Third-party undelete programs have been available for DOS for many years. MS-DOS itself didn't include an undelete program until version 5.0. UNDELETE was improved in MS-DOS 6.x to include a "Delete Sentry" TSR (Terminate and Stay Resident program) that significantly improves the chances of recovering a deleted file. Windows 3.1 includes a Windows version of MS UNDELETE, typically in the "Microsoft Tools" program group and under the File menu in File Manager.

To understand why UNDELETE works, it is important to know how DOS "deletes" a file. DEL and ERASE do not physically remove data from the disk, rather the file is "logically" deleted (the same is true if you delete from File Manager). The information is still there, but the space it occupies is marked as free for reuse. When DOS writes to the disk again, it may write over this "deleted" data. Then it is gone forever. So the key is to recover deleted files as QUICKLY as possible.

Also when a file is deleted, the file's entries in the file allocation table (FAT) are cleared, though the data on the disk itself is unchanged. Since the FAT tells DOS where the file is physically located, from DOS' perspective the file is now "gone."

Delete Sentry is the highest level of protection. You load UNDELETE in AUTOEXEC.BAT with the /S switch. When you delete a file, it is moved to a special, hidden \SENTRY subdirectory. Files remain in the \SENTRY subdirectory by default for seven days or until the subdirectory takes up 20% of the available disk space -- at which time the oldest deleted files are purged. So when you need to undelete a file, as long as it is still in the \SENTRY directory, it can be completely recovered.

The lower level of security is Delete Tracking. UNDELETE is loaded with the /T switch. Delete Tracking keeps a list of all the disk clusters where a deleted file was stored. As long as those clusters haven't been reused by DOS, the file can be recovered. Time is critical, because you can never know how soon a cluster will be overwritten -- remember that as far as DOS is concerned, those clusters are empty. If the clusters are reused, the deleted file cannot be recovered. As you can see, Delete Sentry is a much more reliable option than Delete Tracking, so we ll focus on it.

It is important to understand that files will be physically deleted from the \SENTRY directory in several situations. This again makes it important to undelete files as soon as possible. Files are automatically purged from \SENTRY when:

* DOS needs the disk space. If your drive is full and DOS needs space to save your data files, it will remove files from \SENTRY to make enough room.

* The files in \SENTRY are taking up too much disk space. The size of the \SENTRY directory is a percentage of the drive space; the default is 20%. (This can be changed, as we'll see below). To keep the size below this percentage, some files are deleted.

* The files in \SENTRY are too old. By default, files are saved for seven days (though this again can be changed). Old files are deleted when UNDELETE loads.

In all cases, the oldest files are purged first.

1. From the Windows Program Manager, choose File, Run. Type in SYSEDIT and click [OK]. This runs the Windows SYSEDIT program, which allows you to edit four system configuration files: AUTOEXEC.BAT, CONFIG.SYS, WIN.INI, and SYSTEM.INI.

2. Double-click on C:\AUTOEXEC.BAT title bar to maximize that Window. This makes it easier to edit the file.

3. Enter the UNDELETE command on a new line after the PATH statement. For each drive you want to protect, use a /S switch immediately followed by the drive letter (without the colon). For example, if you have only a C: drive, enter:
UNDELETE /SC

For a C: and a D: drive, you d enter:
UNDELETE /SC /SD

4. From the SYSEDIT menu, choose File, Save to save the file, followed by File, Exit to close the program. UNDELETE will be loaded the next time you turn on your PC.

UNDELETE loads as in memory a 14k Terminate and Stay Resident program. It can be loaded into the Upper Memory Blocks if they are available, thus saving yourself some conventional memory. So after setting up UNDELETE, you will probably want to run MEMMAKER, DOS s memory optimization program.

1. Run Notepad. Open the WINFILE.INI file in the \WINDOWS directory.

2. Look for the [Settings] section, and immediately below it add this line:
UNDELETE.DLL=C:\DOS\MSTOOLS.DLL

3. From the Notepad menu, choose File, Save to save the file, followed by File, Exit to close Notepad.

After UNDELETE is loaded for the first time, you may want to change some of the configuration settings Delete Sentry uses. These can be changed directly in the UNDELETE.INI file (as we ll see next year), but it is easier to make the changes through the Windows UNDELETE program.

Double-click on the MS Undelete icon in the Tools program group, or select File, Undelete in File Manager. Undelete will display the deleted files in the current directory, along with their condition and protection status. To configure Delete Sentry:

1. From the menu, select Options, Configure Delete Protection. Make sure Delete Sentry is selected (it should be if loaded), and click [OK].

2. Under Which files should Delete Sentry save, the default is Only Specified Files. This means all files except a group of temporary files displayed in the Exclude box. Since these are temporary files typically used by DOS and Windows, there is no reason to save them because they d never need to be undeleted.

3. The Do not save archived files is terribly misnamed. By default the box is checked, and you should leave it checked. What this setting really means is that all files are saved to \SENTRY whatever their archive attribute. The archive attribute is set whenever a file is changed, and turned off when that file is backed up. If you uncheck this box, ONLY files with the archive attribute are saved to \SENTRY. Any files you delete without the archive attribute are not saved to \SENTRY and cannot be recovered using Delete Sentry.

4. Purge files after specifies the number of days to keep files in the \SENTRY directory. The default is seven days. Files older than a week will be purged from \SENTRY when UNDELETE loads in CONFIG.SYS.

5. Limit disk space for deleted files to indicates the size of the \SENTRY directory as a percentage of the total disk space. The default is 20%. If the number of files starts to exceed this space limit, the oldest files in \SENTRY are deleted to stay under the percentage.

6. The [Drives] button specifies the drives to protect. However, any changes made here may not be updated in AUTOEXEC.BAT. If you need to add or delete a drive, edit AUTOEXEC.BAT as described above.

7. When done, click on the [OK] button and close Microsoft Undelete. Exit Windows and reboot your computer for the changes to take effect.

With these preliminaries done, next month we ll look specifically how to recover files, and how to work with UNDELETE directly from the command line.

===============================

Kenneth E. Johnson is author of The Lawyer s Guide to Creating Web Pages, published by the American Bar Association, and is currently writing a book on Internet E-mail. He is Assistant Editor of the ABA s Network 2d newsletter, and Contributing Editor of Practical Windows and DOS World Magazines.

For more information on the Tulsa Computer Society click here