Actually, the FAT itself is just a flat array indexed by allocation unit. The data held is either a marker for empty space, a marker for the last unit in a file or a reference to the next unit. When a file is deleted, the first character in the directory entry is changed and the FAT entries are reset to empty space - all that is left is a pointer to the first unit. The reason why undelete programs work on FAT is because they have intimite knowledge of how the OS places files and that takes an educated guess at what part of the file went where.Yes, but it worx safely only in case the FAT (fs ?) is not fragmented ...
Jason
if clusters of files A and B are "mixed" (i.e. stored like "a1 b1 a2 b2 a3 b3",
"a1 a3 a2 b1 b3 b2" etc.) undelete will give corrupted files.
Special "undelete" info (stored in extra file) must be used.
noro
-- [EMAIL PROTECTED] mailing list
