Extract records flagged as deleted

APPX recovery normally leaves deleted records out of its active-record output. An optional third output pathname requests a separate file containing the deleted records that the utility can extract. It does not automatically add those records back to the application.

The following example is for an encrypted APPX 6.2.1 file with a compatible 6.2.1 engine and the correct encryption configuration. The paths are examples; substitute your own restricted working directory and engine path. Preserve the source and use two new output names.

/opt/appx/appx -recover /srv/appx-recovery/PROSPECT.dat /srv/appx-recovery/PROSPECT-active.dat /srv/appx-recovery/PROSPECT-deleted.dat

For Windows PowerShell:

& 'C:\APPX\appx.exe' -recover 'C:\APPX-Recovery\PROSPECT.dat' 'C:\APPX-Recovery\PROSPECT-active.dat' 'C:\APPX-Recovery\PROSPECT-deleted.dat'

In the APPX 6.2.1 test with a fixed-length, indexed PROSPECT file, the separate deleted-record output matched every byte of the deleted record's original decrypted contents. All nine surviving active records also retained their complete contents.

For the fixed-length file tested in 6.2.1, the deleted output is unencrypted native consecutive record data. It is not CSV, and some fields retain binary storage. Do not open it as a text export or substitute it for the indexed PROSPECT file. Reading it through APPX requires a separate consecutive-file definition with matching fields, storage types, and record length. Have an APPX designer prepare that definition and a controlled procedure to check the extracted values and deliberately add any wanted record back. Check for duplicate identifiers and related records before reinstating it. The extraction was verified byte for byte; this additional application restoration procedure was not part of the test.

Deleted-record extraction depends on the old contents still being present and undamaged. In the 6.2.1 test, a new APPX record reused the deleted record's storage slot. Recovery then reported zero deleted records and produced an empty deleted output. It could no longer extract the old record from that file. Stop writes and preserve a copy immediately when a deleted record is needed; use an earlier backup if its storage has been reused.

Variable-length deleted-record extraction was not tested. These results do not establish recovery of overwritten data or every form of file damage. Keep the unencrypted deleted output under the same controls as a confidential CSV export.