PC-Online 1999 November

home *** CD-ROM | disk | FTP | other *** search

/ PC-Online 1999 November / PCOnline_11_1999.iso / filesbbs / OS2 / DFSEE305.ZIP / DFS.DOC < prev next >

Wrap

Text File | 1999-08-30 | 134KB | 2,843 lines

Display File Systems; version 3.05 30-08-99-99 (c) 1994-1999; Jan van Wijk ═════════════════════════[ www.fsys.demon.nl ]══════════════════════════════ CONTENTS (pagenumbers based on 80 line pages) --------------------------------------------- Introduction, purpose of the program 1 Status of the program and change history 2 Terminology used 3 Summary of commands 5 Command reference, general DFS commands 7 Command reference, FDISK specific commands 24 Command reference, FAT specific commands 31 Command reference, NTFS specific commands 33 Command reference, HPFS specific commands 35 Diagram of an example HPFS structure 42 Examples of DFS usage 43 Known limitations 47 Considered improvements 48 HINT: When using DFSee to create a logfile, DO NOT USE ">" REDIRECTION, use the DFSee "log filename" command instead. This will prevent littering the logfile with ANSI control-codes (See DFSQUICK.BAT for an example) When browsing an LVM (Warp server for e-bussines) system, set the screen-width to over 100 characters when possible. This will allow complete display of the volume + partition-names in the 'part' table Introduction, purpose of the program ------------------------------------ The DFSee program is a disk and filesystem browser with an emphasis on the HPFS and FAT filesystems, disk partitioning and some NTFS. It will support different file-systems sometime in the future. The program has been built while studying the HPFS filesystem. It's main purpose is getting to understand the file-system as it resides on the disk itself, in the data-structures laid down in disk-sectors. Over time, additional logic was implemented to allow analysis of all sorts of disk problems on HPFS volumes. The tool has been used a few times over the past years to analyse some real-life disk problems in a large systems-integration project. Also it has proven very usefull in teaching others the internals of HPFS Most of my knowledge of the HPFS file-system is based on the excellent lectures "HPFS Internals" at the 1994, 95 and 96 ColoradOS/2 conferences by Doug Azzarito and on peeking arround on a lot of HPFS volumes using DFS. Further improvements will probably be in more advanced recovery commands and other filesystems like NTFS and EXT2 and in porting to other platforms. The standard distribution, DFSEExxx.ZIP contains executables for OS/2 Warp (32-bit), 16-bit DOS and Windows-NT. Availability ------------ 1) My Homepage: http://www.fsys.demon.nl always the most recent DFSee! 2) USA mirror: http://www.infobear.com search for "DFSEE" 3) HOBBES (WWW): http://hobbes.nmsu.edu search for "DFSEE" 4) Several other WEB and FTP sites, bulletin boards (often outdated!) Status of the program --------------------- This version of the program is free for anyone to use, it was written in my own time using my own equipment. However, I do appreciate feedback. Further development depends on my own needs and feedback I receive from other users, al work has to be done on spare time... Suggestions and other comments regarding DFSee and filesystems are welcome. If you have a disk-related problem, feel free to contact me, I cannot guarantee prompt or continuous attention bu I will do the best I can ... You can reach me through the Internet: dfsee@fsys.demon.nl Change History -------------- 1.00 27-11-94 DHPFS initial version, hex dump super+spare blocks 1.39 20-07-95 32-bit port; Sector Lookup table; bug-fixes 1.52 13-09-95 new '/' cmd shortcut; First released version! <== BBS 1.62 13-10-95 RUN cmd runs REXX; Added Free-space and inconsistency report 1.64 16-10-95 Cleanup for delivery on ColoradOS/2 CDROM 1.70 20-12-96 Update ColoradOS/2, DASD limits; REQUESTABLE (OS2FISYS forum) 1.87 19-01-97 Fixed MBR/EBR walk; multiple cmds using #, BM-labels in part 1.91 21-01-97 New fixroot, fixcp and saveto commands for recovery actions 2.00 03-02-97 Removable media (NEWDASD); (part) D: cmd; invisible primary 2.06 16-03-97 Updated ACL support on HPFS386; Scan badsectors 2.12 06-04-97 Added logical volume support using "DASD" type access 2.20 19-05-97 Win NT beta version; Search speedup; prio command; cleanup 2.24 10-06-97 Added Img and Sim commands; date/time on dirblocks; 2.25 15-06-97 Added Wrim command; Improved lock implementation (nested) 2.28 21-06-97 Added autobase command for HPFS (find HPFS partition start) 2.30 06-07-97 Improved 'find' syntax and functionality; Undelete support 2.32 20-07-97 Reporting & ALBLK fixes to saveto; new "ca" cmd CheckAlloc 2.35 18-08-97 Path info in Fnode display and "list" output; MEM cmd 2.37 24-08-97 Path display on find Fnode; Wildcard select on list +f 2.40 06-09-97 import/export of LSN lists; getbs/fixbs badsector mgmt 2.41 12-10-97 Multiple file UNDELETE with delfind/delshow/delsave cmds 2.42 18-10-97 Support for EA's in "saveto" and delsave cmds 2.43 28-10-97 Support for undelete of directories including EA's 2.47 11-11-97 Updated SLT error display; new check cmd (chkdsk); +/- cmd 2.50 24-11-97 HPFS checksum management; cs, edit and write cmd 2.52 07-12-97 check spare/super; BPB display; Specific FAT & NTFS commands 2.54 28-12-97 More FAT commands; generic More ...; fix DELFIND bug 2.55 25-01-98 DOS version; diskgeo cmd; More write capabilities; bugfixes 2.57 15-02-98 Name DFSee; VFAT Details; FAT Os2Ea display; "find" cleanup 2.58 22-02-98 Fixed More... bugs; Fixed FAT EA & label bug; show EA details 2.60 08-03-98 Single snlist; recover/saveto; dirfind, wipe; color in DFSNT 2.61 29-03-98 saveto xxx.DIR orphan naming; DispHex update; displ NTFS-MFT 2.63 19-04-98 Fixed DFSDOS WRIM and IM commands (file I/O); Fix "FS xxxx" 2.64 04-05-98 Small bug-fixes + support for named-pipe to LPT on sim/wrim 2.65 10-05-98 Fixed 'f* * xxx' bug + new % speed-up option; FAT32 support 2.67 04-06-98 Added optional LZW-compression on SIM and WRIM commands 2.70 28-07-98 Fixed date-time display for HPFS (bug was OS/2 only) 2.72 30-07-98 New $ option to 'part' for size-info table 2.75 21-10-98 No default SLT generation on "part", "vol", "im" and "fs" 2.77 17-11-98 Added NTFS runlist display; Fixed trap on HPFS autobase cmd 2.78 22-11-98 Added HPFS bootsector creation; fixed WIPE trap, DFSDOS WRIM 2.79 29-11-98 NTFS fixups & directory display; FAT dir bug; FreeSpace bug Fixed some DFSDOS geo-bugs, added geometry to part display 2.80 13-12-98 DOS Cyl count fix; TZDFSEE dates; NTFS RunList; list +d / +c 2.81 16-12-98 Allow "diskgeo" for images & non-alpha chars in *.img name fixed display of 1-sector HPFS bootsector .IMG file 2.82 01-01-99 Set exit RC; bootrec Cyl size; HPFS auto CPinfo; INT13 ext. Physical Geo in DFSDOS In13ext; show limits with 'base' NTFS fixboot cmd; part-table display fix; BeOS-FS recognition 2.83 12-01-99 Extended type 0f as extended; NTFS display MftSize & DirSize Part * and part $* display; fixed bootsector display trap 2.84 24-01-99 Calculated CHS warnings/info; FreeSpace info; list +g fixext cmd fixes 0f-type extended partitions back to 0x05 setptype cmd changes type of any partition to any value 2.85 25-01-99 NT admin warning; Small FAT bugfix; TrackZero freespace 2.86 07-02-99 Fixed WRIM doc; MAP command; TRANS command; small fixes 2.87 14-02-99 minor MAP display updates; No auto-read diskinfo 2.88 15-02-99 Final touch on MAP display; DFSBW/DFSQUICK.bat more generic 2.89 16-02-99 Fix Fnode-display for huge 0-size file; DFSDOS ANSI detect 2.90 25-03-99 FDISK delete; newmbr; settype; setaccess; startable; create plist; dos2os; cleanup; setboot 2.91 28-03-99 New NTFS MIR cmd; .NNN, BM-name and cleanup fixes; TYPE cmd 2.92 31-03-99 Added some more system-types (TYPE); minor fixes DOS2OS 2.93 07-04-99 Reboot internal for DOS/OS2, DFSNTX.EXE for NT; geo at start 2.94 20-04-99 LVM and minor JFS display updates; plist LVM + plist WALK 2.96 11-05-99 Minor fixes in LVM display, find and delfind commands 2.99 28-06-99 More minor fixes; introduction of text-based windowing 3.00ß 07-07-99 Small but significant fixes for text-based windowing 3.00Σ 09-07-99 New 'bsfind' command to find bootsectors quickly 3.00 10-07-99 win/nowin commands and LOGO text; dirfind cmd fixed 3.01 25-07-99 Windowing enhancements; DFSDOS fixes; More LVM support 3.03 04-08-99 DFSDOS Ext-Int13 fix; ANSI colors