've seen an UNFORMAT prog somewhere.

I don't know if these progs depended on something in the system, i.e. DOS 5.?, to function, so I cannot say the prog will work in your system.

UNDELETE presents you with the deleted files, one by one, and asks about recovery. The first char of the filename is not there, so needs to be reset. A bit like the CP/M system and the user number being set to E7. So like you say, reset the marker and the file comes back, although you can have problems with other deleted files where the Alloc Blocks have been re-used as they were deleted some time previously.

Over and above that, I've used a prog called ANADISK, which allows you to view the sectors, incl the directory sectors, to see what's there. I think this will allow the edit of the data too.

There are other systems as well, I think things from NORTON, no doubt there are others.

Make sure you keep the disks until you've sorted recovery.

What size of floppy are they? 360k standard? Or bigger??

Geoff
 
Thanks for the replies. Yes I heard there is a undelete command in Dos 6. The system I am using is my old IBM 5170 which has just started giving me problems with its 1.2 mb floppy drive. Ive found another drive now that works but thought it was time I backed up everything on the hard drive. So its the hard drive I accidentally quick formatted not the floppy drive I intended. Trouble is the IBM is a Dos only machine with a old MFM hard drive so not compatible with IDE. So I am about to set up a basic Pentium 3 or 4 PC with 3.5" drive and a 5.25" drive and windows xp on it. Then I should be able to download anything from the net and put on 5.25" floppy to take to the IBM. Its the only way I can think of how to get it across. I have Norton utils on some 3.5" floppies so maybe they will do. Geof I remember what you said about the first character in the filename missing from years ago when i did something similar before. Hopefully I should manage to work out the file names. Any other suggestions?
 
roadrash said:
So I am about to set up a basic Pentium 3 or 4 PC with 3.5" drive and a 5.25" drive and windows xp on it. Then I should be able to download anything from the net and put on 5.25" floppy to take to the IBM..... ....Any other suggestions?
Click to expand...

Stick with a P3. A lot of P4's have a BIOS that only support 1 FDD, and I've read (not sure how true) that XP will only format 1.44MB disks. If so, then dropping back to Win2K would be a good bet...
 
What version of DOS did you use?

If was DOS 5 or 6 then it would have saved unformat information and you should simply be able run run unformat.

Any earlier version of DOS, and I'm afraid you will be manually picking through sectors to piece files back togeather. I hope you at least ran a defragmenter at some point prior. You won't have a root directory to work with, and no FAT chains to follow.
 
It may be easiest to dump the whole disk, sector for sector, into a single file and then pick out what you need. Reconstructing whole disks with no delete tracking is a hideous job.
 
Just my 2 cents: make an image of the HDD before touch anything on it!!

There are lot of recovery programs out there that can help you. Your mileage will vary, I always had good results with this one:

https://www.cgsecurity.org/wiki/PhotoRec

and you can also use classic utilities from Norton, Central Point (PC Tools), Mace, ...
 
dieymir said:
Just my 2 cents: make an image of the HDD before touch anything on it!!

There are lot of recovery programs out there that can help you. Your mileage will vary, I always had good results with this one:

https://www.cgsecurity.org/wiki/PhotoRec

and you can also use classic utilities from Norton, Central Point (PC Tools), Mace, ...
Click to expand...

I imagine that PhotoRec doesn't handle text files (source code etc.), or any format without a well-known header. Recovering pictures or videos is probably not what the OP is looking for.

One idea for recovering FAT filesystems I had, is scanning each cluster to see if it is a subdirectory (easy to identify by the '.' and '..' entries). I don't know if something like this already exists, but a simple version of such a program would work like this:

- Read FAT into memory
- Scan for directories
- Mark first cluster of each directory and file found as used
- Second pass, build chains for files based on first cluster and size
- Report fragmented files, prompt whether to delete or keep beginning of file
- Write back FAT and make root entries for top level directories

In any case, if there is important data then making a complete image first is a good suggestion!
 
dreNorteR said:
I imagine that PhotoRec doesn't handle text files (source code etc.), or any format without a well-known header. Recovering pictures or videos is probably not what the OP is looking for.
Click to expand...
Go back and look at what formats are listed in its recovery list. You'll see that .txt is there.
 
T-R-A said:
I've read (not sure how true) that XP will only format 1.44MB disks. If so, then dropping back to Win2K would be a good bet...
Click to expand...

Its true that formatting 720k was removed as an option in Windows XP, but you can still use the format command in a command prompt to achieve the same result.

FORMAT A: /T:80 /N:9

FYI this still works up to Windows 10 as I've done it many times with a USB Floppy (which supports low density disks I might add as not all do).
 
