Erasing Files

"FACE" wrote in message
...
On Tue, 19 Oct 2004 20:51:46 -0000, "SFB - KB3MM"
in
microsoft.public.win98.performance wrote:

Undelete programs scan the
directories (folders) looking for entries with this special character
and then prompt you to undelete them by supplying the first character
of the original file name.

The undelete will be successful as long as the file was contiguous.

I thought that a noncontiguous file fragment still had a pointer at the
end
to the next fragment location. ??

The fragment contains nothing - the info is in the FAT.

You may want to:

Read the spec for the FAT/FAT32 file system and then get your favorite
DISK HEX EDITOR.

Find a noncontiguous file (a few clusters is fine) and look at the directory
entry.
Using the FAT pointer there, trace the FAT for the file.

Then delete the file:

Look at the directory entry again and note the changed first letter AND the
fact
that the FAT entry is intact. Then try to trace the FAT and notice that all
of the entries for the file now indicate 'no data'. There's no way to find
the clusters that contained the data.
HTH.

Many "diskwasher" programs are around that overwrite available space.
I know that used to be part of the Norton package and I guess still is.

AH! A cutesy named utility function. Never use them.

Very easy to overwrite free space. Just read thru the FAT and when ever you
find a free cluster write zeroes to the cluster; don't have to know
anything about the data that used to be in the clusters.


Also,
" Alt+Wash Disk - Fill the unused area of a disk with nulls or
random
data to protect against unerasure of sensitive
data."
is part of Ztree. (Any space marked FREE, hence any deleted file, would
be
part of "unused space".

Of course, in a pinch, a strong magnetic field will physically delete
files.

Is that a fact or part of an old myth?

:-)


FACE

On Wed, 20 Oct 2004 02:42:49 -0000, "SFB - KB3MM" in
microsoft.public.win98.performance wrote:


"FACE" wrote in message
.. .
On Tue, 19 Oct 2004 20:51:46 -0000, "SFB - KB3MM"
in
microsoft.public.win98.performance wrote:

Undelete programs scan the
directories (folders) looking for entries with this special character
and then prompt you to undelete them by supplying the first character
of the original file name.

The undelete will be successful as long as the file was contiguous.

I thought that a noncontiguous file fragment still had a pointer at the
end
to the next fragment location. ??

The fragment contains nothing - the info is in the FAT.

You may want to:

Read the spec for the FAT/FAT32 file system and then get your favorite
DISK HEX EDITOR.

Find a noncontiguous file (a few clusters is fine) and look at the directory
entry.
Using the FAT pointer there, trace the FAT for the file.

Then delete the file:

Look at the directory entry again and note the changed first letter AND the
fact
that the FAT entry is intact. Then try to trace the FAT and notice that all
of the entries for the file now indicate 'no data'. There's no way to find
the clusters that contained the data.
HTH.

Yes it does. I am now thoroughly disabused of the notion that the file
itself contains a pointer to the next fragment.

Now, a two part question. Does the MSDOS FAT system consist of a dual FAT?
If so, how is the previous FAT accessed?


Many "diskwasher" programs are around that overwrite available space.
I know that used to be part of the Norton package and I guess still is.

AH! A cutesy named utility function. Never use them.

Yes it is cutesy. It evokes an image of removing platters and immersing
them in detergent.

Very easy to overwrite free space. Just read thru the FAT and when ever you
find a free cluster write zeroes to the cluster; don't have to know
anything about the data that used to be in the clusters.


Also,
" Alt+Wash Disk - Fill the unused area of a disk with nulls or
random
data to protect against unerasure of sensitive
data."
is part of Ztree. (Any space marked FREE, hence any deleted file, would
be
part of "unused space".

Of course, in a pinch, a strong magnetic field will physically delete
files.

Is that a fact or part of an old myth?

The magnetic field? Unless the recording media has changed to something
other than ferrite, so far as i know it is fact. But if in doubt, fire,
followed by a judicious application of a sledgehammer will suffice.


