How MS-DOS 6.22 Recovers Deleted Directories

This article explains the underlying system mechanisms that allow MS-DOS 6.22 to recover deleted directories. In MS-DOS, directory recovery relies on how the FAT (File Allocation Table) file system handles metadata deletion, combined with the capabilities of the native UNDELETE utility. By examining FAT directory entry flags, cluster allocation tables, and optional memory-resident tracking safeguards like Delete Sentry and Delete Tracker, this guide details how the operating system locates, reconstructs, and restores deleted directory structures.

The FAT Directory Architecture and Deletion Behavior

In MS-DOS 6.22 (using FAT12 or FAT16), a directory is treated as a special file containing a list of 32-byte records. Each record holds critical file system metadata: the name, extension, file attributes (such as the directory attribute bit 0x10), creation time, file size, and the starting cluster number.

When a user deletes a directory via standard DOS routines, the operating system does not physically erase the data on the disk. Instead, it performs two specific actions:

  1. Marks the Directory Entry as Deleted: The system overwrites the first byte of the directory's 32-byte record in its parent directory table with the hex value 0xE5 (represented as the Greek character sigma σ in ASCII). This flag signals to DOS that the entry is inactive and available to be overwritten by new files or subdirectories.
  2. Frees Allocated Clusters in the FAT: The entries in the File Allocation Table corresponding to the directory's data chain are marked as 0x0000 (unused).

Because the directory's internal data (the child directory entries, including the . and .. pointers) remains intact on the storage media until new data overwrites those sectors, recovery remains possible.

The UNDELETE Utility and Standard Recovery

MS-DOS 6.22 ships with an enhanced version of UNDELETE.EXE (licensed from Central Point Software). Under the default "Standard" recovery method, the utility inspects the raw sectors of the parent directory looking for entries that begin with 0xE5 and have the directory attribute flag enabled.

When a candidate is identified:

  • The user is prompted to supply the missing first character of the directory name (replacing 0xE5).
  • The system reads the starting cluster stored within the 32-byte record.
  • The utility inspects the target cluster to confirm the presence of standard directory header structures—specifically the . (current directory) and .. (parent directory) records.
  • If confirmed, MS-DOS reconstructs the cluster chain by assuming the directory occupies contiguous clusters, updating the FAT accordingly.

Standard recovery often struggles if the directory was fragmented or if child files within that directory had their individual FAT entries cleared. To provide deterministic directory recovery, MS-DOS 6.22 introduced memory-resident mechanisms.

Delete Tracker (PCTRACKR.DEL)

Delete Tracker is a Terminate-and-Stay-Resident (TSR) program loaded via UNDELETE /T[drive]. It monitors disk activity by intercepting DOS interrupts (INT 21h) responsible for file and directory deletion.

When a directory or file deletion call is intercepted:

  • Delete Tracker records the complete name, attribute flags, and exact sequence of allocated cluster numbers into a hidden file called PCTRACKR.DEL located in the root of the drive.
  • Even though DOS zeroes out the FAT entries and applies 0xE5 to the directory record, PCTRACKR.DEL retains the exact mapping of fragmented or non-contiguous clusters.
  • During recovery (UNDELETE /TRACKER), the utility references this log file to accurately rebuild the directory's original cluster chain without guessing.

Delete Sentry (SENTRY Directory)

Delete Sentry provides the highest recovery reliability in MS-DOS 6.22 and is invoked using UNDELETE /S[drive].

Unlike standard deletion or Delete Tracker, Delete Sentry fundamentally alters how DOS processes the deletion:

  1. It creates a hidden, system-level directory named SENTRY in the root of the drive.
  2. When a command to remove a directory or file is issued, Delete Sentry intercepts the interrupt and moves the directory contents and metadata into the hidden SENTRY structure instead of releasing the clusters to the FAT.
  3. It creates a log file within \SENTRY\CONTROL.FIL to map the original pathnames and restoration data.
  4. If disk space runs low, Sentry automatically purges the oldest files permanently to free genuine disk space.

When recovering through Delete Sentry (UNDELETE /SENTRY), MS-DOS simply reads CONTROL.FIL and moves the preserved directory structure and its contents back to its original path, bypassing the need to reconstruct cleared FAT chains or replace missing first characters.