Tip: Run a free scan for common Windows errors ad

re: Restoring files deleted from a compressed drive Monday, April 13, 2009 at 7:44 pm Posted by ancien (46 messages posted) There are plenty of detailed posts giving step by step instructions on how to edit the environment files to be sure drvspace is running and all drives are mounted. Try: www.windowsbbs.com/windows-95-98-me-nt/72813-win95-no-boot-missing-operating-system.html or google drvspace.000 There seem to be at least three methods: 1. Mount the HD as a second drive on a running Win95 or 98 system. 2. Use a Win95 or 98 floppy to boot the system and mount the drive. 3. Apparently you can even mount the drive using some WinXP systems. Whatever you do, don't write to the compressed volume if you want to recover files. On Monday, April 13, 2009 at 11:04 am, thattoo wrote: >I'm trying to help a friend recover some data from an old Packard Bell 486 box after >she had a bad couple of years with schizophrenia and deleted almost all of the files >that were stored within C:\DRVSPACE.000 on a 420MB hard drive. > >Windows 95 boots and then asks me where the command interpreter is. If I point it >to A:\COMMAND.COM, I can run 'DIR' to see what's left on C:. Nearly all of the files >under C:\WINDOWS and C:\PROGRA~1 are gone, and I don't see a 'My Documents' or 'profiles' >folder listed anywhere. > >But if I mount an image of the whole drive on Linux and run the 'strings' command >on the DRVSPACE.000 file, I can still see the names of deleted files, and some apparently >uncompressed registry keys from the deleted SYSTEM.DAT file can be read. (I'm hoping >to reinstall the OS on a bigger drive for her because the motherboard's BIOS can >handle it, but she lost her ProductID and most of her other software registration >codes along with everything else.) > >I have my own copy of Windows 95 to run on another machine if necessary, with plenty >of room to store the restored files. > >Is there any hope, short of giving nonexistent big bucks to a data recovery service? > I was warned not to use DriveSpace myself back then, so I'm mostly lost now. (I >would know how to restore the files if they weren't compressed. Only DriveSpace >is a mystery, but enough so that I can't come up with the right words to plug into >a search engine to look it up.) [Reply or follow-up to this message] re: Restoring files deleted from a compressed drive Tuesday, April 14, 2009 at 8:49 am Posted by thattoo (10 messages posted) Thanks for the quick response, ancien. The link you provided was informative because I had encountered the same needlessly confusing drive labels that the person requesting help on windowsbbs.com had seen. When I run DriveSpace3 from Windows to mount the drive where it's attached as a slave, it tells me that I have to run ScanDisk first to repair errors. But then ScanDisk doesn't find any errors, nor does it report that it found any lost file fragments. Then, what I see on the mounted drive in an Explorer window is a list of only the same few compressed files that my friend didn't delete (the all-but-empty WINDOWS directory, for example, with the SYSTEM subdirectory missing). If I run PC Inspector File Recovery then, it does find a lot of what was in the 'Program Files' directory. There's also a _YSTEM.DA0 file in a deleted Windows directory within the RECYCLED folder, with human-readable Windows 95 and Office 97 ProductID codes, but I see no sign of anything resembling USER.DAT. I also still see no trace of her personal files or of any folder where they would ordinarily be stored, and no sign of a file shredding program. (She doesn't remember ever using one, either; she said she'd just kept hitting the Delete key in an Explorer window.) So I'm wondering whether some program other than DriveSpace3 is out there that would be able to read directly from a backup copy of her DRVSPACE.000 file and spit out the decompressed raw data that may include some of her personal files. I found some freeware called "Drivespace 3 Disaster Recovery Kit" that may help, but its author warns that finding lost files with his software is an extremely time-consuming task. He was kind enough to make the source code available, but I don't know Pascal, and I'm a bit surprised not to have found yet that anyone else has already written some sort of front end for it. Any ideas? As I indicated, I've already made a backup image of the whole drive (by running 'dd if=/dev/hdb of=/mnt/sda1/pb1666cd.img' on Linux to save everything to a file on a USB stick before letting Windows touch the data), so I can experiment and not risk losing what was still there when my friend brought her computer to me. ~~~ The people out to get you are paranoid. ~~~ On Monday, April 13, 2009 at 7:44 pm, ancien wrote: >There are plenty of detailed posts giving step by step instructions on how to edit >the environment files to be sure drvspace is running and all drives are mounted. > >Try: >www.windowsbbs.com/windows-95-98-me-nt/72813-win95-no-boot-missing-operating-system.html > >or google drvspace.000 > >There seem to be at least three methods: >1. Mount the HD as a second drive on a running Win95 or 98 system. >2. Use a Win95 or 98 floppy to boot the system and mount the drive. >3. Apparently you can even mount the drive using some WinXP systems. > >Whatever you do, don't write to the compressed volume if you want to recover files. [Reply or follow-up to this message] re: Restoring files deleted from a compressed drive Tuesday, April 14, 2009 at 6:14 pm Posted by ancien (46 messages posted) I'm understanding you to say that you can read all the contents of drvspace.000. If her files are not in drvspace.000 you are probably out of luck. The supposed ability to recover files once they have been overwritten is IMHO an urban myth. DriveSpace checks the reliability of your disk before it begins. That's normal. DriveSpace appeared with MSDOS 6.22 replacing the earlier