cleanup; display sizes 3.04 15-08-99 Aurora GEO; display speedup; UNDELETE speedup + enhancements NTFS improved MFT display and translation functions 3.05 30-08-99 NTFS MFT allocation update; find deleted MFT records Terminology used ---------------- Sector 512 bytes of data (although other sizes exist!) This is the smallest amount of data manipulated by the disk subsystems and is also the basic allocation-unit for the HPFS file-system CHS Cylinder Head Sector (addressing) This is the classical way of addressing physical sectors on a disk. It is used in the PC's BIOS, in partition tables and in low-level disk-IO API's (IOCTL, INT-13). In most implementations the addressing ranges are limitted causing all sorts of problems with large disks/partitions. INT-13 DOS Interrupt-13, the classical way to interface to physical disks in DOS. Limitted by design to 1024 cylinders. (DFSDOS) Maximum disksize, when using BIOS disk-translation like LBA is just below 8Gb (1024 cylinders, 255 heads, 64 sectors) Ext-Int-13 Extended INT-13, a new BIOS interface that breaks the 1024 cylinder limit. Implemented on recent (EIDE/ATA) BIOS'es (DFSDOS) and some operating system drivers (like Win9x Dosbox) Due to several problems with different implementations, DFSee will recognize the existence, but only use Ext-Int-13 on disks really larger than the limit (1024 cylinders) PSN Physical Sector Number This is the zero-based, unsigned-LONG, number for a sector on a physical disk. Addressing on a disk using PSN's is often refered to as Relative Block Addressing (RBA) or Logical Block Addressing (LBA) LSN Logical Sector Number This is the zero-based, unsigned-LONG, number for a sector on a logical partition. The partition can be seen as a linear sequence of sectors. Note: when accessing a whole disk, the LSN equals the PSN SLT Sector/Cluster Lookup Table An array of information about sectors or groups of sectors, containing the type of the sector(s) and the LSN of a directly related sector (usualy an Fnode). It is currently implemented for HPFS only. Cluster A (small) group of adjecent sectors that are handled by the operating system as one allocation-unit. It is used on FAT filesystems to allow large partitions at the cost of more wasted "slack" space, and on NTFS to balance performance, slack-space etc. HPFS does not use sector-clustering (or a cluster-size of 1!) DFS will try to account for clustering where needed, for example in size calculations and where sector/cluster pointers are used in the file-system internal structures. Partition An area on a physical disk that holds a single logical file-system like FAT, HPFS, Boot-manager, NTFS etc. There is an index to find partitions in the form of a set of partition-tables in the MBR/EBR chain. MBR Master Boot Record The first sector on the physical disk, located at PSN 0 = Cylinder 0, Head 0, Sector 1 It contains the initial boot code called from the BIOS and the main partition table that holds the primary partitions and the start of the chain of extended boot records (EBR). EBR Extended Boot Record It contains no boot code but only a partition table that holds the location of a single logical partitions. It usualy is located on the cylinder just before the actual logical partition itself, at Head 0, Sector 1. Each EBR will also point to the next EBR if more logical partitions exist on the same disk. Volume A logical volume as seen by the active operating system, with a logical drive-letter associated to it. It can be either a hard-disk partition with a filesystem recognized and mounted by the operating system, or some other storage-medium like floppy disk or CD-Rom. Note: Network drives or other "virtual" file-systems can also be refered to as volumes. However, DFSee will not be able to access them because such devices usualy cannot be accessed using "open volume" (DASD) methods. LVM Logical Volume Manager, an 'FDISK' like program plus related operating system drivers on OS/2 Warp Server for e-bussines. LVM allows more flexible naming and usage of partitions and drive-letters, including joining multiple partitions on more than one disk into a single volume. DFSee respects the drive-letters as assigned with LVM and has special display options like the 'PLIST LVM' command in FDISK mode. Also the 'part' display will show volume- and partition names as well. (TIP: use a display-size wider than 80 columns) Shortname The leading part of a filename, as contained in an HPFS fnode and usefull for undelete. The maximum length is 15 characters LsnInfo A value combining an LSN and a (small) informational value in a single 32-bit number. It can be kept in the sector-list and the sector lookup table, most operations will recognize and handle it correctly. On example of usage is the directory-sector LSN plus the index of a directory-entry for (V)FAT directories. LsnInfo 78000345 combines LSN 00000345 with index 7 and a single bit to mark it as an LsnInfo value (flag 0x08000000) So this points to the 8th directory entry in the directory sector at LSN 0345. (entry-numbers start counting at 0 :-) Sector list A list of sector numbers (LSN) or LsnInfo combination-values that can be manipulated as a whole with several commands like export, import, getbs, fixbs, dirfind, delfind, delsave etc. Summary of commands ------------------- The user-interface has a command entry-field with history buffer so previous commands can be recalled, and a large scroll-buffer for output. Output can also be copied to a file for later analysis. The classic user-interface can be used as well, start the program with the keyword 'nowin' as the first parameter, like 'DFS nowin' The commands are single words or (hexadecimal) numbers. Most commands have one or more parameters of wich some are optional. DFSee keeps track of the current- and some other usefull SN's so they can be referenced faster, without having to type them in. They are: Name Cmd Description ---- --- ----------- up 'u' up in hierarchy down Enter down in hierarchy this 't' this (current) xtra 'x' Extra, alternative You can display and analyse either a physical disk, a partition or a volume. A physical disk can be opened using the 'disk' command. A disk-partition or volume needs to be opened first with the 'part' or 'vol' commands respectively. The following prompt will show some status info. After opening an HPFS partition, using 'Enter' a few times will take you to the superblock, root-directory, possible sub-directories upto some file. Multiple commands can be chained if separated with a special character, the default is '#' but this can be changed with the 'sep' command. An overview of the available commands is given below, it can also be referenced from within the program using the 'help' command. ----------------------------------------------------------------------------- DFSee basic selection commands, use '??' for other generic commands Batch-mode can be forced by adding a '!' char to the cmd as in 'FDISK!' Any command not recognized will be passed to the operating system The DISK, FDISK, PART and VOL commands can select a specific mode wich makes more specific commands available, use '?' and '???' for details hex-sector-nr = Analyse & display sector, SN using logical sector-number ? or /? = Show current FS (mode), specific commands and help info ?? = Show list of all generic commands with short description ??? = Show all recognized sector-types for current filesystem <Enter>, u, x = Show next with <Enter>, up with 'u' or extra LSN with 'x' DISK [dsknr] [!] = Select a physical disk and show the MBR, [!] = reset geo FDISK [FdiskCmd] = Activate the FDISK fs (mode) and optionaly execute cmd LOG [file] = Log (append) to 'file' (.log); (No file => stop logging) PART [$|+|dr/nr] = Show partitions, or select one using nr or drive-letter VOL [drive] = Show all volumes, or select one using drive-letter q = Quit DFSee OS2: 3.05 30-08-99 (c) 1994-1999; Jan van Wijk A list of general available commands can be shown using the '??' command: ----------------------------------------------------------------------------- .NNN = Display numbered FS-entity marked .NNN from the sector list BASE [sn [sl]] = Show (and set) physical base limits start and end values BATCH [on |off] = Set batch-mode, no confirmation and locking-error reporting BPS secsize = Force sectorsize to specified value (decimal, bytes) BSFIND [types] = Find boot-sectors on head 0/1 sector 1 only (fast) CD [path] = Change current directory an current drive CS [sn] = Calculate 32-bit checksum for 'this' sector; HPFS aware CHECK [dr/nr] = Report all detected file-system errors using SLT info CHS c h s = Analyse & display sector, using CHS (cylinder head sector) DELSHOW [w;t] = Show delfind list, optional wildcard and min/max threshold DELWIPE [w;t][p] = Wipe sectors in list with pattern, wildcard [w], threshold DIRFIND [l][dir] = Put [l] levels of directory-contents in the sector-list DISKGEO [?