DISKEDIT - A sector editor (Version 1.08) Instruction Manual...By M.H. Smith 1988 Contents: 1. Using the program a. Getting started b. Simple editing c. More advanced features 2. Reference section a. The FILE menu b. The MOVE menu c. The CHECK menu d. The SHOW menu e. The OPTIONS menu f. Keyboard menu selections 3. Atari disk format a. Physical disk format b. Logical disk format c. Root and sub directories d. The file allocation table Section 1: Using the program Subsection a: Getting Started Current limitations and warnings If a single file on the disk is to be edited then it follows that the disk must have a correct file allocation table. There are checks in the program to prevent this but it is recommended that you do not use the Open File menu option on a disk when you know the FAT is incorrect. The program is also restricted to editing standard ST disks with 2 512 byte sectors per cluster. This should not be much of a limitation as I have yet to see a disk that isn't. The program usually assumes that the Bios Parameter block on the disk is correct. Because of the way the program works a totally scrambled BPB could cause trouble if it indicates that there is a ridiculously large number of sectors on the disk. Again I have yet to see this happen but I suppose it will occur eventually. Be careful It goes without saying that you can do tremendous damage by careless use of a sector editor. If you have never used one before read the section on the Atari disk format first. For experimenting purposes set the write protect on a disk and examine it to get used to the program. If you ever lose any data follow this procedure: i) Stay very calm, do not format the disk out of frustration. It is very likely that most of the data is still on it. ii) Use a bit or sector copier to make a backup of the corrupt disk. This may help to identify physically damaged sectors and you can then work on the backup copy in relative safety. iii ) Before making any changes be sure you know what you intend to do, how the disk is organised and how you will be able to recover if you mess up. iv) If at all possible do not write on the defective disk. Pull the sectors containing your data into memory and write them as a file onto another disk (this is covered later). Severely damaged disks If the sectors on the disk are damaged in such a way that the controller can no longer read them then there is obviously very little that can be done. Take the advice of the program, open the window, grab the disk by its edge and throw, hard. If the file allocation table is defective it makes the job of recovery more difficult but not impossible. You must locate the sectors on the disk which contain your data and indicate to the program the order they should be put in to form the file. You can usually spot a defective FAT when you ask to see a file and the drive makes a noise like it is about to break out of the case. If you are sensible about keeping backups then you have less worries, usually. If you do not realise a disk is corrupt and use a sector copier you can back up the corruption (don't laugh I have done it!) Subsection b: Simple Editing: Opening a disk or file Put the disk in question into the drive and click the Open Disk or Open File menu options. When you edit a disk you can move about between and edit all the sectors on that disk (1440 on a double sided disk). If you open a file you must indicate which one by using the file selector. You are then confined to the sectors that make up that file. The info line of the window changes to actually give information. It shows the sector you are at, the highest number sector available and flags which show the state of that sector. These are explained later. The window title changes to indicate the disk being edited or the full path of the file being edited. Sector zero of the disk or file is brought into memory and displayed in the window. Using the editor The square editing cursor can be moved around with the cursor keys or you can point and click the mouse where you want the cursor. The key acts like a left cursor. To change one of the bytes of the sector either type a character in the ascii range (code 32 - 126) if the character display is on or type two hex digits. If you change your mind after one digit has been typed press the key. If the new value you supply differs from the one that was there before then the sector is considered to be changed and an indication of this appears on the info line of the window. To move to a different sector press ALT-G or select the Goto Sector menu option. Assuming the number of the sector that you then supply is in range then that sector will be read from disk for editing. Saving Changes For now ensure that the option Caching To RAM is turned off. When you move off of a sector that has been changed or close the disk without writing changes to a sector then an alert appears asking if you want the changed sector written or not. You can save the sector yourself at any time by pressing ALT-W or selecting the Write Sector option. This does not clear the changed indication as there is still a copy of the original sector in memory and you may recover it with the Undo Changes