Data Recovery

This is something I've been wondering about for a while...anyone know how to recover files you've deleted (by hand, not using a 3rd-party tool). I know that when you delete a file or format a disk, it's not 0d by windows, so the data should theoretically all still be intact. My guess would be that you'd have to get down and look at the disk on the sector level, but how would you go about..."linking" (don't know the proper terminology) the file back up?

(I havn't messed with this since FAT16, so I'm sure it's changed some, but...)
Generally a deleted file can only be completely recovered if it is contiguous, though it may also be possible if you can read the format and figure out what belongs and what doesn't and in what order without help.

In FAT16, you would start by finding the directory table where the file was contained. Hopefully, you'll find the file you're looking for, with the first character replaced with the deleted file character. The directory entry contains the starting location of the file and the size. If it's contiguous, just go to that allocation unit and copy out the file. An allocation unit is not a sector (at least not for large discs); a sector is a fixed portion of the platter, whereas the size of an allocation unit changes depending on the size determined when formatting (using the standard format tools, this is based on the overall size of the disc). If the file is not contiguous, you may still be able to piece it together by looking at the open allocation units in the FAT, starting at the one indicated by the directory entry. There are two copies of the FAT, which except in the event of a power failure or a sudden crash or reboot should be exactly the same. The FAT is a series of pointers that indicate where a file is on the disc. Each location corresponds to an allocation unit and either points to the next allocation unit after that one for the file, has a bad allocation unit flag, has an end-of-file flag, or has an unused flag. Since we're restoring an erased file, we're hoping that all its allocation units are unused. From the starting allocation unit, you'd find the unused allocation units and examine them to determine if they are part of your file. If you're lucky, they'll be in the right order; otherwise, you have a real pain putting it back together. That's pretty much that. Norton Utillities has always had tools for manipulating these file system components at a human-readable level in the past, and I'd expect the same now.