|c h s]= Force specified geometry on opened physical disk, ?=adjust DISPLAY = Show current display size EXPORT [fn] = Export LSN's in the sector list, to file [fn] FINDPATH path = Find and show file/directory specified by path-spec, relative to current dir, or root if starting with '\' FS fsys-name = Force analysis mode for filesystem 'fsys-name' FIND[op] t [str] = Find using [op]tions, sectors of type t containing [str] options are : * = repeat; - = backward; $ = Ign-case; @[pos] = position HELP [*] = Show list of generic commands with short description a,A xx [size] = ASCII-dump (half)sector, SN xx, s sectors or bytes h,H xx [size] = Hex-dump (half)sector, SN xx, s sectors or bytes ID [xx] = Identify 'this' or specified sector, using the SLT IM img = Open a file with a FS-image (.img) for display & analysis IMPORT [fn] = Import LSN's to the sector list, from file [fn] LIST [opt] [str] = Display LSN's in the sector list, using options/string LOCK = Lock physical disk or logical partition to avoid conflicts MAP [disknr opt] = Display pseudo-graphical map of partitions on a disk MEM [c|lsn] [#] = Store LSN in sector-list at loc #, or limit list-size MORE [?|*|lines] = Set number of screen-lines, including More ... function PRIO [lvl] = Set relative priority of the DFS main thread PSN xx = Analyse & display sector, SN xx using physical sector-nr RECOVER d [w;t] = Recover files from the sector-list (delfind), to dir [d], and with optional wildcard [w] and min/max threshold [t] SAVETO [dir][l] = Save filedata for current file to a new file in [dir] SCAN [wr [NoId]] = Scan bad-sectors; use read/Write verify; No automatic id SCL clsize = Force clustersize to specified value (decimal, sectors) SCREEN [on|off] = Switch output to the screen on or off SETANSI [on|off] = Set use of ANSI escape-sequences (colors) on or off SIM img [f s z] = Save to FS-image, from LSN [f], size [s]; z = LZW compress SLT [type i ln] = Display SLT for sectors of 'type' at index i, ln lines SORT [-][unique] = Sort LSN list; [-] = descending [unique] removes duplicates TRANS l|i|c|p xx = Translate and display value 'xx' as Lsn, I13, Chs and Psn t [sector-type] = Display 'this' sector as Hex or specified sector-type u [sector-type] = Display 'up' sector as Hex or specified sector-type x [sector-type] = Display 'xtra' sector as Hex or specified sector-type UNLOCK = Unlock physical disk or logical partition WIPE pat [f s] = Wipe disk/vol/part area with pattern at LSN [f], size [s] WRIM img [f s] = Write FS-image to disk-sectors start at LSN [f], size [s] WIN [col][row] = Reset display to windowing mode, opt. resize display size NOWIN [col][row] = Reset display to cmd-line mode, opt. resize display size RUN macro = Run a DFS macro in a REXX file q = Quit DFSee OS2: 3.05 30-08-99 (c) 1994-1999; Jan van Wijk Command reference, general DFS commands --------------------------------------- FDISK [Command] = Select FDISK mode, pass (optional) command to execute Purpose: Make FDISK the active analysis mode and command-set Parameters: command optional Specific FDISK command (try FDISK ??) Output: none Remarks: When the 'batch' mode is forced using a trailing ! on FDISK, and a command is specified, DFSee will do an automatic quit after completing the command. This is usefull to execute a series of FDISK commands from a batch- or command-file. DISK [dsknr] [!] = Select a physical disk and show the MBR, [!] = reset geo Purpose: Select a physical disk Parameters: dsknr optional disk nr, default is current if open or 1 ! optional reset previously forced geometry Output: Disk Geometry and default display of sector 0 (usualy MBR) Remarks: The dfs_number variable for REXX will be set to nr-of-disks See also: WALK command LOCK [ign] = Lock physical disk, to allow writing to it Purpose: Lock a physical disk Parameters: ign optional Ignore lock failure, do not prompt interactively for write permission Output: none UNLOCK = Unlock physical disk, after writing to it Purpose: Unlock a physical disk Parameters: none Output: none BPS secsize = Force sectorsize to specified value (decimal, bytes) Purpose: Force a specific number of bytes per sector Parameters: secsize mandatory Number of bytes per sector (decimal) Output: none Remarks: Should be automatically correct, special purpose usage only SCL clsize = Force clustersize to specified value (decimal, sectors) Purpose: Force a specific number of sectors per cluster Parameters: clsize mandatory Number of sectors per cluster (decimal) Output: none Remarks: Should be automatically correct, special purpose usage only MAP [disknr opt] = Display pseudo-graphical map of partitions on a disk Purpose: Give an easy to interpred visual image of the disk layout Parameters: disknr optional number of disk to diplay, default is all opt optional options, '+' is more verbose map Output: Some lines of drawing-characters and text representing the disk with it's partitions. The partitions are sized according to their real size. Freespace is also shown the same way. The color of the areas indicate the filesystem-type. Each area contains the most relevant textual info as well. Remarks: Loosely modelled after the PartitionMagic display PART [opt / drv] = Select specified partition, or show the list of partitions Purpose: Select a disk partition for analysis Parameters: opt/drv optional Number specifying the partition as shown by the 'disks' or 'part' commands or d: Drive-letter for a partition (part C:) or $ To get a table with size information and/or * To add info on extended partitions to table or + To get a multi-line verbose list (incl LVM) or ++ Extremely verbose, with additional FS info or ! To force a new scan of physical disks If no parameter is specified the list of partitions will be displayed. or !! Force new scan, and use alternative method of drive-letter assignment (industry std). Output: Either the list of partitions in the specified format, or the verbose partition display for the selected partition. Remarks: The command "d:" where d is any existing drive-letter will be interpreted as a "part d:" command. This means that the C: partition can be opened just by typing "C:" The returncode (rc) will be zero for a valid partition id or the number of partitions otherwise (usefull in REXX scripts). An example of the list ouput in table form (default) is: Number of disks : 2 Geometry for disk : 1 Cyl: 263 H:255 S:63 Disksize : 00407847 = 2063 Mb Geometry for disk : 2 Cyl: 527 H:255 S:63 Disksize : 00812F4F = 4134 Mb Id 06=F: WARNING : Not formatted or invalid bootrecord ┌──┬──┬───┬─────────────────┬────────┬────────┬───────────┬──────────┬────────┐ │id│PD│Vol│Type, description│Format │Creator │Label Info │BM-Name │ Size Mb│ ├──┼──┼───┼─────────────────┼────────┼────────┼───────────┼──────────┼────────┤ │01│ 1│>--│Prim 0a Boot Mgr │BMGR │fdisk │«Merlin » │ │ 7.8│ │02│ 1│*--│Hide 16 FAT >32Mb│FAT16 │IBM 7.0│FAT_BOOT_1 │IBMDOS7 │ 125.5│ │03│ 1│*C:│Prim 06 FAT >32Mb│FAT16 │MSWIN4.0│FAT_BOOT_2 │WIN95/NT │ 360.8│ │04│ 1│ D:│Log 06 FAT >32Mb│FAT16 │MSWIN4.0│FAT_DATA │ │ 690.3│ │05│ 1│ E:│Log 07 Inst. FS │NTFS │Win NT │ │ │ 360.8│ │06│ 1│ F:│Log 07 Inst. FS │--none--│fdisk │ │ │ 7.8│ │07│ 1│*G:│Log 07 Inst. FS │HPFS │OS2 20.0│OS2_BOOT_3 │Merlin │ 509.8│ ├──┼──┼───┼─────────────────┼────────┼────────┼───────────┼──────────┼────────┤ │08│ 2│ H:│Log 07 Inst. FS │HPFS │OS2 20.0│BIG_HPFS │ │ 2400.3│ │09│ 2│ I:│Log 06 FAT >32Mb│FAT16 │MSDOS5.0│MSVCPP_DFS │ │ 706.0│ │10│ 2│ --│Log 82 LinuxSwap│SWAP │fdisk │ │ │ 117.6│ │11│ 2│*--│Log 83 LinuxExt2│EXT2 │fdisk │ │Linux │ 902.1│ └──┴──┴───┴─────────────────┴────────┴────────┴───────────┴──────────┴────────┘ Number of disks = The number of disks reported by the system Physical-Geo disk = Physical geometry for a disk using extended INT13 (DFSDOS) Geometry for disk = Geometry for one disk, as reported by the the OS Id nn=d: WARNING = Any informal, strange or alarming conditions on partition Where: id = The selection-id used by DFS for this partition PD = Physical drive number; 1..max Vol = Drive letter, capital (or lowercase for hidden) Prefix: '>' for active partition (BIOS bootable) '}' active partition, not first disk '!' active partition, bad bootsector '*' for partitions bootable by Bootmgr '-' bootable by Bootmgr, bad bootsector Type, description = Type-info and hex value of the type, type-info: Prim = Primary (active, accessible) Hide = Hidden (primary or special) Log = Logical volume in an extended partition Lhid = Logical volume, currently hidden Format = The filesystem format string found in the bootrecord for this partition or --none-- Creator = The OEM identification string from the bootrec of "fdisk" if no valid bootrecord is found Label Info = The volumelabel as found in the bootrecord, or the «BM-label» of the current Bootmgr selection BM-Name = The name for this partition as registered in the OS/2 boot-manager information area's LVM Volume, Part = The full LVM volume and partition names (replaces BM-name when LVM info present on disk) Size Mb = The gross size of the partition in megabytes An example of a list fragment for verbose form (FAT) is: DFS partition Id : 3 Physical disk nr : 1 Cyl: 263 H:255 S:63 = Fixed P-Table MBR, entry:2 System Indicator : 06 Type description : FAT >32Mb FileSyst. format : FAT16 Partition type : Primary Part. visibility : Visible Creator OEM-name : MSWIN4.0 Partition Label : FAT_BOOT_2 Boot capability : Bootable by OS/2 boot-manager as: WIN95/NT Bootsec checksum : D0B8A5A4 Partition start : Cyl: 17 H: 0 S: 1 first PSN : 00042AD1 on cyl: 17 Partition end : Cyl: 62 H: 254 S: 63 last PSN : 000F717E on cyl: 62 Bootsect. offset : 00042AD1 = 273105 Dec Partition size : 000B46AE = 361 Mb Cylinder size: 3EC1 = 8033 Kb Cluster size : 00000010 = 8 Kb, in 16 sector(s) of 512 bytes Free space drive : C: 156.1 Mb of 360.6 Mb on file-system: FAT Bootsec. checksum : D0B8A5A4 Size of FAT entry : 16 Bits FAT label in Root : FAT_BOOT_2 Largest ClusterNr : 0000B453 Number of sectors : 000B46AE = 361 Mb 1st FAT start LSN : 00000001 2nd FAT start LSN : 000000B7 RootDirectory LSN : 0000016D Root-size sectors : 0000002E = 23 Kb Rel Cluster-0 LSN : 0000017B 1st DataClust LSN : 0000019B EA data fragments : 0 EA header sectors : 00000000 = 0 b VOL [drv] = Show all volumes, or select one using drive-letter Purpose: Work with logical volumes including floppies and CD-rom Parameters: drv optional Drive-letter for the volume to open Output: Either the list of volumes or the default display for the first sector of the volume (usualy a boot-sector). Remarks: Network or other "virtual" file-systems are not supported for 'open' like 'vol X:', but they are listed, including their network sharename. (OS/2 version only) DISKGEO [?|c h s]= Force specified geometry on opened physical disk, ?=adjust Purpose: Show current or force different geometry to be used for interpreting and analysing the current physical disk Parameters: none Display the geometry currently in use, including possible overrides by previous 'diskgeo' commands c h s Overrule current geometry by the values specified for cylinders, heads and sectors. The value '?' can be specified for the cylinder value and will cause a re-calculation for the cylinder count based on heads/sectors and the size of the disk at the time it was first selected. Output: The resulting geometry for the physical disk currently open Remarks: You can keep the current value for one of the items by specifying zero (0) or nothing for the override Example: 'diskgeo 0 255' will set the number of heads to 255 'diskgeo ? . 32' will set the number of sectors to 32 and calculate the right number of cylinders for that geometry and disksize CHECK [dr/nr] = Report all detected file-system errors using SLT info Purpose: Check file-system integrity using SLT info (chkdsk function) Parameters: drive-letter or partition-nr to check, default opened partition Output: Verbose list of all SLT entries that have an error flagged This will include path+filename when available and textual explanation of the error(s) Remarks: The reported arrors are the same as listed with the SLT command 'check' is an alias for "SLT * 0 * +fffd" The SLT will be rebuild on each invocation of the "check" cmd. IM img = Open a file with a FS-image (.img) for analysis Purpose: Work with a saved binary image Parameters: img Filename for the image, default extention is '.img' Output: The default display for the first sector of the image Remarks: File-system type is derived from first (boot) sector SIM img [f s z] = Save to FS-image, from LSN [f], size [s]; z = LZW compress Purpose: Save specified sectors as a binary image for use with 'IM' Parameters: img Filename for the image, default extention is '.img' When prefixed with [lpt.exe], the data is actualy written to named pipe \pipe\xxx.img to LPT.EXE wich will be started in a separate session automatically This allows saving the image on a different PC that is attached using a parallel (laplink) cable. f Start LSN for save, default is 0 s Size of the saved image in sectors, default is 256 '$' can be used to save all sectors of the disk/volume z Option to enable LZW compression on the image-file Output: none Remarks: When '.' is specified for s, sector 'f' upto 'this' is saved When '.' is specified for f, the start-sector is 'this' When '.' is specified for both, only the 'this' sector is saved WRIM img [f s] = Write FS-image to disk-sectors start at LSN [f], size [s] Purpose: Write sectors back from an image to opened partition or volume Parameters: img Filename for the image, default extention is '.img' When prefixed with [lpt.exe], the data is actualy read from named pipe \pipe\xxx.img from LPT.EXE wich will be started in a separate session automatically This allows retrieving the image from a different PC that is attached using a parallel (laplink) cable. f Start LSN for write, default is 0 s Size of the saved image in sectors, default is 1 '$' can be used to write all sectors to the disk/volume Output: none Remarks: '.' can be specified for the f and s parameters, see 'sim' cmd LZW compressed image-files created by SIM will be recognized and automatically un-compressed on the fly. WIPE pat [f s] = Wipe disk/vol/part area with pattern at LSN [f], size [s] Purpose: This will wipe an entire volume or disk, or a specified part of it, using the specified pattern. Parameters: pat The pattern to use for wiping, it can be any lenth from a single byte upto 256 bytes. default: DfsWiped It can be specified as a mix of ASCII and HEX. The starting mode is ASCII, switching to HEX and back is done with the ' character. Note that there can be NO SPACES in this definition, if you need spaces, use the hex '20' value instead. f First sector-number to be wiped, hexadecimal . = current sector 'this' default: 0 s Size to wipe, in sectors, hexadecimal . = upto current sector 'this' $ = upto end of current volume/disk default: $ Output: Progress indicator with one dot for each wiped megabyte Remarks: A disk, partition or volume needs to be opened first. You can easily call DFS (or DFSDOS) from the commandline specifying a 'wipe' for the entire volume or disk. Example: wipe '00' 0 1 set bootsector to zeroes, clearing boot-code and, when the current object is a complete disk, the partition-table wipe wipe entire vol/disk/partition with the default pattern dfsdos part d n#wipe#q From the dos commandline, select partition D: and wipe it completely using the default pattern dfsdos disk 1#wipe 'ff'#q From the dos commandline, select physical disk 1 and wipe it completely using hexadecimal pattern 0xff dfs disk 2#wipe DFS'20'was'20'here 0 1#q From the OS/2 commandline, select physical disk 2 and wipe the master-boot record with the string "DFS was here" Note the use of '20' to get the parameter completely specified without using the space-character. FS fs-name = Force analysis using specified file-system knowledge Purpose: Use specific FS knowledge if the default is not correct Parameters: fs-name File-system name, like FAT or HPFS Output: none Remarks: none EXPORT [fn] = Export LSN's in sector list, to file [fn] Purpose: Save an LSN-list in a file for modification or later use Parameters: fn Destination filename, default is dfslistX.lsn Output: none Remarks: The file has one LSN per line, editable with a text-editor. IMPORT [fn] = Import LSN's to sector list, from