Retrieving deleted records...the data is there

[d94dsj]

Hi,

I have a really tough problem to try to solve. If someone knows how to solve my problem I would be really impressed and really happy.

I have a database (FileMaker v6) in which all records have been accidentally deleted by a script (a bug in the script which occurs under certain circumstances), with the script step delete all records. The record count show 0 records.

Normally this shouldn't have been a problem because a backup is performed of the database every night to a zip file and then this file is copied to a file with the current date in the filename on a different network share.

BUT the backup to another network share has not been working for many months I found out today, so every night the only zip file containing backup files is updated with current data. And the problems of deleted records was discovered yesterday, which means that the backup file now also contains 0 records.

So far, things seem hopeless.

BUT, I've discovered that the version in the backup zip file is actually as large as the normal file with all records in it should be (about 8Mb for about 4000 records). When I open this file in FileMaker, and then exit FileMaker, the file size is reduced to about 500kb.

Now, my guess is that all data is actually in the file when I open it, but that FileMaker has not "committed/flushed" all the deleted records on the last exit of the file. On exit from FileMaker, it probably detects this anomaly and flushes the deleted data.

I have tried confirming this by looking at the raw data in a hex editor, with both the big file (which I extract from the zip file) and the smaller file (after opening/closing). Since the contents are not encrypted, I can see information about the people that are entered in the database (it is full of prospect customers). And there are much more data in the bigger file than in the smaller file.

I have also run some unix file/text utilities on the data, looking for how many lines contain the word "Stockholm" (which many of the records should contain):

On the bigger file:

grep --binary-files=text Stockholm Solution.fp5 |wc -l -L

3391 1864

This means that there is 3391 lines containing the word "Stockholm" in the bigger file and that the longest line is 1864 characters long.

And on the smaller file:

grep --binary-files=text Stockholm Solution.fp5 |wc -l -L

4 438

here, only 4 lines contain "Stockholm" and the longest line is 438 characters long.

So, the data seems to be there.

Now, how could I extract this data into a working copy of my database? The file format of FileMaker is not open, so I do not know how to parse the data. Is there anyone here who knows the internal format of a record in FM 6?

I've tried to do a Recover on the bigger file, but that just reduces the file size to the smaller size and does not leave any data for me

I've also tried importing data to a new file from the bigger file, but this does not find any data either - but it does reduce the file size of the bigger file I select to import from.

But my guess is also that the is some kind of "dirty/deleted data" flag that FileMaker looks at before flushing the data. This could theoretically be one bit that needed to be changed.

I'm stumped at the moment.

Thanks for any input,

Daniel

[DykstrL]

I don't know of anyone that has divulged a way to do what you're asking.

I think there is only two ways for you to go:

1. Export the dump from a Hex editor to a text editor and try to parse out your data.

2. Contact FileMaker. Inc., to see if they have a way of extracting your data (I don't know if they do or not). If they do, it will probably cost you a nominal fee.

Good luck.

[d94dsj]

Thanks for your input - I think I have to contact FileMaker Inc. to see what they have to say about it.

I read somewhere that when you exit FileMaker it frees up unused blocks - which I guess is also deleted records. Now if I only knew how to tag them as "used blocks" maybe FileMaker would show them.

It seems hard to parse the data, it seems scattered across the file. I will perhaps try some reverse engineering.

Daniel