option or ALT-U if you decide that the changes were not really wanted. Then hit ALT-W again. this only applies until you move off of a sector. More powerful undo is available with the caching option enabled and is explained in the next section. Subsection c: More Advanced Features Storing changes in RAM With the caching option turned on and you move off of a sector that has been changed then it is not written to disk but is stored in memory, along with a copy of the sector as it was unchanged. If you move back to this sector it is not read from the disk again but is obtained from memory. An indication of this is the word appearing on the info line. Asking for undo changes on such a sector causes the display to revert to the sector as it was read from disk, not the last time you edited it. Thus you can be sure that the sector is then really unchanged. When the disk or file is closed then you are asked if you want all the sectors you have changed written back to the disk (if there are any changes). If you confirm this then they are written. A failed write cancels the close option so you may select it again and retry. The amount of free memory determines the number of sectors that you may store. It is up to you to be sensible. You can force an unchanged sector to be cached by pressing ALT-C or selecting the Cache Sector option. The indication of this appears immediately on the info line. What have I done? If you do have caching switched on then you can get a list of the changes you have made by selecting the Show Changes Made option. This lists the byte and sector numbers of each change and what the byte used to be and what you changed it to. Turn on the hardcopy option to get a printed record of the changes. Should you decide you need a list of the changes after closing the disk or file it is still available until the next open which will clear out the cache. File recovery, FAT damage If the disk you are dealing with does not have a damaged FAT then you can use the Show File Trace option to get a list of the sectors the file occupies. Remember space is allocated 2 sectors at a time and these are consecutive logical sectors and note that the show option only gives the first sector in each cluster. If the FAT is damaged you must search the disk yourself to find the numbers of the sectors holding data. Use the Search for match option. A thing to watch for is when you have several deleted copies of a file on a disk. There will be several sectors holding similar data so make sure you get the right one. So open the disk (don't use open file) and find out where the data is. Once you know which sectors you need visit them in the correct order and press ALT-M or click the Mark Sector option on each. The sector is brought into the cache and a double indication and +MARKED+ appears on the info line. Once all the sectors have been marked then close the disk. You will then get a message asking whether you want the marked sectors written. Click Yes and supply a file name to the hideous file selector. If you only have one drive (shame) change disks first. The sectors you marked are then written out to form the file in the order that you marked them. It is highly likely that the file will not have had a length of a multiple of 512 so you can now load the file into Tempus or some inferior editor, chop off the extra garbage and save it again. Sure is easy eh? maybe it will encourage some more backups to be made. Seriously: if the FAT is down what did you expect. Automatic recognition of which sectors happen to be in your file? Section 2: Reference Section This section describes all the available menu options and even tells you what they are supposed to do. Subsection a: FILE menu Open Disk This option opens up a disk for editing. You are asked which drive. Sector zero is then read in and displayed and you may start editing. This option clears out any cached sectors remaining from a previous edit. Open File This option opens a file. You must specify the path of the file by using the file selector and it is then opened. The sectors holding the file are located and the first is read into memory for editing. It is displayed as being sector zero though its actual sector number on the disk will be different. Like the previous option this one clears out cached sectors. Cache Sector This copies the sector being edited into the buffer and indicates the fact on the info line. If there is no more memory an error message results. Has no effect if the sector is already in the cache. Cached sectors may be written back to the disk when the disk or file is closed. Mark Sector This indicates that the sector being edited is the next one in a file to be recovered. It is copied into the cache and a message to that effect is displayed on the info line. This option has no effect if the sector in the buffer has already been marked or you are editing a file, when it does not make sense, The marked sectors may be written out when the disk is closed. Undo Changes If the sector in the buffer has been changed then it is restored to the state it was in when read from disk. A cached sector is not restored to the state before the last edit but back to its original