October 10th, 2003, 11:49 AM
Join Date: Oct 2000
Location: Back in the real world.
Good old DOS times ...
With most modern OSs this is close to impossible because they can overwrite the deleted file's data immediately.
If you deleted a file by accident, in the same second you have to make this decision:
- Is it worth pressing the power switch immediately?
Then you usually have a good chance to recover files because the write cache might not have been flushed.
But you might destroy other data with this, so use on your own risk.
Then boot from a CD or Floppy and start a recovery program.
Still there is no guarantee that it can do anything for you. And the probability of a successful recovery depends on many other factors too.
If the OS does any further write actions to this partition though, like when shutting down, it could be too late.
You asked this in the Delphi Forums, so I guess you want to know how to write such a program?
You need to download the specifications for your file system. In case of eg. NTFS this is not publicly available.
Then you can write a program that reads the partition sector by sector and it will be your program that has to analyze the structure according to the specifications, search for the lost data and try to rebuild the file from the raw sectors.
In windows you'll have to search the WinAPI for the functions to read raw sectors. You can then boot into the recovery console and run the program from there.
Another way would be a DOS program using BIOS int13h to read raw sectors.