Reply to: Foul file deletion

[Diver]

Anyways, getting back to the point: was there any kind of program with a backup utility on the machine? Many DOS programs made backups by changing the last letter of the filename. This sounds like a likely scenario: maybe finger trouble and they made the whole disk a backup, and then they kindly deleted everything to try and cover the first mistake?

The accounts program was Pegasus (to run in Dos)
The Database I can't remember the name of off hand, but they were stand alone programs with separate Backup facilities.?

I was going to download the op system & prog files on to an ext hard drive to study at a later date, but they were worried that I might download confidential patient info!

[Sysman]

Yep, how many times have you seen companies that religiously run backups.....but never actually test that the data can be restored???...

The WORN backup strategy.

Write Once, Read Never.

™®© Sysman.

[angusglover]

Either way you probably screwed up all forensics there so what exactly happened will probably never be established. This is just a reminder that undelete is not a substitution for a good backup strategy that should be regularly tested by restoring data into cloned machine to see if backups actually work.

Yep, how many times have you seen companies that religiously run backups.....but never actually test that the data can be restored???...

[Bluebird]

First used Clipper in a Gvt dept - they have still got it !

[threaded]

Anyways, getting back to the point: was there any kind of program with a backup utility on the machine? Many DOS programs made backups by changing the last letter of the filename. This sounds like a likely scenario: maybe finger trouble and they made the whole disk a backup, and then they kindly deleted everything to try and cover the first mistake?

[Diver]

Fortran Rules

[AtW]

Yes I did some Basic too, but soon moved to assembly, so there youngster

[Diver]

I think mine fell off the back of a lorry, it certainly looked like it when I got it.

as for the Sinclair ZX81, you certainly missed something special there.

the instruction book came with a delightfull little program to type in that showed a sine wave.
It took two days to type in (Basic) and two days to debug.

It was a very pretty sine wave though!

[AtW]

No, I had to use this: http://www.taswegian.com/MOSCOW/mk-61.html

105 bytes of memory that gets wiped out when you switch it off, polish reverse logic - unfortunately proper small computers were extremely expensive and my parents could not afford them until IBM PC 386 in 1994

[Diver]

Did you rush out and buy a ZX81 too!

[AtW]

And I was playing with punchcards in early 80s...and I used my fair share of black and white, and mono-crome (not just green, but other worse colour) screens

[Diver]

I think they made a number of changes in v6.x of DOS to aid their own undeletion - at the time (early 90s) there was big outcry from vendors like Norton that pioneered undelete command, and Stacker who were miffed at having DoubleSpace provided as part of DOS. My guess is that that file was deleted with something else than del command - this missing first letter behavior was standard in DOS, I myself manually recovered deleted files using Norton Utilities Disk Editor. You sound like a youngster who never edited FAT using Disk Editor

Either way it is all ancient history - good backups are a must.

As soon as I spotted that the file names had been stripped at both ends I knew that Dos Del had not been the tool used!
(As for editing FAT, it's a serious problem, Not enough Exersize)

I.v still got Norton Utils on floppy from the late 80s, I used to own a top of the range IBM portable with Green Screen, everything you looked at used to have a pink tinge for about 2hrs after using it. youngster

[AtW]

I think they made a number of changes in v6.x of DOS to aid their own undeletion - at the time (early 90s) there was big outcry from vendors like Norton that pioneered undelete command, and Stacker who were miffed at having DoubleSpace provided as part of DOS. My guess is that that file was deleted with something else than del command - this missing first letter behavior was standard in DOS, I myself manually recovered deleted files using Norton Utilities Disk Editor. You sound like a youngster who never edited FAT using Disk Editor

Either way it is all ancient history - good backups are a must.

[Diver]

Done uncounted number of recoveries because of Dos Del. but never come accross both ends of the file name being stripped before!

That's why I posted it.

as for the forensics! - We are talking about 1 x pentium1- 4 x 486 DX's and an SX. they probably had an 0806 greenscreen connected to a sinclair ZX81 in the basement as well for all I know

thankfully they let me talk them into a complete new install.

[AtW]

It's been a while since I used Norton Utilities to recover data on DOS, but I vaguely remember that those missing characters were normal feature of DOS when it was deleting files.

This link: http://www.vfrazee.com/ms-dos/6.22/help/undelete.htm seems to suggest that missing first letter is normal - you only get full letters if some extra software is running to assist undelete.

Either way you probably screwed up all forensics there so what exactly happened will probably never be established. This is just a reminder that undelete is not a substitution for a good backup strategy that should be regularly tested by restoring data into cloned machine to see if backups actually work.