state. This option does not affect the disk. Write Sector This option causes the sector in the edit buffer to be written back to its correct place on disk. It does not affect the indication of whether the disk was changed. A copy of the sector as it was still exists and can be recovered until the sector is left. If caching is on then a copy of the original sector remains in the cache until it is cleared. Close This option causes the disk or file to be closed. If you have changed the sector in the buffer you will get the option to write to disk. Similarly if you have sectors in the cache which are changed or have marked some sectors you will be asked whether you want these written out as well. The close option does not destroy data in the cache so the list of changed sectors is still available until the next open disk or file. The same effect as the close menu option can be obtained by clicking the window close box. Clicking this box without a disk or file open causes the window to be cleared. Quit Can not be selected unless close has been used. This takes you out of the program. Subsection b: The MOVE Menu Goto Sector After asking for a sector number then that sector will be fetched in for editing. You cannot exceed the maximum sector as displayed at the top of the screen. If a file is open then the sector read in will be the one at the specified position in the file, sector 1 of the file is never logical sector 1 on the disk. Goto Offset This option is only available when you are editing a file. You must type in a hex offset in bytes from the beginning of the file (2,4 or 6 digits) and the sector and byte position of this offset is calculated and you are moved there. This is useful when you want to patch a file you have examined with a monitor. Remember that executable files have a header which is removed on loading. Search For Match If the display selected is character mode then you are asked to supply a character string to be searched for. Otherwise you must type a hex string, e.g. 0407 to search for 2 bytes. Once this has been done the search of the disk or file starts at the editing cursor position and continues until the pattern is found or the end of the disk or file is reached. You can stop the search at any time by holding do the right mouse button. If the search was successful then the edit cursor is moved to where the match was found. If you stopped the search or the pattern was not found then the cursor is left where it was before the search. Next Match This option, available after a successful search, causes the next match to be sought. It always continues the search from the byte after the one where the last match occurred. i.e. you may move the cursor to examine any sectors you like between uses of this option. Subsection c: The CHECK Menu Check FAT The file allocation table on the specified drive is read in and checked for consistency. Problems detected include chains of clusters running through bad disk clusters, cycles of clusters and a chain hitting a cluster marked as free. A problem not detected is two files pointing to the same chain of clusters as this would mean reading all the sub-directories on the disk. This is a rare situation though and should be quite easy to spot. Check Boot Sector This option reads in the boot sector of the specified drive and checksums it to see if it will be executed when the disk is booted from. This occurs if the word checksum of the disk is 1234 hex. A message is printed giving the result. Most disks should not have executable boot sectors. Some protected software does for example. You should be suspicious of disks such as P.D. software that have executable boot sectors as it is one of the means that stupid people could use to try and do your data in. You could also try looking for hidden files in the AUTO folder if you are really paranoid. Subsection d: The SHOW Menu The options in this menu have several things in common. They all treat the screen as a scrolling text window and display their information in it. If the hardcopy option is on then anything printed in the window appears on the printer as well. If you are editing a disk or file and you use one of these options then the sector display is restored from an internal buffer when the output has finished. You can pause the output by holding down the right mouse button or by pressing one or more of , or . Output resumes when you release the key or button. Show Disk Info This option displays the data in the Bios Parameter Block of a disk. This includes things like the size and position of the root directory and FAT and how many free clusters there are left. If the claimed number of free clusters exceeds the count of the number of clusters on the disk then a warning message is printed. Show Directories After selecting this option you can use the file selector to pick the directory you are interested in. After selecting one it is searched for files and their name, size, creation date and attributes are displayed. Show Sector This causes the sector being edited to be displayed in character and hex form. It is included so a copy of the sector can be printed out. Show FAT This option reads in a file allocation table