file [fn] Purpose: Read an LSN-list from a file, exported and/or modified Parameters: fn Source filename, default is dfslistX.lsn Output: none Remarks: The file needs one LSN per line, editable with a text-editor. It can be the result of an export, derived from a log-file or created completely by hand. The verbose format resulting from a "list +" or "list +f" and the "delshow" is also valid. (use "log" cmd to capture) This is often more convenient than bare LSN lists because the verbose format contains info like path/filename. DIRFIND [l][dir] = Put [l] levels of directory-contents in the sector-list Purpose: Find non-deleted files in a directory and optionaly it's subdirecties upto the number of levels specified. Parameters: l optional number of directory levels to include in the list, or 's' for all levels dir optional directory specification, starting from the root-directory Output: Sector list in memory to be used in following operations Remarks: List can be manipulated as usual, best viewed with "list +f" Example: dirfind s \os2 This will put the whole \os2 tree in the sector-list BASE [sn [sl]] = Show (and set) physical base limits start and end values Purpose: Force a different partition start sector-nr Parameters: sn Sector-number to use as start for partition ==> LSN 0 sl Sector-number to use as end for partition (optional) Output: Display of current physical start and end values (after set) Remarks: Can be used if start of partition / partition-tables are bad Try to find the PSN for the first sector of the partition and use the "base" cmd followed by an "FS xxxx" command PSN xx = Analyse & display sector using PSN xx Purpose: Display sector using Physical Sector Number addressing Parameters: xx = 1 to 8 hexadecimals Output: Sector display, format selected based on sector-contents Remarks: The SN is specified in hexadecimal format, however the first digit needs to be decimal to avoid misinterpretation. Prefixing the SN with '0' will avoid any conflicts. Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) CHS c h s = Analyse & display sector using CHS specication Purpose: Display sector using Cylinder, Head and Sector addressing Parameters: c mandatory The zero-based decimal Cylinder number Range 1 to disk-specific maximum and usualy below 1024. h mandatory The zero-based decimal Head number Range 0 to disk-specific maximum but never more than 255 s mandatory The one-based decimal Sector number Range 1 to disk-specific maximum but never more than 63 Output: Sector display, format selected based on sector-contents Remarks: Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) xx = Analyse & display sector, SN xx; xx = 1 to 8 hexadecimals Purpose: Display a sector in the most usefull format Parameters: none Output: Sector display, format selected based on sector-contents Remarks: The SN is specified in hexadecimal format, however the first digit needs to be decimal to avoid misinterpretation. Prefixing the SN with '0' will avoid any conflicts. Logical addressing (LSN) is actualy used, however when a physical disk is selected the offset for logical addressing is set to 0. The result is that LSN's equal PSN's. Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) H,h [xx [s]] = Hex-dump sector or half-sector, LSN xx, s sectors/bytes Purpose: Display current or specified sector in hex-dump format Parameters: xx optional LSN of sector to dump s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 512 bytes for the 'H' command and 256 bytes for the 'h' command Output: Hex-dump of the sector On every line 16 bytes of data will be displayed, each line containing: - the relative offset in the record (4 hex digits) - 16 bytes in hexadecimal; separator after 8 bytes - the same 16 bytes represented as ASCII Remarks: The ASCII representation is filtered, non-printable characters are represented with a PERIOD character T a|h [s] = This LSN, display in Ascii or Hex; s sectors/bytes Purpose: Display current sector in ASCII, EA, HEX or default format Parameters: a|h optional Specifies display format as: a = ASCII h = HEX none = default (based on sector-contents) s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Output: Sector display in requested format Remarks: FIND[op] t [str] = Find using [op]tions, sectors of type t containing [str] Purpose: Perform a sector search starting from the current LSN until a sector of the specified type and optionaly (not) containing a specified ASCII/HEX string is found. Parameters: op optional Search and display options, default is '+' * = Repeat find, building a list (find all ...) % = No sector-spanning, => fast text-search [ = Freespace only => fast undelete ] = Allocated space only => fast file-grep ! = No progress output while searching (faster) + = Verbose output even when repeating - = Search towards lower sector numbers ~ = Search sector-1 head 0/1 only, bootsectors $ = Use case-insensitive string compare ^ = Inverse, search sectors NOT containing ... @[pos] = compare at sector position [pos] only (with type dependant defaults for [pos]) Note: Use no spaces between 'find' and options! t optional Types of sector wanted, default is any KNOWN specify multiple types in a single string DFS generic sector types '*' = any sector '~' = No contents shown 'r' = Master Boot Rec 'e' = Extended Boot Rec 'b' = Fsys boot sector 'R' = Fsys reserved sec '!' = any known type 't' = Text format data 'h' = Hex format data 'H' = Unidentified data '$' = Free space 'w' = Wiped by DFSee... 'T' = Tpack# compressed '.' = <Past-partition!> For an up-to-date list, use the '???" command str optional A string of bytes that have to be present in the wanted sector. When the '$' string option is not given, it can be specified as a mix of ASCII and HEX. The starting mode is ASCII, switching to HEX and back is done with the ' character. Leading whitespace is skipped, in HEX mode spaces can be used to improve readability. Example 1: last'0d0a'first This will search for the word "last" followed by a carriage-return line-feed combination and the word first Example 2: 'e9bd13 0d4023 49 42 4d 3a38 2e' This will search for a byte sequence, in this case the start of COMMAND.COM Output: Sector display, format selected based on sector-contents, or a single line with position and type info when repeating Remarks: This command is also very usefull to find a specific fragment of disassembled code anywhere on the disk, to resolve the name of an EXE, DLL or device driver causing traps or hangs. Backward search can be usefull on HPFS to find the preceding fnode when looking at some random file-data. Note: the 'id' command will do this more reliably but depends on the sector-lookup-table to be filled. The find command is often called by other commands to implement the actual search (like "delfind" and "bsfind") BSFIND [types] = Find boot-sectors on head 0/1 sector 1 only (fast) Purpose: Find MBR, EBR or fsys-boot-sectors on a disk Parameters types optional type of sectors to look for (default 'bre') Output: Sector display, format selected based on sector-contents, or a single line with position and type info when repeating Remarks: This command is intended to collect info for 'unfdisk' type of recovery in the fastest way possible. It only inspects sector-1 on head 0 and 1 on each cylinder. This makes it DEPENDANT on the geometry currently being used on the disk. You could try using different geometries with the 'diskgeo' command if the actual geometry is uncertain. Afterwards, a usefull detailed list can be made with 'list +d' EDIT pos str = Update the current sector at 'pos' to the value of 'str' Purpose: Make (small) modifications to sector contents Parameters pos mandatory Hexadecimal offset, start of edit-area str mandatory A string to be placed at the specified position in the current sector. The syntax for this string is exactly the same as for the find ('f") command. So ASCII and binary specifications are possible. Output: Hex-dump BEFORE and AFTER for the changed sector area Remarks: The edit command itself does NOT write the new contents back to disk. Use the 'write' command to do that. The 'show' command can be used to view the sector before writing back or making more changes. It is simular to the 'H' and 'h' command, but it does not read from the disk, it just displays the current sector buffer contents. SHOW [s] = Hex-dump current sector (or half-sector), s sectors/bytes Purpose: Display current (last read, edited) sector in hex-dump format Parameters: s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 512 bytes for the 'SHOW' command and 256 bytes for the 'show' command Output: Hex-dump of the sector, see the 'h' and 'H' commands Remarks: The main difference with 'h' and 'H' are that the current contents of the sector-buffer (possibly changed by an 'edit') are shown. 