FACE

On Wed, 20 Oct 2004 02:42:49 -0000, "SFB - KB3MM" in
microsoft.public.win98.performance wrote:


"FACE" wrote in message
.. .
On Tue, 19 Oct 2004 20:51:46 -0000, "SFB - KB3MM"
in
microsoft.public.win98.performance wrote:

Undelete programs scan the
directories (folders) looking for entries with this special character
and then prompt you to undelete them by supplying the first character
of the original file name.

The undelete will be successful as long as the file was contiguous.

I thought that a noncontiguous file fragment still had a pointer at the
end
to the next fragment location. ??

The fragment contains nothing - the info is in the FAT.

You may want to:

Read the spec for the FAT/FAT32 file system and then get your favorite
DISK HEX EDITOR.

Find a noncontiguous file (a few clusters is fine) and look at the directory
entry.
Using the FAT pointer there, trace the FAT for the file.

Then delete the file:

Look at the directory entry again and note the changed first letter AND the
fact
that the FAT entry is intact. Then try to trace the FAT and notice that all
of the entries for the file now indicate 'no data'. There's no way to find
the clusters that contained the data.
HTH.

Yes it does. I am now thoroughly disabused of the notion that the file
itself contains a pointer to the next fragment.

Now, a two part question. Does the MSDOS FAT system consist of a dual FAT?
If so, how is the previous FAT accessed?


Many "diskwasher" programs are around that overwrite available space.
I know that used to be part of the Norton package and I guess still is.

AH! A cutesy named utility function. Never use them.

Yes it is cutesy. It evokes an image of removing platters and immersing
them in detergent.

Very easy to overwrite free space. Just read thru the FAT and when ever you
find a free cluster write zeroes to the cluster; don't have to know
anything about the data that used to be in the clusters.


Also,
" Alt+Wash Disk - Fill the unused area of a disk with nulls or
random
data to protect against unerasure of sensitive
data."
is part of Ztree. (Any space marked FREE, hence any deleted file, would
be
part of "unused space".

Of course, in a pinch, a strong magnetic field will physically delete
files.

Is that a fact or part of an old myth?

The magnetic field? Unless the recording media has changed to something
other than ferrite, so far as i know it is fact. But if in doubt, fire,
followed by a judicious application of a sledgehammer will suffice.


FACE

"FACE" wrote in message
...
On Wed, 20 Oct 2004 02:42:49 -0000, "SFB - KB3MM"
in
microsoft.public.win98.performance wrote:


"FACE" wrote in message
.. .
On Tue, 19 Oct 2004 20:51:46 -0000, "SFB - KB3MM"

in
microsoft.public.win98.performance wrote:

Undelete programs scan the
directories (folders) looking for entries with this special
character
and then prompt you to undelete them by supplying the first
character
of the original file name.

The undelete will be successful as long as the file was contiguous.

I thought that a noncontiguous file fragment still had a pointer at the
end
to the next fragment location. ??

The fragment contains nothing - the info is in the FAT.

You may want to:

Read the spec for the FAT/FAT32 file system and then get your favorite
DISK HEX EDITOR.

Find a noncontiguous file (a few clusters is fine) and look at the
directory
entry.
Using the FAT pointer there, trace the FAT for the file.

Then delete the file:

Look at the directory entry again and note the changed first letter AND
the
fact
that the FAT entry is intact. Then try to trace the FAT and notice that
all
of the entries for the file now indicate 'no data'. There's no way to
find
the clusters that contained the data.
HTH.

Yes it does. I am now thoroughly disabused of the notion that the file
itself contains a pointer to the next fragment.

Good. Keep the FAT spec handy !


Now, a two part question. Does the MSDOS FAT system consist of a dual
FAT?

There are two copies of the FAT on the disk.

If so, how is the previous FAT accessed?