and prints it out in a relatively easy to read form. The cluster number is given at the left hand side of the output then 8 clusters follow on the line. For each is printed the contents of that entry and a 3 letter code indicating its significance. The display often includes a lot of empty entries as it does not believe the count of the number of clusters on disk but always prints to the end of the FAT even though most of these entries do not exist. The meaning of the codes is as follows: BAD The cluster was marked bad at format time RES The cluster is reserved (cluster 1) EOF The cluster is the last one in a particular file USE The cluster is allocated. ??? The entry points to a reserved cluster. nothing The cluster is a free one Reserved clusters should never be allocated so the presence of a '???' entry indicates problems. If the symbol is 'USE' then the number in that entry is the number of the next sequential cluster in the file. Follow that chain to the next one and then see what to do next! Show File Trace This option asks for a filename. As with Open File this option interprets a null filename as a request to operate on the directory given in the path, this allows you to find where a sub- directory occurs on disk. The trace produced lists each cluster of the file in order, the logical sector number on disk of the first sector in the cluster is printed in brackets following the cluster number. Show Changes Made This option scans the sectors held in the cache. For any of them that have been changed a record of the changes is printed. This gives the byte and sector number of the change and what the byte was changed from and to. A printed copy of this can be very useful if you find you have done something very silly. It does happen you know. Subsection e: The OPTIONS Menu Character Display This changes mode of display of the program between hexadecimal and character mode. It affects the sector display, the entry of data and the form in which you are asked to specify a search string. Caching To RAM This option turns the caching of sectors on and off. With this option on changed sectors are not written straight back to disk but are stored in memory. You may make as many changes to as many sectors that will fit in memory as you like. When you close the disk you can then have all the changed sectors written at once. Hardcopy Of Show When this option is turned on then all output from the options in the SHOW menu is sent to the printer as well as to the screen. Should you select a SHOW option with hardcopy enabled and the printer is not present or not on line then an error message is produced. Subsection f: Keyboard Menu Selections Certain menu options can also be accessed from the keyboard. These will only be accepted in cases where the menu option would be allowed. The keys to press are as follows: ALT-U Undo Changes ALT-W Write Sector ALT-C Cache Sector ALT-M Mark Sector ALT-G Goto Sector ALT-O Goto Offset ALT-F Search For Match ALT-N Next Match Section 3: Atari Disk Format Subsection a: Physical Format Tracks And Sectors An Atari disk is either single or double sided, rumours of a triple sided disk under development are completely untrue! Each side of the disk is formatted into concentric rings, called tracks, on standard disks there are 80 tracks, protected disks sometimes use more. Each track is divided into sectors, the standard format has 9 sectors, each holding 512 bytes per track. So on a double sided disk this results in 2x80x9x512 bytes of storage space = 737280. This is known as the formatted capacity, when you bought the drive they will have quoted the unformatted capacity of 1Mb as it is bigger. The Boot Sector You do not get all the above space to yourself however. To start with sector 0 track 0 of the first side is known as the boot sector. It sometimes contains boot code and always contains the Bios Parameter Block. This is a description of the disk indicating the areas reserved by the operating system and the area you may store data in. The block occupies 9 words in the boot sector and contains the following information: Name Use recsiz Size of sectors in bytes clsiz Size of a cluster in sectors clsizb Cluster size in bytes rdlen Length of root directory fsiz Size of FAT in sectors fatrec No of 1st sector of 2nd FAT copy datrec No of 1st sector for users data numcl No of data clusters on disk flags Indicates FAT format clsizb has always seemed a little superfluous. I assume it is because the format was borrowed from the bad old 8086 which finds 2x512 a little arduous. rdlen is the size of the root directory in sectors. This is described more fully later. There are two consecutive copies of the FAT held on disk. I am not sure why as it has never seemed to prevent the OS screwing the disk up. If bit zero of flags is set it indicates that the FAT has 16 bit entries. This occurs on a hard disk. The program will at present refuse to edit disks with a 16 bit FAT. Floppy disks have 12 bit entries. If the boot sector word checksums to 1234 hex then the code it contains is executed when the disk is booted from. This code can then do absolutely anything you like. Early model ST computers had their operating