'h' and 'H' will first read a sector from disk. WRITE xx = Write back the sector-buffer using current or specified LSN Purpose: Update a sector on the disk, possible after editing it Parameters: xx mandatory sector-number specification (LSN) '.' is the current sector ('This') Output: none Remarks: Only one sector (512 bytes) will be written. Writing back changed data to the disk can cause BIG TROUBLE when you don't know EXACTLY what you are doing. Use it with extreme care (and maintain backups if possible :-) LIST [opt] [str] = Display LSN's in the sector list, using options/string Purpose: Display one of the sector-number lists maintained by DFS Parameters opt optional + = Use verbose output, one line per LSN +f = verbose including PATH info on Fnode +d = display sector contents as well +c = One line LSN info + a command per LSN +g = Show lsn -> psn -> CHS using diskgeo str optional Wildcard select-string, only valid with "+f" multiple wildcards '*' and '?' can be used. Useful on a (large) list of deleted fnodes! Command to execute for each LSN in the list when the "+c" option is used Output: List of sector numbers in compact, verbose or special format Remarks: List also available for REXX in the dfs_sn. stem variable Lists can be imported and exported to files, see import/export SAVETO [dir][l] = Save filedata for (current) dir+entry LSN to a file Purpose: Recover a file based on it's directory entry and the FAT, by a low-level sector-by-sector copy of its data to a new file. Parameters: dir optional Path to save the file copy, default a:\ l optional LSN (dir+entry) of the file to recover rename optional new name for destination file Output: Progress is reported with one RED or GREEN dot for each sector Remarks: Only the file contents is recovered, date&time and attributes are lost. If no directory is specified it will default to the last one used for saveto. This directory should be on ANOTHER drive! DELSHOW [w;t] = Show delfind list, optional wildcard and min/max threshold Purpose: Display a list of deleted Fnodes Parameters: w optional wildcard selection for display t optional +nn = Minimum allocation-OK percentage -nn = Maximum allocation-OK percentage Output: LSN list in fnode format (as "list f+f *;1" command) Remarks: Default wildcard is '*', default percentage is 0 Minimum wil list all values larger, maximum all values 'upto' Wildcards are real (UNIX style) wildcards using '*' and '?' Wildcards can appear at multiple places in the path string. Example delshow *;100 All files perfectly recoverable Example delshow *.ini;50 All *.ini files at least halfway OK Example delshow *;-100 All files not fully recoverable RECOVER d [w;t] = Undelete files from the delfind list, to dir [d], and DELSAVE d [w;t] with optional wildcard [w] and min/max threshold [t] Purpose: Undelete multiple files using (a selection from) a list Parameters: d optional Path to save the file copy w optional wildcard selection for display t optional +nn = Minimum allocation-OK percentage -nn = Maximum allocation-OK percentage Output: Progress is reported with output like the "ca" command, error messages will be given as appropriate All files are recovered one by one using the "saveto" command automatically on each selected LSN from the list. Remarks: See "saveto" and "delshow" command LSN list is the find-result list as shown with "delshow" It can be edited using "export" or "log" + "delshow" and imported again using "import", to make specific selections If a path for the deleted file can be resolved, it will also be included in the saved copy. If the directories do not exist they will be created. This means a whole directory-tree can be undeleted in one operation, while retaining the structure. DELWIPE [w;t][p] = Wipe sectors in list with pattern [p], wildcard [w], and WIPELST [w;t][p] threshold [t]. WIPELST is a synonym. Purpose: Wipe sectors in the (delete) list with a pattern This makes deleted files INVISIBLE for future undelete commands Parameters: w optional wildcard selection for display or '!' t optional +nn = Minimum allocation-OK percentage -nn = Maximum allocation-OK percentage default: *;-100 ==> all except 100% ones p optional The pattern to use for wiping, it can be any lenth upto 256 bytes default: DfsWiped Output: Progress is reported with one line per file (file-info list), or a single dot per sector when selection overruled with '!' Remarks: '!' as first parameter will overrule the normal file-display and validation, and wipe EACH SECTOR in the list. Wiping file-list sectors (from delfind), is intended to clean the disk from obsolete file-info (Fnode's), making 'delfind' returning less deleted files the next time. The files wiped CAN NEVER BE UNDELETED ANYMORE! See also "wipe" and "delshow" command MEM [c|lsn] [#] = Store LSN in MEMory list at loc #, or limit mem list-size Purpose: Add an LSN to the LSN memory list for later use with .NNN Parameters: c optional Clear command, limit list-size to # entries lsn optional LSN to add to the list, special values are: x, u, d, t for Xtra, Up, Down and This # optional memory location to store lsn, or limit Output: none Remarks: The LSN memory can be listed using "list" [+f] SORT [+|-][u] = Sort the LSN list using specified options Purpose: Sort the list ascending/descending, remove duplicates Parameters: +|- optional Sort ascending (+) or descending (-) default is ascending u optional Make list unique by removing all duplicates Output: none TRANS l|b|c|p xx = Translate and display value 'xx' as Lsn, Bios, Chs and Psn Purpose: Translate value xx to 4 possible representations Parameters: l|b|c|p optional type specifier for input value (xx) l = lsn, logical sector number b = bio, 3 hex-byte CHS, as in part-table c = chs, 3 decimal values; cyl, head, sector p = psn, physical sector number xx optional input value(s) to translate The default is the 'this' value (as lsn) Output: One line with all 4 possible representations of the value 'xx' Remarks: This function is usefull to calculate values for partition- table entries or CHS values. The same functionality is used in the 'list +g' command against each sectornumber in the list. .NNN [id] = Display numbered FS-entity marked .NNN from a sector list Purpose: Display one of the entries from the list last shown It can be applied on Directory- as well as Allocation-lists The number (NNN) to use is displayed to the left of the list Parameters: NNN The zero-based decimal entry number to show id optional Identifier for LSN list (see list command) Output: Sector display, format selected based on sector-contents Enter = down in hierachy (Enter = down) Purpose: Display the next, most likely wanted, sector Parameters: none Output: Sector display, format selected based on sector-contents u = up in hierachy Purpose: Display the sector that is higher in the hierarchy (parent) Parameters: none Output: Sector display, format selected based on sector-contents x = Extra LSN Purpose: Display the sector marked as eXtra Parameters: none Output: Sector display, format selected based on sector-contents SLT [t i s m] = Show SLT for 'type', at index i, size s, error-mask m Purpose: Display (selection of) the Sector Lookup Table Parameters: t optional Sector-types to include in the displayed list. Default is all types ('*') Types are same as specified for 'f' cmd i optional Start index in the SLT to display, '+' and '-' show next/previous screenfull 'a' will show entire SLT s optional Number of entries to display, default will result in one screenfull; '*' = rest of SLT m optional Error filtering mask, * = all errors 4-digit Hexadecimal value, each set bit will include a specific error value. When prefixed with a '+' sign, the ouput will be verbose (error-text & path+filename) Output: One line for each entry in the SLT, containing: LSN Start LSN for a range of sectors size Number of sectors in the range ref Other sector refering to this range (fnode) type Type of the sectors in the range error 4-digit Hexadecimal error value: 0x00000001 Linked to some