Copyright: Copyright Alex Mokrov 2002
Citation: Alex Mokrov, 2002


Back2Life

Back2Life for TC - plugin for Total Commander (ex Windows Commander) that allows you to undelete erased files in your favorite file manager!


Properties: Start cluster
File contents are stored on disk starting with this cluster


Properties: Clusters total
File contents are stored on disk using this many clusters. Summary clusters size is always equal to or greater than the real file size.


Properties:  Cluster size
Cluster size depends on disk configurations and usually equals to several kilobytes


Properties: Damage
Damage indicates the ratio of overwritten clusters to original clusters. Damage is calculated for files only.


Properties: Cluster-use map
Cluster-use map graphically displays how much and where a file is overwritten by other data.

Cluster-use map is available for files only


Properties: Name
The name of file or folder. If the first name character was not discovered, a question mark is used.


Properties: Full path
The full path to file (folder)


Properties: Dates and times
Date and time of creation, modification and access


Introduction

The Recycle Bin for Windows has been designed to protect files from accidental erasure, but what happens if you want to recover a file deleted from the Recycle Bin itself? Or, what if your deleted file didn't get to the Recycle Bin? Viruses will not send anything to the Recycle Bin! Give Back2Life a chance to find and unerase those files!

With Back2Life for TC you can treat erased files just like normal ones and unerase them right in Total Commander file manager!


License agreement

BY INSTALLING, COPYING, OR OTHERWISE USING THE SOFTWARE, YOU AGREE TO BE BOUND BY ALL OF THE TERMS AND CONDITIONS OF THE LICENSE AGREEMENT.

This software is provided "as is" and is without warranty of any kind. The author of this software does not warrant, guarantee or make any representations regarding the use or results of use of this software in terms of reliability, accuracy or fitness for purpose. You assume the entire risk of direct or indirect, consequential or inconsequential results from the correct or incorrect usage of this software even if the author has been informed of the possibilities of such damage. Neither the author nor anybody connected to this software in any way can assume any responsibility.

You may install a copy of the Software on a computer and freely move the Software from one computer to another, provided that you are the only individual using the Software. You may use a copy of the Software for files less than 64K without registration for as long as you want.

You may not transfer, rent, lease, lend, copy, modify, translate, sublicense, time-share or electronically transmit or receive the Software, media or documentation except permanent basis provided you retain no copies and the recipient agrees to the terms of the License Agreement. You acknowledge that the Software in source code form remains a confidential trade secret of author and therefore you agree not to modify the Software or attempt to reverse engineer, decompile, or disassemble the Software.


Program features

Back2Life for TC 2.1 supports:

•	Operating systems: MS Windows 95/98/Me and NT/2000/XP

•	File systems: FAT12, FAT16 and FAT32 (including Floppies, ZIP, JAZZ and other removable disks)

•	Browsing the existing and erased folders with erased files

•	Searching for specific erased files

•	Restoring stand-alone files and entire folders with erased files (including subfolders)

•	Standard and Alternative restoration algorithms

•	Cluster-Use Map for file properties

•	Estimate of the file damage

•	Long file names

•	Non-English characters in file names

Program works with Total Commander 5.5 and up. Some features will work only with Total Commander 5.51 and up

Standalone version of Back2Life with many extra features can be found here.


Technical information: Introduction

This part is designed to explain some technical details on undeleting files and is not really necessary to read :). But in case of some problems, this material can help you understand the process, as well as satisfy your technical curiosity. This information is not complete and presents only basic terms.

FAT file system

Erasing and Unerasing files

Alternative method

Recommendations


Technical information: FAT file system
FAT file systems

The FAT file system has the file allocation table located at the beginning of a logical volume. FAT was designed for small disks and simple folder structures. Two copies of the file allocation table are stored on the volume. In the event that one copy of the file allocation table is corrupted, the other file allocation table is used.

Back2Life supports the following FAT file systems:

•	FAT12 (used for floppies),

•	FAT16 (fairly small disks and partitions, mainly used under DOS and first Windows 95 systems)

•	FAT32

The number 12, 16 or 32 determines amount of bits used to store one FAT entry. All these file systems are supported by operating systems Microsoft Windows 95-98-Me and NT-2000-XP.