DoubleSpace. MS changed the name because they were facing a lawsuit from Stac Electronics over similarities to its Stacker file compression utility.Commands are the same. Windows 95 added a GUI and some extra tools, but it's still the same DOS program. You can work on the file entirely in DOS. The following source gives an explanation of the DOS syntax and operations. Don't change the caps to lower case. If you do the link won't work. http://us.geocities.com/rick_lively/MANUALS/COMMANDS/D/DBLSPACE.HTM One idea is to decompress the entire drive and see what you get. Try your file recovery program again or use a hex editor to look for data. It would be a whole lot of work. My own success with file recovery programs has been very good with .jpg files and not good with Office files. Maybe it's because they are in a proprietary format. If you uncompress H it should become what was C the root drive, but with a different drive letter. All sectors will be overwritten, but you have said you can't find anything on the compressed drive anyway. In Windows 95 it's Start > Programs > Accessories > System Tools > DriveSpace. Left-click DriveSpace, highlight the drive you want to work with from the list. In the Drive menu from the toolbar, select Uncompress, and left-click Start. You must have enough room on the drive for all the decompressed files or it will abort. On Tuesday, April 14, 2009 at 8:49 am, thattoo wrote: > Thanks for the quick response, ancien. The link you provided was informative >because I had encountered the same needlessly confusing drive labels that the person >requesting help on windowsbbs.com had seen. > When I run DriveSpace3 from Windows to mount the drive where it's attached as >a slave, it tells me that I have to run ScanDisk first to repair errors. But then >ScanDisk doesn't find any errors, nor does it report that it found any lost file >fragments. > Then, what I see on the mounted drive in an Explorer window is a list of only >the same few compressed files that my friend didn't delete (the all-but-empty WINDOWS >directory, for example, with the SYSTEM subdirectory missing). > If I run PC Inspector >File Recovery then, it does find a lot of what was in the 'Program Files' directory. > There's also a _YSTEM.DA0 file in a deleted Windows directory within the RECYCLED >folder, with human-readable Windows 95 and Office 97 ProductID codes, but I see no >sign of anything resembling USER.DAT. I also still see no trace of her personal >files or of any folder where they would ordinarily be stored, and no sign of a file >shredding program. (She doesn't remember ever using one, either; she said she'd >just kept hitting the Delete key in an Explorer window.) > So I'm wondering whether some program other than DriveSpace3 is out there that >would be able to read directly from a backup copy of her DRVSPACE.000 file and spit >out the decompressed raw data that may include some of her personal files. I found >some freeware called "Drivespace >3 Disaster Recovery Kit" that may help, but its author warns that finding lost >files with his software is an extremely time-consuming task. He was kind enough >to make the source code available, but I don't know Pascal, and I'm a bit surprised >not to have found yet that anyone else has already written some sort of front end >for it. > Any ideas? > As I indicated, I've already made a backup image of the whole drive (by running >'dd if=/dev/hdb of=/mnt/sda1/pb1666cd.img' on Linux to save everything >to a file on a USB stick before letting Windows touch the data), so I can experiment >and not risk losing what was still there when my friend brought her computer to me. > > > ~~~ The people out to get you are paranoid. ~~~ [Reply or follow-up to this message] re: Restoring files deleted from a compressed drive Tuesday, April 14, 2009 at 6:25 pm Posted by thattoo (10 messages posted) >I'm understanding you to say that you can read all the contents of drvspace.000. Not exactly. What I'm saying is that I can read all of the files that can be restored by either DriveSpace3 or PC Inspector File Recovery—i.e., the data that, through the use of those two programs, can be copied to a never-compressed drive as files that have intact file information, or that have filenames whose first character only was replaced with an underscore, or that have been assigned a 'cluster [some number]' filename because the file recovery program found whatever kind of metadata it happened to be looking for, wherever it happened to be looking for it. (I don't know exactly what it does and does not try to find; it is freeware, but it's not open source.) Many of the files I did restore are corrupted, apparently as a result of a common problem described in the documentation for that 'DriveSpace 3 Disaster Recovery Kit' software. I don't know how to read the rest of the decompressed raw data from the area within that DRVSPACE.000 file. With that freeware file recovery program, I was able to retrieve only about 700MB out of nearly 900MB total. When that software copies the data to a separate drive to restore the files, it's not smart enough to replace gibberish characters with valid file information to prevent Windows from assuming that the destination hard drive is full (despite that drive's having a whole 5GB of free space, compared to less than 1GB of decompressed data that could possibly need to be stored on it). That corrupted file information prevents me from retrieving any deleted files from at least two directories. One is the root directory, not a good one to do without when I want to reinstall the OS on an unfamiliar machine; and the other, alas, is the folder containing my friend's personal data. I can't decompress the drive and expect to retrieve all of the free space, because most of the free space is exactly what the DriveSpace program is likely to discard to make room for the files it believes to exist, which take up 390MB out of