The UNFORMAT Command By Kenneth Johnson, Chicago Computer Society In February's column we looked at the FORMAT command, and discussed briefly how to deal with an accidental format. This month we'll continue with an in depth look at the UNFORMAT command. Introduced with DOS 5.0, UNFORMAT attempts to recover a disk that has been inadvertently formatted. Depending on the type of format and whether any data has been written to the disk meanwhile, UNFORMAT probably can completely recover the disk. UNFORMAT can also be used together with the MIRROR program to restore a hard disk's partition table. We'll look at both functions. First, a quick review the FORMAT command. FORMAT prepares a disk for use by "initializing" the surface; creating the sectors, File Allocation Table (FAT), and directory; and checking for and marking bad sectors so they are not used. FORMAT can also be used to create a bootable floppy disk and to erase an old disk and check it for physical defects. A major enhancement in DOS 5.0 is the "safe" format, which is now the default. If you format a previously formatted disk, FORMAT will save the FAT and root directory information in a hidden file (called the "MIRROR image" file) on the disk. The FAT and root directory are then erased, but the data itself is not deleted or physically overwritten. The UNFORMAT command can use this MIRROR file to restore the disk. If you need to recover an accidentally formatted disk, the key is to run UNFORMAT immediately. UNFORMAT will attempt to recover the disk with the MIRROR image file if one exists; if not it will try to recover based on the data that remains. When the newly formatted disk is used (i.e., files are written to it), your chances of recovery drop significantly. The one situation where UNFORMAT cannot help is a disk that has been formatted with the "/U" switch. /U does an Unconditional, full format; the FAT is cleared, and all data on the disk is overwritten. Because the information is physically gone, UNFORMAT cannot recover the disk. Recovering a Disk with UNFORMAT If you've accidentally formatted a disk using DOS 5.0, and didn't use the /U switch, the format didn't physically delete information on the disk and can possibly be undone. The syntax of the UNFORMAT command is: UNFORMAT [d:] [/J] UNFORMAT [d:] [/L] [/P] [/TEST] [/U] UNFORMAT /PARTN [/L] d: is the drive containing the disk to unformat. It is required unless using the /PARTN switch. /J Verifies the existence of the MIRROR image file and checks whether it corresponds with the system area of the disk. This option does not actually do the unformatting. /L When used by itself, it lists all directories and files found on the formatted disk without making use of the MIRROR image file. When used with the /PARTN switch, it displays the current partition table. /P Sends output messages of the procedure to the printer (specifically LPT1, the first parallel port). /TEST Simulates the unformat without using the MIRROR image file. UNFORMAT will show what files and subdirectories will be recovered, but does not do the unformatting. /U Unformats the disk without using a MIRROR image file. You would use this switch if the MIRROR file exists but is out of date. /PARTN Restores the hard disk partition table based on information in the file PARTNSAV.FIL, created previously on a floppy disk with the MIRROR /PARTN command. We'll discuss this use of UNFORMAT below. Unless you explicitly tell it otherwise with /U or /L, UNFORMAT will search the disk for a MIRROR image file. If more than one is found, you can choose which file to use (you'll be shown the dates and times each MIRROR file was created). Upon your confirmation, UNFORMAT will replace the system information on the disk with that from the MIRROR file. The FAT and root directory are both restored. If no information has been written to the disk since the format, the recovery is 100% complete and nothing else needs to be done. If the MIRROR image file is not used and the disk wasn't unconditionally formatted, UNFORMAT will search the disk for subdirectories and rebuild the disk's directory tree þ a time consuming process. First level subdirectories will be restored as SUBDIR.1, SUBDIR.2, etc. since their original names were lost when the root directory was cleared. Files in subdirectories will be recovered as much as possible, but if a file is fragmented UNFORMAT only can recover the first fragment. You'll be asked if fragmented files should be truncated or deleted. Unfortunately, UNFORMAT cannot recover any files in the root directory because their directory entries are gone. If you must recover those files, you'll have to use a third-party utility like Norton Utilities that lets you examine available clusters and put them together into files. Doing so is slow and difficult; Peter Norton himself has likened it to the Iranians trying to piece together