The base unit for storing information on FAT disks is the cluster. Cluster sizes depend on FAT version and disk configurations, and are usually equal to several kilobytes. If a file doesn't fit to a single cluster, system reserves several clusters to store it. When file clusters are not sequental but are separated in fragments at different locations, we call this a fragmented file.

FAT file systems store file name, size and attributes in the Directory Table, while file content is stored in disk Data Area. The Directory Table record of the file also stores the number of the first cluster file content in Data Area, while the remaining sequence of cluster numbers is stored in FAT (File Allocation Table). The clusters in FAT are specifically marked. The first file cluster (if file takes more than one) holds the ordinal number of the following cluster, the following cluster holds the ordinal numbers of its following cluster and so on. The last file cluster holds special value that indicates that it is the end of file. By reading cluster marks and contents, the system aggregates the entire file for future use (such as copying, editing etc.).


Technical information: Erasing and Unerasing files
Erasing and Unerasing files on FAT disks

When you delete a file it is not physically erased from the disk. To reduce the operation time, the system only deletes the first character of the file name in Directory Table so other regular programs can no longer "see" it (that's why sometimes it is impossible to find out the first filename character. But, files created under Windows usually have doubled records). This Directory Table record can be reused later for another file or folder. Also the system clears all the clusters' marks, so they appear empty (unused). During the course of further disk use, these clusters can be reused to store other files. The Damage rates displayed by Back2Life indicate the ratio of reused clusters which had been earlier used by now-erased file.

Because of the loss of cluster marks, at restoration ATTEMPT we may only assume that file was not fragmented and all its clusters are sequental. Starting at the first file cluster (this value is not lost when file is erased), the program reads the ASSUMED file content from the corresponding number of sequential clusters. It is no wonder that this assumption is not always correct.

That's why sometimes, even with a Damage ratio of zero percent, the file can't be successfully restored. Usually in such cases the file's integrity has been broken - the restored file begins correctly, but at its end it holds the content of another file... It is also possible that file clusters have been reused and erased again - they still look untouched but the content has been changed.

Three following things determine restoration success for FAT disks:

•	if file record in Directory Table hasn't been reused (if it was, file will not even be found by Back2Life)

•	if file cluster sequence is assumed correctly

•	if file clusters were not reused after it's deletion

All this is quite sad, BUT: FAT disks were not designed for file undeleting so the possibility to even try to restore at least something is Grace by itself! However, in most cases the files can be restored completely.


Technical information: Alternative method
Alternative restoration method

The Alternative algorithm is only helpful for files with damage ratio more than 0% and less than 100%.  If file damage is zero percent, the Alternative method makes the same result as Standard.

The major difference is that Alternative algorithm saves not the daisy cluster chain, but the sequence of unused clusters (this means that reused clusters are skipped).

The Alternative algorithm idea is based on assumption that file was initially fragmented. For example, if right after the file has been erased (and its content was not overwritten yet) its damage ratio is more than 0%, most likely that file was fragmented and only Alternative algorithm can restore it correctly.


Technical information: Recommendations
Recommendations

The following three things are important for restoration considerations:

(1) The less time since the disk has been defragmented, (2) the sooner you make a restoration attempt, and (3) the smaller the size of the file - the more chances for success we have. <Your conclusions here>

When program saves restored file it reads its content and writes it to a new file with the same name. It is recommended that you save files on another disk because of the risk of overwriting other erased files with the new saved one. If you still choose to save files on the same disk from where they were restored, all files will be read from disk to memory and only after that will be written to disk. Then to check the condition of other erased files on disk, it will be re-scanned.


Special thanks

•	To God (first of all for the life!)

•	Christian Ghisler

•	Alexei Rudenko

•	Alexander Mamontov (J-34)

•	All users who sent their comments and suggestions


Install and Uninstall

To install Back2Life for TC on computer:

  1. Unzip the archive to any directory

  2. Launch Total Commander and choose Configuration -> Options -> Operation -> FS-Plugins

  3. Click "Add"

  4. Go to the directory where the archive was unzipped, and select Back2Life.wfx

  5. Click OK.

Please note: If you install Back2Life for TC right before undeleting files, DO NOT unzip it to the drive where these files are located, because they can be overwritten!

