Here we deleted and wiped the data of file PARTBOOT.C. When we see the contents of the floppy with DIR command, the file PARTBOOT.C is not displayed there. When we further execute the program the entry of the deleted file is showed as follows:
| FILE NO. |
FILENAME |
EXTENSION |
STARTING CLUSTER |
FILESIZE |
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15 |
ALLPARTS
CUTPASTE
FLOPYDBR
HDD_DBR
REC_DBR
MBR_BACK
PASTEMBR
sARTBOOT
TTPARBOO
TT_IMAGE
TEMPFLP
TEMPWIPE
NOW_RAW
DATAWIPE
LOW_WIPE |
C
C
C
C
C
C
C
C
C
C
C
C
C
C
C |
19
41
42
45
53
59
62
0
71
78
86
96
103
114
118 |
11131
442
1413
4094
2785
1172
1181
0
3220
3826
4992
3234
5416
2029
3385 |
Here, the character “” (0xE5), represents that the file has been deleted. (see the table for First Character of File Name).
If you want to write the same program for hard disk drive, you must also use the FAT with root directory to get the information of the data area of any file.
It is so because, the rate of fragmented data in the hard disk drives, increases with time as the older files are deleted and new file are created. Then it is not necessary for all the data clusters of any file in the drive to stay one after one continuously in the data area. By accessing FAT, you can access all of those clusters.
| Sample Chapters from book DATA RECOVERY WITH AND WITHOUT PROGRAMMING by Author Tarun Tyagi |
|
Publishers of the Book
Number of Pages
ISBN
Price of the Book
|
BPB Publications, New Delhi, India
540
81-7656-922-4
$69.00 (Including Shipping Charges, Cost of Book and Other expenses, Free Source Code CD included with the Book)
|
 |
|
|