structure, but not in bitmap 0x00000002 Allocated in bitmap, but no known link 0x00000004 HPFS shortname does not match DIR name 0x00000008 Fnode is a directory but DirFlag is not set 0x00000010 Fnode datalength greater than Dir-entry size 0x00000020 Fnode datalength smaller than Dir-entry size 0x00000040 Fnode datalength greater than allocated size 0x00000080 Fnode datalength smaller than allocated size 0x00000100 Checksum value is incorrect 0x00001000 LSN does not point to valid dirblock 0x00002000 LSN does not point to valid Fnode 0x00004000 LSN does not point to valid Allocation sector 0x00008000 LSN is too large for this volume Remarks: Sector ranges might overlap, the smallest matching range will hold the best identification for a specific sector. The start-index will default to the position of the sector last searched using the 'i' cmd. If needed the SLT will be built in a background thread. ID [xx] = Identify, using sector lookup table Purpose: Display the type for a specific sector and one major reference Parameters: xx optional LSN of sector to identify, default is the current sector Output: One line specifying corresponding SLT entry, followed by a line specifying the type of the sector itself and a sector display of the 'ref' sector, in a format based on sector-contents Remarks: This function is extremely usefull to relate file-data sectors from fragmented files to the Fnode for the file. It will tell you exactly to wich file a certain sector belongs. LOG [file] = Log (append) to 'file' (.log); (No file => stop logging) Purpose: Close current LOG, open new and capture DFS output in it Parameters: File specification If no parameter is specified, logging is stopped. Output: Concatenated output of DFS commands given after the 'log' command, upto next 'log' or 'q' command. ANSI control characters for colors and cursor-positioning are not written to the logfile. Remarks: There is no check on available space on the destination drive, file may end up empty if disk(ette) is full. The same logfile specification can be used more than once, output will be concatenated. On each 'log' command the current logfile will be closed. TRACE [lvl] = Set trace level for DFS internal functions Purpose: Investigate unexpected behaviour and debug DFS Parameters: lvl optional Trace level; 0 = no trace Output: The resulting trace-level, after this the output will be normal output mixed with extra trace information showing API return-codes and DFS internal variables Remarks: Only available in the special DFSTRACE.EXE version PRIO [lvl] = Set relative priority of the DFS main thread Purpose: Increase (search) speed with +, or decrease system impact Parameters: lvl optional Prority level; + and ++ = high(est), - and -- = low(est) Output: The resulting prio-level Remarks: When running on low(est) priority in the background, DFS will almost come to a halt. q = Quit DFSee OS2: 3.05 30-08-99-99 (c) 1994-1999; Jan van Wijk Purpose: Exit DFS program Remarks: Opened physical disk and logfile will be closed on exit Asynchronious running threads will be aborted. CD [path] = Change current Directory Purpose: Change both the current directory and the current drive Parameters: path optional Absolute or relative path specification Output: The resulting current drive and directory Remarks: '.' and '..' can be used in the relative path specification RUN mf [arg] = Run a REXX macro from DFS Purpose: Execute a REXX script using the 'DFS' environment Parameters: mf mandatory Macro file specification arg optional Arguments to the REXX macro Output: Any output from the REXX macro including (OS/2) commands executed from the macro. Remarks: DFS commands can be issued from within the macro, this is the default environment (Address DFS). Commands for CMD.EXE must be addressed using 'Address Cmd' The following REXX variables will be available after each executed DFS command from a macro: rc The returncode from the DFS command dfs_disknr Physical disk number currently open dfs_partid Partition-id for selection with "part" dfs_drive The opened drive letter, including a colon. dfs_afsys The attached filesystem, like "HPFS" or "FAT" dfs_sect The last retrieved sector(s), binary buffer dfs_type Type of last retrieved sector, this is a string starting with the type-character (see 'F' cmd) followed by a textual description. dfs_this SN of the last retrieved sector dfs_down SN of most likely sector to retrieve now dfs_up SN of sector up in hierarchy dfs_next SN of next in sequence dfs_prev SN of previous in sequence dfs_down SN of up in hierarchy dfs_number The number of disks or partitions resolved, from the commands "disk" and "part 0" or "part" respectively. dfs_sn.0 Number of sector-numbers in the SN stem variable dfs_sn.n nth sector-number in the SN stem variable, coming from DFS output for directories and allocation. They correspond to the '.NNN' command Note: SN's are in an 8-digit Hexadecimal format REXX is dynamically loaded, when the run-command is exectuted It requires REXX.DLL and REXXAPI.DLL in the libpath. COPYOUTPUT [stem-name] Copy output from last-command to REXX stem-var Purpose: Allow output to be captured and processed from REXX Parameters: stem optional name of stem variable, ending in a '.' default: "dfs_output." Output: none Remarks: The <stem>.0 will hold the number of lines <stem>.1 through <stem>.n the actual cmd-output ==> This command is temporarily disabled in version 2.73 to avoid a trap ona 'vol' command on HPFS while logging SCAN [wr [NoId]] = Scan bad-sectors; use read/Write verify; No automatic id Purpose: Identify bad sectors on a physical disk or logical volume Parameters: write optional 'w' to use full read/write/verify sequence NoId optional 'n' to disable automatic SLT lookup Output: Progress indication based on sector-numbers, and one line for each bad-sector found, plus an SLT display of a related sector like the fnode, if automatic SLT display is enabled. Remarks: For REXX, the dfs_sn.0 stem variable will hold the number of bad-sectors found and dfs_sn.1 through dfs_sn.n the actual bad sector numbers (can be shown with the 'list' command) Without the write option, only a single 'read' will be done for each sector, this can be executed on a running system with open files on the disk/volume to be checked. With the write option a "read/write-inverse/read/write-normal" sequence is done for each sector with contents checking. The contents of each sector will stay the same, so the function can be safely executed on formatted disks with live data. This sequence takes at least 4 times more time to complete and also, for safety, the disk will be locked. This means that the write option can only be used when the complete physical disk is not being used. Remarks: Also available for REXX in the dfs_sn. stem variable SCREEN [arg] = Switch output to the screen on or off Purpose: Allow output to logfile only Parameters: arg optional 'on' or 'off' to switch mode Output: none Remarks: The returncode (rc from REXX) will indicate the setting for screen output: 0 indicates screen switched on 1 indicates screen switched off SEP separ = Specify a different separator character for multiple commands Purpose: Allow use of the current separator-character in commands, while still allowing multiple commands to be specified in a single commandline. Parameters: separ mandatory One character being the new separator Output: none Remarks: If part of a multi-command itself, the 'sep; command needs to be terminated with the current (old) separator. The rest of the multi-command uses the new value. Example: dfs sep ~#log inifiles~part d~fos2.