Purpose of the MS-DOS 6.22 UNDELETE Utility

The MS-DOS 6.22 UNDELETE utility is a built-in recovery tool designed to restore files that have been accidentally removed from disks using the standard DEL or ERASE commands. This article explores the primary function of the UNDELETE command, how it interacts with the FAT file system, the three distinct levels of deletion protection it provides, and the practical syntax used to recover lost files in MS-DOS.

How File Deletion Works in MS-DOS

To understand the purpose of UNDELETE, it is essential to understand how MS-DOS handles file deletion on FAT12 and FAT16 file systems. When a user runs the DEL command, MS-DOS does not physically erase the data residing on the storage media. Instead, it performs two specific actions:

  1. It marks the first character of the file's name in the directory table with a special hex byte (E5h), indicating that the entry is now considered deleted.
  2. It marks the clusters allocated to that file in the File Allocation Table (FAT) as empty and available for new data.

The actual contents of the file remain intact on the disk until another operation writes new data over those newly freed clusters.

The Primary Purpose of UNDELETE

The primary purpose of the UNDELETE utility is to reverse this process. It inspects the directory structure for entries marked with the E5h deletion flag, reconstructs the chain of disk clusters associated with the file, prompts the user to supply the missing first letter of the file name, and restores the directory entry and FAT pointers.

The Three Protection Levels

MS-DOS 6.22 included advanced iterations of the UNDELETE utility (originally licensed from Central Point Software) that offered three distinct levels of protection to maximize the chances of successful recovery:

  • Standard (DOS) Protection: This is the default method used when no background tracking TSR (Terminate and Stay Resident) program is active. UNDELETE relies purely on the disk directory table. It can successfully recover files only if the clusters remain completely unfragmented and untouched by subsequent write operations. Users must supply the first letter of the file name manually.
  • Delete Tracker: Activated using the UNDELETE /T[drive] switch, this mode loads a memory-resident program that creates a hidden file named PCTRACKR.DEL. Whenever a file is deleted, the tracker records the file name and its exact cluster chain. This permits full file recovery even if the FAT chain is fragmented, provided the data has not been overwritten.
  • Delete Sentry: Activated using the UNDELETE /S[drive] switch, Delete Sentry offers the highest level of protection. Rather than simply tracking cluster records, it intercepts file deletions and physically moves the deleted files to a hidden directory named SENTRY. If disk space runs low, Sentry automatically purges the oldest deleted files to free up space. This guarantees 100% recovery as long as the file has not been purged.

Common Syntax and Switches

The utility is executed directly from the MS-DOS command prompt using the following syntax:

UNDELETE [drive:][path][filename] [switches]

Commonly used switches include:

  • /LIST – Displays a list of deleted files eligible for recovery without actually undeleting them.
  • /ALL – Automatically recovers all deleted files without prompting for confirmation. It attempts to restore the original first character or automatically assigns a pound symbol (#) if standard protection is used.
  • /DOS – Forces the utility to use the standard DOS directory table rather than Delete Tracker or Delete Sentry logs.
  • /STATUS – Shows the current protection method running on each drive.
  • /PURGE – Manually empties the Delete Sentry directory to reclaim storage space.

Operational Limitations

While UNDELETE is an effective safeguard, its success is time-sensitive. Because MS-DOS treats the space occupied by deleted files as free, any subsequent file creation, installation, or disk writing can permanently overwrite those clusters. Once data has been overwritten by new information, the UNDELETE utility can no longer reconstruct the original file.