systems loaded from disk in such a manner. Subsection b: Logical Format Logical Sectors and Mappings In practice the physical format of the disk can be abstracted away. Rather than referring to the side,track and sector of a disk you can refer to a logical sector. This is a number from 0 to the number of sectors on the disk-1. It is so arranged that logical sector 0 corresponds to the boot sector. The device driver is responsible for translating the logical sector numbers into the physical disk sector you are referring to. Any kind of weird mapping scheme could be used transparently to the user. The sector numbers in the BPB refer to logical sectors. So if the value of 'datrec' is 18 then it means that logical sector 18 holds the first data block. It may or may not be side 0,track 2 sector 1. Clusters Sectors are not allocated to files one at a time but in clusters. A cluster is a group of sectors. On the ST the cluster size is 2 so each cluster holds 1K of data. If the value of 'datrec' is 18 the first cluster occupies logical sectors 18 and 19. The file allocation table, described later, indicates which clusters belong to which files and which are free for use. Subsection c: Root and Sub Directories Where Is the Root Directory? The root directory can be found from the information in the BPB by calculating fatrec+fsiz. This area is fixed at format time thus implying that is a limit to the number of files that can be created in the root directory. If 7 sectors are allocated to it and each entry is 32 bytes long then the number of files you can have in the root directory is 512x7/32 = 112. Where are Sub Directories Sub directories are treated in much the same way as files. Instead of holding data they hold directory entries. They can grow dynamically as can files and so the limit for the number of files in a subdirectory depends on the size of the disk. To find a file several levels down you start at the root and look for the subdirectory, say AUTO. When this is found you have the start cluster of the AUTO subdirectory and can search this for the next one. A chain of clusters exists for AUTO in the same way as an ordinary file and can be followed to find all the entries in it. Sub-directories have two extra entries '.' and '..' which refer to the current directory and its parent directory respectively. The Format Of a Directory Entry Both root and sub directories have the same format. They are a list of entries each of which is 32 bytes long. Values in the various fields are held in backwards 8086 format. To see one open up a disk and goto sector 11. The format of a directory entry is: Size and Type Usage 8 characters File name 3 characters File extension 1 byte File attributes 10 bytes Unused word Creation time word Creation date word No of first cluster long, Length of file in bytes If a file is deleted the first byte of the entry is set to E5 hex (you remember CP\M too eh?) The start cluster number can be converted to a sector number given the BPB and the additional knowledge that clusters 0 and 1 do not exist on the disk. You calculate ((cluster no-2 for reserved clusters) x clsiz) + datrec The file attribute byte has bits set depending on what attributes the file has. The layout is as follows: Bit No Usage 0 If set file is read only 1 If set file is hidden from dir search 2 If set file is a system file 3 If set file is 11 byte volume label 4 If set file is a subdirectory 5 Archive bit 6 Unused 7 Unused The archive bit is supposed to indicate whether a file has been altered since the last backup but does not seem to work on floppy disks. I imagine it does on hard disks or the storm of protest would have been pretty big. Subsection d: The File Allocation Table Where Is it? There are two copies of this on the disk. The second copy can be found by looking at the value of datrec in the BPB. The first copy is at datrec-fsiz. The FAT normally occupies 5 sectors. For each cluster on the disk the FAT records its state. Whether it is allocated to a file, free, bad etc. Format Of Entries The entry for each cluster occupies 12 bits. So each group of 3 bytes in the FAT holds the data for 2 clusters. Extracting the correct 12 bits for each entry (you can deduce how to do this by looking at the output of Show FAT, remember : Show FAT compensates for the 8086!) gives a number between 000 and FFF hex. If the number is 000 then that cluster is free for use. If the number is 001 then there is a problem. Cluster 1 is a reserved cluster and does not actually appear on the disk. The FAT entries for 0 and 1 are supposed to contain information about the disk. If the number is 002 to FEF then it means that this number is the cluster number of the next cluster in the file. If the number is FF0 to FF7 then it means that one or both of the sectors in that cluster were found bad at format time and the cluster cannot therefore be used. If the number is FF8 to FFF it means that this cluster holds the last one for a file. So by finding the start cluster of a file you can follow the chain of clusters in that file until you reach the last one. This might go something like: 003 004 005 006 FFF. If the FAT ever gets damaged then you are in trouble!