中国DOS联盟

Under the operating environment, if a file has been physically deleted by someone else by accident, can DOS retrieve the deleted file? How to do it.

Re wgh984125:

　　You didn't specify the operating environment you're using, and I have doubts about the term "physical deletion." Does it refer to deleting while holding down Shift, emptying the Recycle Bin, or something else.

　　It should be noted that programs deleted under Windows may possibly be recovered under DOS, but I still suggest using data recovery software under Windows, such as FinalData, RecoveryNT, etc., and under DOS, you can use the graphical interface EasyRecovery, etc.

　　Also, to keep the board tidy, please delete the other duplicate thread.

Okay, I'll try the software you provided. I think physical deletion means being emptied in the recycle bin, no matter what method you use to delete. If it's incorrect, please give me advice.

My view is: Physical deletion is to set all to zero or one. There should be no way to recover...

Yes. For general users (including even most computer professionals), there is no so-called physical deletion! It's just that in WIN, it's emptied, or in DOS, it's DEL or DELTREE. In such cases, only the first character of the file name is changed to E5H, and the corresponding cluster chain is set to writable. To perform "physical" deletion, one should use a zeroing software to zero it out. Then, it can never be recovered in any way!

Re GOTOmsdos:

>To perform a "physical" deletion, you should use a zeroing software to zero it out. In this way, it can never be recovered no matter what.

　　This is not necessarily the case. In the current data recovery field, there is something called "deep recovery", which is to recover overwritten data.

　　The link is as follows: Finding Lost Memories - In-depth Computer Data Recovery 3

Here I would like to talk about the recovery after the unfortunate data overwrite - deep data recovery. A person in the industry wrote to correct me, saying that there have long been deep recovery devices in China - weak magnetic reading machines. In fact, this should be a misunderstanding. The weak magnetic reading device refers to those devices that can read weak magnetic signals. For example, a hard drive is burned or thrown from a height of tens of meters to the ground. After high temperature or strong shock, the magnetic medium magnetic direction on the disk platter is chaotic. It is impossible to read digital information normally through the magnetic head. At this time, a weak magnetic reading device is needed. By accurately reading the chaotic magnetic signals, the interference information with different magnetic moment coefficients is excluded, and the original 0 or 1 magnetic signals with fixed magnetic moment coefficients are accurately extracted. Such devices do exist in China, but they cannot recover overwritten data. Because in the case of data overwrite, the original data and the overwritten data have the same magnetic moment coefficient, both are 0 or 1 digital signals. For the weak magnetic reading device, it can only see the new data that is overwritten, and cannot distinguish the overwritten data. It cannot be said that the difficulty and required technology of weak magnetic reading are not high, because it is very difficult to distinguish what is useful information and what is useless information on a disk that has undergone violent collision and has magnetic information disorder. According to the current technology, the success rate and data integrity of weak magnetic recovery are very low. However, for analog information such as video tapes and audio tapes, even if there are many interfering magnetic information, you can still see or hear a general idea, at most it is like when watching TV with poor reception, and the TV screen is full of snowflakes.

Deep data recovery is restricted by many conditions and is related to many other factors. But let's temporarily set aside all other factors and return to the root of the magnetic medium, and we will find that deep data recovery is based on such a principle: that is, a magnetic medium crystal that originally had a 0 signal, after being written with a 1 signal (here, assume that this magnetic medium crystal is crystal A), is different from a magnetic crystal that was originally a 1 signal and was also written with a new 1 signal (here, assume that this magnetic medium crystal is crystal B). Although both are read as 1 signals by the magnetic head, when detected by some other means, it will be found that there are indeed some differences. We all know that a charged particle will deflect in a magnetic field. At the same time, we can assume that there is a charged particle that enters the disk platter from top to bottom. At this time, there are 3 situations: first, the particle passes through the platter; second, the particle is bounced back; third, the particle stays in the platter. Then, combined with the above two phenomena, if we use a charged particle, or even several different charged particles, to strike crystal A and crystal B respectively, what kind of situation will occur? Will the final result be different? The premise is that the appropriate type of particle must be found, so that they can produce sufficiently obvious different feedback phenomena after hitting different crystals. In addition, we also know that when a ray enters another different density medium from a certain density medium, refraction and reflection phenomena will occur. It is using this phenomenon that experimental personnel can design a specific space, in which some media with different densities are filled respectively, so that the ray produces refraction when passing through the medium, and magnifies the slight change of the ray like a magnifying glass, so that the instrument can capture the difference. Of course, this is a very pure theoretical model constructed by stripping off all other factors, and it is impossible to exist in practice. So this is very different from the actual situation, and everyone should not expect to produce a deep recovery instrument so easily, and "experts" should not argue here.

Now, there are two main difficulties in solving the problem of deep recovery. First, generally, to detect the information at a sufficient depth of the magnetic medium crystal, a particle with relatively strong penetration ability is needed. But very paradoxically, generally, particles with strong penetration ability are not easy to be interfered and moved, and are not easy to be captured by the instrument, which brings difficulties to observation. To give an extreme example: the penetration ability of a neutrino is very strong, and it can easily penetrate the entire earth. But precisely because its penetration ability is too strong, currently no scientific and technological means can ensure that the neutrino can be effectively captured within a limited time. Second, it is not as easy as imagined to distinguish effective feedback information from invalid feedback information, and it involves many problems. For example, the material for making the disk, the type of magnetic medium, etc., need to be determined through repeated experiments to obtain the required effective characteristic information. The above are the basic theoretical bases for deep recovery.

If we assume that we can observe the data after being erased and written twice now, then, since the situation of each crystal is either 0 or 1, there will be 2 to the power of 3, that is, 8 possibilities.

Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 Case 8

Second erase and write 0 1 0 1 0 1 0 1
First erase and write 0 0 1 1 0 0 1 1
Original signal 0 0 0 0 1 1 1 1

We only need to lock the feedback phenomena in these 8 different situations. Then, no matter whether the magnetic crystal signal is interfered by other factors, as long as one of the 8 situations occurs, it corresponds to a certain digital information. Through a full-disk scan, record all digital information, and after sequential arrangement, the data signal list of the entire disk is generated. Assume that the information is arranged as follows
Crystal 1 signal Crystal 2 signal Crystal 3 signal Crystal 4 signal Crystal 5 signal Crystal 6 signal ……

Second erase and write 1 1 0 1 0 0 ……
First erase and write 0 0 0 1 1 0 ……
Original most information 1 1 0 0 0 1 ……

In that case, as long as all are strung together, it is equivalent to obtaining three layers of data on the disk through one scan. As for how to restore these 0s and 1s into useful data, it is then necessary to use software and restore it with an algorithm. The better the algorithm, the higher the restoration degree.