the shredded documents at the American Embassy! Let's look at what happens when you UNFORMAT with a MIRROR image file. Suppose you've accidentally formatted the disk in the A: drive, but used DOS 5.0 and did not use the /U switch. The command UNFORMAT A: will display the following messages: Restores the system area of your disk by using the image file created by the MIRROR command. WARNING!! WARNING!! This command should be used only to recover from the inadvertent use of the FORMAT command or the RECOVER command. Any other use of the UNFORMAT command may cause you to lose data! Files modified since the MIRROR image file was created may be lost. Searching disk for MIRROR image. The last time the MIRROR or FORMAT command was used was at 11:30 on 02-24-93. The MIRROR image file has been validated. Are you sure you want to update the system area of your drive A (Y/N)? Y The system area of drive A has been rebuilt. You may need to restart the system. After the disk is unformatted, the FAT and directories will be restored to the way they were when the MIRROR image file was created. If no new data has been added to the disk since then, the directory and FAT will be correct. If the formatted disk was used there may be problems with certain files, but at least you won't have lost everything. To verify the MIRROR image file without actually doing the unformat, use the /J switch. UNFORMAT A: /J will display the following: Restores the system area of your disk by using the image file created by the MIRROR command. WARNING!! WARNING!! This command should be used only to recover from the inadvertent use of the FORMAT command or the RECOVER command. Any other use of the UNFORMAT command may cause you to lose data! Files modified since the MIRROR image file was created may be lost. Searching disk for MIRROR image. Just checking this time. No changes written to disk. The last time the MIRROR or FORMAT command was used was at 11:30 on 02-24-93. The MIRROR image file has been validated. The system area does not agree with the MIRROR image file. The system area doesn't agree because it was cleared by the format. If the MIRROR image file does agree with the system area the last message will be: The system area of drive A has been verified to agree with the MIRROR image file. Unformatting without using the MIRROR image file is incomplete at best, but is probably better than losing everything. It may be necessary if you formatted with an earlier version of DOS, used a third-party formatting utility that doesn't save the MIRROR file, or if the MIRROR file itself is corrupt or missing. Remember that you can't recover files from the root directory but probably can get back files in subdirectories. You can use the /L switch to see the directories and files that can be found. UNFORMAT A: /L will display: CAUTION! This attempts to recover all the files lost after a format, assuming you've not been using the MIRROR command. This method cannot guarantee complete recovery of your files. The search-phase is safe; nothing is altered on the disk. You will be prompted again before changes are written to the disk. Using drive A: Are you sure you want to do this? If so, press Y; anything else cancels. ? Y Searching disk. . . . x% searched, x subdirectories found. The count will continue until the entire disk has been searched. Next, UNFORMAT will "walk the directory tree," searching each directory for files. You'll see a list of all files and subdirectories as UNFORMAT finds them. Remember that all first- level subdirectories will have lost their original names and will be displayed as SUBDIR.1, SUBDIR.2, and so forth. You'll then be asked if you're ready to do the unformat. If you say Yes, UNFORMAT will recover the subdirectories and files. If a file is fragmented, UNFORMAT can only recover the first fragment. In such cases you'll be asked if you want to truncate or delete the file. When UNFORMAT is complete, you'll want to do a DIR and examine the directories and files on the disk. If some files are still missing, you can try the UNDELETE command to attempt recovery of additional files. As you can see, unformatting with the MIRROR image file is easier and much more certain. So when running FORMAT, do a "safe" format by not using the /U switch. This will ensure the MIRROR image file is created and that the data isn't physically overwritten on the disk. If you've accidentally formatted an important disk, run UNFORMAT as soon as possible þ certainly before anything is written to the disk. Recovering a Partition Table with UNFORMAT Another, perhaps less obvious use of the UNFORMAT command is to restore a damaged hard disk partition table. UNFORMAT does this together with the MIRROR command, which saves a copy of the partition table and boot record information in a file on a floppy disk. Each physical hard disk is organized into one or more