HMMM! If the two FAT's do not agree how would one decide which
is the correct one VBG



Many "diskwasher" programs are around that overwrite available space.
I know that used to be part of the Norton package and I guess still is.

AH! A cutesy named utility function. Never use them.

Yes it is cutesy. It evokes an image of removing platters and immersing
them in detergent.

Marketing techniques to make $$$ fly into some ones wallet gr


Very easy to overwrite free space. Just read thru the FAT and when ever
you
find a free cluster write zeroes to the cluster; don't have to know
anything about the data that used to be in the clusters.


Also,
" Alt+Wash Disk - Fill the unused area of a disk with nulls or
random
data to protect against unerasure of sensitive
data."
is part of Ztree. (Any space marked FREE, hence any deleted file,
would
be
part of "unused space".

Of course, in a pinch, a strong magnetic field will physically delete
files.

Is that a fact or part of an old myth?

The magnetic field? Unless the recording media has changed to something
other than ferrite,

Ferrite !? Really? Haven't looked for quite a while.

I've operated disks in the presence of a 25 KG field.

so far as i know it is fact. But if in doubt, fire,
followed by a judicious application of a sledgehammer will suffice.


FACE

On Wed, 20 Oct 2004 18:54:17 -0000, "SFB - KB3MM" in
microsoft.public.win98.performance wrote:

Now, a two part question. Does the MSDOS FAT system consist of a dual
FAT?

There are two copies of the FAT on the disk.

If so, how is the previous FAT accessed?

HMMM! If the two FAT's do not agree how would one decide which
is the correct one VBG

Will this be on the test? ;-)
Since erasing files was the subject should the term be "correct" or
"desired"?


FACE

On Wed, 20 Oct 2004 18:54:17 -0000, "SFB - KB3MM" in
microsoft.public.win98.performance wrote:

Now, a two part question. Does the MSDOS FAT system consist of a dual
FAT?

There are two copies of the FAT on the disk.

If so, how is the previous FAT accessed?

HMMM! If the two FAT's do not agree how would one decide which
is the correct one VBG

Will this be on the test? ;-)
Since erasing files was the subject should the term be "correct" or
"desired"?


FACE

"FACE" wrote in message
...
On Wed, 20 Oct 2004 18:54:17 -0000, "SFB - KB3MM"
in
microsoft.public.win98.performance wrote:

Now, a two part question. Does the MSDOS FAT system consist of a dual
FAT?

There are two copies of the FAT on the disk.

If so, how is the previous FAT accessed?

HMMM! If the two FAT's do not agree how would one decide which
is the correct one VBG

Will this be on the test? ;-)

No. It is academic.

Since erasing files was the subject should the term be "correct" or
"desired"?

Correct.



FACE

"FACE" wrote in message
...
On Wed, 20 Oct 2004 18:54:17 -0000, "SFB - KB3MM"
in
microsoft.public.win98.performance wrote:

Now, a two part question. Does the MSDOS FAT system consist of a dual
FAT?

There are two copies of the FAT on the disk.

If so, how is the previous FAT accessed?

HMMM! If the two FAT's do not agree how would one decide which
is the correct one VBG

Will this be on the test? ;-)

No. It is academic.

Since erasing files was the subject should the term be "correct" or
"desired"?

Correct.



FACE

On Thu, 21 Oct 2004 01:09:44 -0000, "SFB - KB3MM" in
microsoft.public.win98.performance wrote:

HMMM! If the two FAT's do not agree how would one decide which
is the correct one VBG

Will this be on the test? ;-)

No. It is academic.

Since erasing files was the subject should the term be "correct" or
"desired"?

Correct.



Who's on first?

On Thu, 21 Oct 2004 01:09:44 -0000, "SFB - KB3MM" in
microsoft.public.win98.performance wrote:

HMMM! If the two FAT's do not agree how would one decide which
is the correct one VBG

Will this be on the test? ;-)

No. It is academic.

Since erasing files was the subject should the term be "correct" or
"desired"?

Correct.



Who's on first?