Recovering a ZAP'd File:

The ZAP command removes all the records from a DBF file by performing four distinct actions in a DOS environment:

1. Sets the record count in the file header to zero (4 bytes changed).
2. Writes an end-of-file marker (1A hex) into the first character position of the first record (1 byte changed).
3. Deallocates all clusters in the File Allocation Chain beyond the cluster that contains the file header.
4. Adjusts the file size in the disk directory to reflect only the amount of space occupied by the header.

The ZAP command thus changes only five bytes in the file no matter how large the file may be. The remaining changes are made in the File Allocation Table and disk directory. Since all the file data lies in unallocated clusters on the disk following a ZAP, the data is very vulnerable to being overwritten since DOS regards unallocated clusters as available for writing new files.

It is extremely important to recover a ZAP'd file without re-writing the file's data. An unZAP utility that re-writes the data can write it right over the data that you are trying to recover thereby making recovery forever impossible.

dSALVAGE is unique in that it recovers a ZAP'd file without re-writing the data. It does this by reversing the actions of the ZAP command using sophisticated pattern-matching techniques.

In most cases, the Automatic Unzap feature in dSALVAGE will completely recover a ZAP'd file. If, however, data was written to the disk after the ZAP operation was performed (perhaps by copying a file to disk or even just starting an application that creates temporary files), some part of the ZAP'd file's data may have been overwritten. In such case, the Manual Assist Unzap in dSALVAGE will allow you to recover all data that has not been overwritten.

Return to the dSalvage main page