The IBM's hard disk just had Dos 3.3 on it so wont have saved any recovery info on the hard disk after formatting it. So using Xp undelete would not work. I noticed testdisk which I have on floppy has a undelete tool. I cant remember ever using it but it might be worth a try. I cannot believe that the 1.2mb floppy on my IBM 5170 has also packed up. I was only using it the day I accidently quick formatted the hard drive but now it wont read any disks. I have plugged it into a old desktop and it spins up and the head seeks track zero etc but it will not boot or read any disks. I have another working 1.2mb drive but its a different colour and doen't look right in the IBM 5170. Does anyone on here have a spare working YD380 1.2mb 5.25" drive or know how to sort it because its been a good drive up until now and I cannot see anything wrong with it?
 
roadrash said:
The IBM's hard disk just had Dos 3.3 on it so wont have saved any recovery info on the hard disk after formatting it. So using Xp undelete would not work. I noticed testdisk which I have on floppy has a undelete tool. I cant remember ever using it but it might be worth a try. I cannot believe that the 1.2mb floppy on my IBM 5170 has also packed up. I was only using it the day I accidently quick formatted the hard drive but now it wont read any disks. I have plugged it into a old desktop and it spins up and the head seeks track zero etc but it will not boot or read any disks. I have another working 1.2mb drive but its a different colour and doen't look right in the IBM 5170. Does anyone on here have a spare working YD380 1.2mb 5.25" drive or know how to sort it because its been a good drive up until now and I cannot see anything wrong with it?
Click to expand...

It's probably just got dirty heads. Try running a cleaning disk through it.
 
Yup me too, My YD380 died half way thru writing to floppy, Cleaning the heads did nothing, I took it out and replaced it with a 3.5" 1.44 drive in the end.
 
Well that was strange. I suddenly couldnt get my IBM 5170 to read any floppy disks which is why I thought my 1.2mb drive had failed. Well after hours of messing around it turned out it was a switch on a back plane that switches between a floppy or tape drive system. This machine has custom wired floppy cable that is also connected to a large D connector and a toggle switch marked Floppy B: & Tape. The switch had got moved to "Tape" position. I will have to watch for that in future. Anyway good news is all floppy drives are now back working again and now I can get back to the task of un-deleting the contents of the hard drive.
 
Still got a problem though recovering the files on the MFM hard drive because it seems testdist wont work on anything less than 386. So does anyone know of another file recovery app that will run in MS dos with 640k memory?
 
roadrash said:
Still got a problem though recovering the files on the MFM hard drive because it seems testdist wont work on anything less than 386. So does anyone know of another file recovery app that will run in MS dos with 640k memory?
Click to expand...

My first IBM clone was a Logix 386/25 with a Conner 40m HDD. I'm not sure exactly how many people have accidentally deleted all or most of the files on their HDD, but I can tell you without a doubt that you're not the first. Been there & done that! As has been stated previously, DOS doesn't erase the blocks of a "deleted" file. Instead it overwrites the first character of the filename. So with any half way decent sector level editor and a reasonable level of understanding of the file allocation method used, you can follow the allocation chains and recover your files. All you really need to do is find the directory block(s) and change the first character of the filenames to the original or something reasonable. If you come across a "file" that is actually a sub directory just walk the tree decending and recovering as you go.

The first step however is to absolutely avoid doing anything that might write a new file to the drive being recovered because DOS tends to write first to blocks that were most recently freed. Obviously that would overwrite the data you're trying to recover.

Good Luck!
 
Do any of the mentioned recovery tools support just pointing the tool to a hard disk image file? (I'd expect anything for Linux would, but DOS or Windows?)

I'd recommend making a complete image file to another, larger, drive. If it were me I'd try to either put the drive in a 286/386/486 that supports both MFM/RLL controllers and IDE, or use something like an an XTIDE. Then since the drive is small enough use Norton Utilities 4.5 to select all physical sectors and write that as a file to the larger drive.
 
I've been working on my own recovery tool, and crude as it is, the algorithm seems to get good results! I'm attaching the source and EXE here, feel free to do whatever with it.

So far there is no real user interface, and it only works with image files instead of actual devices.

The program is written in Turbo / Free Pascal and can run on 16 bit DOS; but this may be very slow, and you will need a lot of disk space since it just dumps everything with no interactivity.

Usage: dirscan disk.img [ /a ]
/a to actually recover files, else just list their names to stdout
 

Attachments

  • dirscan.zip
    12.3 KB · Views: 1
You must log in or register to reply here.
Back
Top