partitions; each partition is a logical disk drive. For example, one physical 130Mb disk drive might be partitioned into two logical drives, a 100MB C: drive and a 30Mb D: drive. The first sector on each hard drive contains a partition table, with one entry for each partition. These entries have information on where the partition starts, how many sectors it contains, and whether a particular partition is the one to boot from. The partition table also includes the master boot record and the "bootstrap" program that loads the operating system when you turn on the computer. A partition table can become corrupted because of a hardware problem or virus, or if you've been editing disk sectors and made an error. Viruses particularly like attacking the partition table since a damaged table makes the entire hard disk inaccessible. If you can't boot from the hard disk, or get an "Invalid drive specification" error when trying to access a hard disk, it might be a damaged partition table. Before disaster strikes, use the DOS 5.0 MIRROR command to save a copy of the partition table and boot record to a floppy disk. UNFORMAT can then use this copy to restore the hard disk partition table. The command is: MIRROR /PARTN You'll be prompted to insert a formatted disk into a specified disk drive. MIRROR will read the partition information for all the hard drives and write it out to a file called PARTNSAV.FIL on the floppy disk. Ideally you should write PARTNSAV.FIL to your emergency boot disk. The emergency boot disk allows you to boot your computer from the A: drive, thus bypassing the C: drive which may be unaccessible. Include the file UNFORMAT.EXE on the emergency boot disk also, since you'll need it to restore the partition table. (See "Creating an Emergency Boot Disk" in the February 1993 Hard-Copy for more information.) To restore a damaged partition table, use this form of the UNFORMAT command: UNFORMAT /PARTN [/L] You'll be prompted to insert the disk containing the PARTNSAV.FIL file created by MIRROR. Adding the /L switch will display the disk's partition table, without doing any recovery. Here is an example display of the partition table information: Hard Disk Partition Table display. Drive # 80h has 1023 cylinders, 9 heads, 17 sectors (from BIOS). The following table is from drive 80h, cylinder 0, head 0, sector 1: Total_size Start_partition End_partition Type Bytes Sectors Cyl Head Sector Cyl Head Sector Rel# ----------- ---------------- --------------- ---------------- ------ Huge Boot 76M 15602 0 1 1 1022 8 17 17 The Type "Huge" indicates a partition greater than 32Mb. You might also see "BIGDOS," or perhaps "DOS12" or "DOS16" indicating DOS partitions with 12 or 16 byte FAT entries. "Boot" identifies this as the partition booted from. If your disk has partitions for other operating systems (such as Unix) or set up by a non-DOS disk manager (such as OnTrack's Disk Manager), you'll see other names here. Total_size shows the size of the partition in megabytes and the total number of sectors. Start_partition shows where the partition starts, End_partition where the partition ends. Rel# shows the start of the partition in sectors from the beginning of the disk. If your partition table is damaged, you'll probably see "garbage" or error messages in this display. UNFORMAT and MIRROR are important additions to DOS 5.0 to recover from accidental formats and damage to your partition table. Some points to keep in mind with UNFORMAT, MIRROR, and FORMAT: þ For the safest FORMAT don't use the /U switch. FORMAT will save the recovery information in the MIRROR image file for possible use by UNFORMAT. þ UNFORMAT can never restore a disk that was unconditionally formatted with /U. þ In case of an accidental format run UNFORMAT as soon as possible. As long as no new files are written to the disk, and if you didn't use the /U switch, the chances of recovery are excellent. þ If you need to unformat a disk, first do the UNFORMAT with the /J switch. This will verify the MIRROR image file exists and checks it against the current system area, but doesn't do the unformat. It will give you an idea how successful the unformat might be. þ If you believe the MIRROR image file is out of date, you can use the /U switch to tell UNFORMAT to recover the disk without using the MIRROR file. Remember though that files in the root directory cannot be restored. þ If you want to see how UNFORMAT would recover the disk without the MIRROR image file, and without doing the unformat, use the /TEST switch. þ Use the MIRROR /PARTN command to save your hard disk partition information to your emergency boot disk. Make sure to include UNFORMAT.EXE on the disk. If your partition table is corrupted, you can use UNFORMAT /PARTN to restore it from the floppy disk. þ And remember þ particularly with a hard disk þ there is no substitute for a good backup of your data.