You can now access the plugin in "Network Neighborhood" as [Erased files]. Read more how to use it...

To uninstall Back2Life for TC:

  1. Launch Total Commander and choose Configuration -> Options -> Operation -> FS-Plugins

  2. Click "Remove"

  3. Select Erased files

  4. Click OK.


Restore dialog: About
See About program information or enter registration key


Restore dialog: Restoration method
Choose Standard or Alternative method to recover file (Alternative may give better results for files with damage more than 0%. Click Help button to see Technical Information > Alternative Restore)


Restore dialog: File properties
See file properties, which can help you to choose whether to use Standard or Alternative restoration method


Restore dialog: Restore
Restore the file using selected method. You will be prompted to choose the destination path.


Restore dialog: Cancel
Return to program without restoring the file


Plugin properties: About
See About program information or enter registration key


Plugin properties: Default restoration method
Check this to use Alternative as a default restoration method (appies to standard copy and view functions as F5, F3 and drag-n-drop operations)


Plugin properties: Show 100% damaged files
Check this to show in Back2Life plugin completeley damaged files as well (you can restore them, but they will not have original contents)


How to use it

After the plugin is installed, you can access it in "Network Neighborhood" under the name [Erased files].

Open any disk shown there and you will be able to browse for erased files and folders!

The Back2Life plugin lists only erased files.

The plugin lists both existing and erased folders, even if folders don't have erased files. To check whether a folder has any erased files, press the space bar to calculate the size of the folder's content.

To view the properties of a file or a folder select it and press Alt+Enter. For erased files you may see the cluster-use map. To restore a file or a group of files and folders, highlight them and copy to the existing directory in another panel of TC by using F5. To restore a single file you may press Enter to open the Restore dialog and to choose the Standard or the Alternative restoration method. Please note, unregistered version of Back2Life recoveres files that are less than 64K in size.

You can't restore files to the same disk they were erased from. You can't copy or move any file to the erased folder.

To access the plugin properties, press Alt+Enter on [Erased files] title. Here you can set:

•	The restoration method used by default (with copy and drag-drop recovery, and F3 preview)

•	Showing or not files completely overwritten (with damage = 100%)

Plugin commands:

•	F3, F4 - preview and edit erased file. Please note that you cannot preview or edit an erased file located on the same drive with the Windows\Temp directory.

•	F5, drag-n-drop operation - restore selected files (folders) using a default restoration method.

•	Enter - show the Restore dialog for the erased file

•	Alt+Enter - show the file (folder) properties

•	Alt+F7 - search for erased files. Searching for text in erased files is not supported

•	Ctrl-R - refresh erased folder

•	Space bar - calculate the size of the folder (only erased files counted)


Registration

The unregistered version of Back2Life restores files that are less than 64K in size. Each new version comes with a new registration key, but registered users can obtain this key for free (see Program update for details)

Back2Life for TC 2.1 costs $14 US. You may also choose to pay with one of the following currences:

•	 Euro

•	 Australian Dollar

•	 Canadian Dollar

•	 Japanese Yen

•	 Pound Sterling

•	 Swiss Franc

Available payment options:

•	Credit card - Visa, MasterCard/Eurocard, American Express, and Diner's Club

•	Switch/Solo - debit cards from Switch and Solo (UK)

•	Bank/wire transfer - transferring to an account in Germany, France, or the UK

•	Check - bank transfers from US banks and checks drawn on US banks. From customers outside of the USA only guaranteed bank checks such as Money Orders or Cashier's Checks accepted

•	Cash - send cash by mail

Please follow the link to proceed with secure on-line registration. This service uses SSL (Secure Socket Layer) encryption technology to transfer your data securely. The encryption is certified by VeriSign.

If you have questions about orders, payments, delivery, or if you have already ordered software and would like to view data relating to your order, please visit our Customer Care Center.

The Software will be registered with your full name.  As soon as payment is received, you will be e-mailed the registration key that will turn off the limitations of your unregistered copy and give you the full function of Back2Life for TC.