You are here: The Oldskool PC/Oldskool PC Software/PADD

PADD

A deleted data exploration and recovery tool for FAT12/FAT16 filesystems

Introduction

PADD (Peek At Deleted Data) allows the user to examine the deleted and unused areas of a DOS FAT12 or FAT16 filesystem, and works with both floppy disks and hard disks. The primary audience are vintage computer collectors who are archiving or exploring their new acquisitions, however the tool is useful for anyone who wishes to recover deleted and inaccessible space on their disks/drives. Using PADD, the user can:

PADD was created primarily for the vintage computer enthusiast as an archeaology and archival tool. Typical DOS computer preservation methods archive file data only. Using PADD, it is now possible to archive all deleted and in-use-but-inaccessible ("slack") data areas as well.

This utility performs two new techniques never before seen in other DOS data recovery tools, so it's worth going over both of them in detail. The two techniques are "freezing deleted data" and "file slack space".

FREEZING DELETED DATA

Background: When files are deleted in a DOS filesystem, the data never actually goes away. DOS marks the file's directory entry as deleted, but then takes no additional action. Popular "undelete" utilities can restore the deleted file by finding the "erased" directory entry and restoring it. However, if a new file or directory was created before those tools can be run, those erased directory entries cannot be reclaimed, making exact restoration of the deleted file impossible. However, this doesn't mean the deleted file's *contents* are permanently gone! Until they are overwritten by a new file, they are still physically present on the drive.

What it does: "Freezing" finds all of the deleted data in the filesystem and then creates a new file in the root directory called DELETED.DAT that contains only the deleted data. This process does not overwrite anything other than a single unused directory entry to hold the file. The deleted data is marked as being in use by the file, "freezing" it in place so that it cannot be overwritten. This "frozen" file can now be copied just like any other file, and when you're done with it, can be deleted to free up the deleted data space.

FILE SLACK SPACE

Background: In DOS, files are stored in one or more chunks of space called clusters. Clusters can only be used for a single file's contents, so if the last cluster in a file is not completely filled up, there is extra data contained in that cluster after the end of the file. This extra data is called "slack" space. Slack space can contain almost anything, from the former contents of older or re-written files, to DOS memory structures from previous operations, to empty formatted space.

What it does: PADD's slack space command-line switch will find all of the file slack areas and write them to a new file for examination. (It is recommended that you write the new file to a different drive than the one you are examining, to prevent overwriting any deleted data you are examining.)

For full documentation, please see the included PADD.DOC file in the download distribution.

Demonstration

As soon as I have a video camera hooked up, I'll give a demonstration of the program and typical usage scenarios. Until then, here are some screenshots of PADD in action:

PADD startup sanity checks. Filesystem information is presented to the user to approve that the program is functioning properly before continuing.

Viewing deleted data in RAW mode.

Viewing deleted data in one of the HEXDUMP modes.

Searching a filesystem for slack space.

Downloads

padd.zip: The program with documentation and source code. Runs on any PC with 256K total RAM or higher.

Questions and Answers

Q: Wouldn't using an imaging tool (ie. Norton Ghost, dd, etc.) be a more complete option for archiving a drive? Absolutely! The problem is, they are hard to come by. Norton Ghost 3.0 and earlier should work, as should booting MINIX and using dd.

Q: Is it safe to use? As safe as I can make it, yes. I tested on a wide variety of filesystems, and I also tested on my own development machine, so I was almost ludicrously careful. I have not lost any data running or developing PADD.

Q: If I lose data using the tool, can I sue you? Nope. But please let me know, so that I can either help you, or at the very least find out what went wrong.

Roadmap

PADD does everything I envisioned, so I don't have any additional features planned at this time. If you'd like to suggest any, feel free to contact me.

Known Bugs

Initial release -- no known bugs.

Development History

Version 1.0 -- initial release.


[Oldskool Home] [Copyright and Usage] [Disclaimer] [Contact Me]

This page's content was last modified on Dec 21, 2015 4:31 pm.
If anything here has helped you, please consider donating to help keep this site alive.