just a little over 400. But because I do have a backup image of the whole drive, I will try it once, just in case some bug or fluke makes a 'My Documents' folder magically appear out of nowhere. (When I mount the drive, all that shows up in an Explorer window is the same thing I pulled up with 'DIR' at the DOS prompt on her machine when I booted C: and had to tell what was left of the OS that the command interpreter was on a floppy: about 100MBs' worth of mostly useless files, and I do have the folder options set to display every file that Explorer will let me display.) If I want to help her, I need to start with the assumption that at least some of her personal files were not overwritten. I might be able to read the rest by going through the data, one tiny piece at a time, with that 'Disaster Recovery Kit' program, because the problem I'm having here seems to be just the sort of problem that that software was written to solve. But I'm really hoping that, after all these years, someone would know of some easier way that just wouldn't happen to occur to me when I haven't been using Windows much lately. Now I'm in the middle of finding out whether the Cygwin port of dd can interpret a mounted 'drive' as a real drive and write the whole file's decompressed contents to a drive image file. I don't want to get my hopes up too high there, but it does seem possible. I've also found an old Linux kernel module called 'dmsdos' that's said to have had some success in reading those sadistic DRVSPACE.### files, but I haven't seen anything said about its being able to recover arbitrary raw data when the FAT has been mangled. Is my situation a little clearer now? You've been kind, ancien. ~~~ The people out to get you are paranoid. ~~~ [Reply or follow-up to this message] re: Restoring files deleted from a compressed drive Thursday, April 16, 2009 at 9:34 am Posted by ancien (46 messages posted) Yes. Clearer. Dean Trower's utilities are working. Best of luck to you. On Tuesday, April 14, 2009 at 6:25 pm, thattoo wrote: >>I'm understanding you to say that you can read all the contents of drvspace.000. > > Not exactly. What I'm saying is that I can read all of the files that can be >restored by either DriveSpace3 or PC Inspector File Recovery—i.e., the data >that, through the use of those two programs, can be copied to a never-compressed >drive as files that have intact file information, or that have filenames whose first >character only was replaced with an underscore, or that have been assigned a 'cluster >[some number]' filename because the file recovery program found whatever kind of >metadata it happened to be looking for, wherever it happened to be looking for it. > (I don't know exactly what it does and does not try to find; it is freeware, but >it's not open source.) Many of the files I did restore are corrupted, apparently >as a result of a common problem described in the documentation for that 'DriveSpace >3 Disaster Recovery Kit' software. > I don't know how to read the rest of the decompressed raw data from the area within >that DRVSPACE.000 file. With that freeware file recovery program, I was able to >retrieve only about 700MB out of nearly 900MB total. When that software copies the >data to a separate drive to restore the files, it's not smart enough to replace gibberish >characters with valid file information to prevent Windows from assuming that the >destination hard drive is full (despite that drive's having a whole 5GB of free space, >compared to less than 1GB of decompressed data that could possibly need to be stored >on it). > That corrupted file information prevents me from retrieving any deleted files >from at least two directories. One is the root directory, not a good one to do without >when I want to reinstall the OS on an unfamiliar machine; and the other, alas, is >the folder containing my friend's personal data. > I can't decompress the drive and expect to retrieve all of the free space, because >most of the free space is exactly what the DriveSpace program is likely to discard >to make room for the files it believes to exist, which take up 390MB out of just >a little over 400. But because I do have a backup image of the whole drive, I will >try it once, just in case some bug or fluke makes a 'My Documents' folder magically >appear out of nowhere. (When I mount the drive, all that shows up in an Explorer >window is the same thing I pulled up with 'DIR' at the DOS prompt on her machine >when I booted C: and had to tell what was left of the OS that the command interpreter >was on a floppy: about 100MBs' worth of mostly useless files, and I do have the >folder options set to display every file that Explorer will let me display.) > If I want to help her, I need to start with the assumption that at least some >of her personal files were not overwritten. I might be able to read the >rest by going through the data, one tiny piece at a time, with that 'Disaster Recovery >Kit' program, because the problem I'm having here seems to be just the sort of problem >that that software was written to solve. > But I'm really hoping that, after all these years, someone would know >of some easier way that just wouldn't happen to occur to me when I haven't been using >Windows much lately. > Now I'm in the middle of finding out whether the Cygwin port of dd can interpret >a mounted 'drive' as a real drive and write the whole file's decompressed contents >to a drive image file. I don't want to get my hopes up too high there, but it does >seem possible. > I've also found an old Linux kernel module called 'dmsdos' that's said to have >had some success in reading those sadistic DRVSPACE.### files, but I haven't >seen anything said about its being able to recover arbitrary raw data when the FAT >has been mangled. > Is my situation a little clearer now? > You've been kind, ancien. [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows 95 Discussion Forum