###~q WIN [col][row] = Reset display to windowing mode, optional resize display size NOWIN [col][row] = Reset display to cmd-line mode, optional resize display size Purpose: Switch to desired mode, either classic command-line based (NOWIN), or windowed using a large scroll-buffer and command-history (WIN) Parameters: col optional The number of columns to use in the display row optional The number of rows to use in the display Output: Screen refresh in selected mode, and display of screen sizes Remarks: To set the screen size, the underlying OS command 'mode xx,yy' is used. Operating system limits regarding size still apply. Example: win 132 43 Command reference, FDISK specific commands ------------------------------------------ Active filesystem : FDISK, specific commands are: DISK|WALK [disk] [!] = Select disk, show the MBR, walk EBR chain CLEANUP [disk ] = Cleanup partition-chain, fix minor errors DELETE pid [disk [clean]] = Delete one or more partitions, clean=zero DFSIBMGR [disk ] = Create new bootmanager image for 'create' DOS2OS pid [disk ] = Change FAT-BR bootcode from DOS to OS/2 FIXEXT [disk [to [from]]] = Fix ext-partition types to standard value NEWMBR [disk [clean]] = Refresh MBR bootcode, [clean] = delete all PLIST p|f|e|m|b [disk [e]] = Part-list on: part|free|ebr|mbr|boot [ebr] SETACCESS pid [hide|vis|multi] = Make partition 'pid' accessible or hidden SETBOOT opt[:opt-parameters] = Bootmanager setup and reboot => 'setboot ?' SETNAME pid [BM-name] = Set or reset bootmanager name for partition SETTYPE pid disk new [old] = Change partition-type from old to new value STARTABLE pid [multi] = Make partition 'pid' startable (bootable) TYPE [system-type ] = Show system-type description (for 00..ff) CREATE plt type [size [loc [pos [BM-name]]]] = Create a new partition CR plt : Primary/Logical identifier; log | prim | l | p type : System-type for new partition; hex | symbolic-name size : Desired size for the partition; number[[,d|x]m|c|s] | * loc : Location to place new partition; @freespace-id | disk | * pos : Position in loc-area; [+|-|@|{|}]number[[,d|x]m|c|s] | * BM-name : Add to the bootmanager-menu using this name For an up-to-date list of commands, use the '?' command FDISK specific sector types (see ??? command) 'X' = Unidentified data WALK [disk] [!] = Select disk and walk MBR/EBR chain, reset Purpose: Show all partitioning information for the specified disk Parameters: dsknr optional disk nr, default is current if open or 1 ! optional reset previously forced geometry Output: Disk Geometry, MBR and all linked EBR's in partition format Remarks: The dfs_number variable for REXX will be set to nr-of-disks See also: DISK command PLIST p|f|e|m|b|w|l [d [r]] = list: part|free|ebr|mbr|boot|walk|lvm Purpose: Show one of several lists of partition related information Parameters: type optional type of list wanted: p|f|e|m|b|w|l part normal partitions free freespace area's ebr EBR-chain mbr MBR partition-table entries boot Bootsectors for all partitions walk MBR's and all EBR's (as WALK cmd) lvm LVM volume information sectors d optional Disk to operate on, default is all disks r optional Flag to include extra-info on related sectors like EBR and/or LVM. Output: The list of the requested type with info on start- and end-sector numbers, sizes and more. Remarks: none CLEANUP [disk ] = Cleanup partition-chain, fix minor errors Purpose: Cleanup minor inconsistencies in partition-chain, like remove of 'empty' extended partitions and recalculation of the total size of the extended-container. Parameters: disk optional Disk to operate on, default is all disks Output: Progress information and confirmation messages Remarks: Inconsistencies can be caused by several operations, using DFSee, other FDISK versions or Partition Magic. Resizing and deleting with PQmagic or a 'delete' with DFSee can cause 'empty' extended containers. DFSIBMGR [disk ] = Create new bootmanager image for 'create' Purpose: Create a DFSIBMGR.IMG image-file from the bootmanager installed on the specified disk, to be used later on 'create' commands when creating new bootmanager partitions. Parameters: disk mandatory Disk to get the bootmanager image from Output: Progress information Remarks: The 'create' command will automatically search for an image with this name when a type 0x0a = BMGR partition is created. FIXEXT [disk [to [from]]] = Fix ext-partition types to standard value Purpose: Change non-standard values (0x0f) back to the standard 0x05 value so operating systems like DOS and OS/2 cann access the logical volumes inside this extended-partition container. Parameters: disk optional Disk to operate on, default is all disks to optional New system-type for EBR, default is 0x05 from optional Existing system-type, default is 0x0f Output: Progress information and confirmation messages Remarks: The non-standard type 0x0f is introduced by Win9x combined with the FAT32 filesystem. These allow partitions larger then 2Gb and spanning the 8Gb BIOS limit (1024 cylinders). Using the 0x0f type prevents older operating systems to access, and possibly damage, the new partitions. When all FAT16 partition are below cylinder 1024, there seems to be NO VALID REASON to use this type, and it can be safely changed back to 0x05 to allow access by DOS, OS/2 and others. I can NOT GUARANTEE full cooperation with multiple operating systems, but my experiences are positive. NEWMBR [disk [clean]] = Refresh MBR bootcode, [clean] = delete all Purpose: Create or refresh the boot-code in the master boot record Parameters: disk optional Disk to operate on, default is all disks clean optional Make the partition-table empty, effectively deleting all existing partitions Output: Progress information and confirmation messages Remarks: none SETNAME pid [BM-name] = Set or reset bootmanager name for partition Purpose: Set or clear the name for a partition, adding it to the menu Parameters: pid mandatory Partition id, see PART and MAP display BM-name optional When specified, this is the name to be used in the bootmanager menu. (length 8) When not specified, the partition will be removed from the menu by clearing the name in the bootmanager administration. Output: Progress information and confirmation messages Remarks: none SETTYPE pid disk new [old] = Change partition-type from old to new Purpose: Change the system-type for a partition to a new value Parameters: pid mandatory Partition id, see PART and MAP display disk Disknr, * or 0, used for selection verification new mandatory New system-type, hexadecimal or symbolic The most used system-types are: hex sym 01 FAT12 = FAT12 04 FAT16 = FAT16 < 32 Mb 05 EXT = Extended partion (chain) 06 FAT = FAT16 > 32 Mb 07 IFS = Installable File system 07 HPFS = IFS, HPFS (alias) 07 NTFS = IFS, NTFS (alias) 0a BMGR = OS/2 Bootmanager 0b FAT32 = Primary FAT32 I13 0f BIGX = Large extended (PQMAGIC 4.0) 82 SWAP = Linux swap partition 83 EXT2 = Linux EXT2 data partition eb BEOS = BeOS filesystem fe PS2S = PS/2 system partition old optional Existing system-type, for verification Output: Progress information and confirmation messages Remarks: Only the type of the partition in the partition-table will be changed. The actual internal format of the partition is not affected by this operation. Note that the 05 an 0f (extended) types cannot not be used by the 'SETTYPE' command, but they can be used in 'FIXEXT' You can get an overview of all types with the 'TYPE' command. SETACCESS pid [hide|vis|multi] = Make partition 'pid' accessible or hidden Purpose: . Parameters: pid mandatory Partition id, see PART and MAP display hide optional Make this partition hidden (invisible) vis optional Make this partition visible, hide others multi optional Make this partition visible, but do allow multiple visible primary partitions per disk Output: Progress information and confirmation messages Remarks: The partition will be made visible (types 01 .. 0f). All other primaries on the same disk will be made hidden, except when the 'multi' parameter was given. SETBOOT opt[:params] = Bootmanager setup and reboot options Purpose: Configure BMGR; Set partition to boot, and (optional) boot Parameters: opt mandatory Option letter/word for the setboot action params optional Depending on the selected option: q:disk (query BM settings on 'disk') t:timeout (seconds or NO) m:mode (normal or advanced) x:num (set system-index to 'num') [0..5]:name (set system 0..5 to 'name') ibd:d (reboot from drive d) iba:BM-name (reboot from BM-name) n:d (set next-boot to drive d) b ([shutdown] and reboot now) System-indexes 0..5 have the following meaning: 0 default system, Booted when no other selection is made from the menu, or when the timeout is set to NO. 1..3 fallback range On a failing boot on one of these systems, the next boot will be of the next lower-number system (fallback scenario) 4 force-reboot Indicates the system-name to boot next time, without display of the menu (forced). This is used by the /iba:name option. The name is automatically cleared on the next boot. 5 last-booted The system-name last booted using bootmanager. This will also be the default when the default system itself (0) is not set. Output: Progress information and confirmation messages Remarks: For the reboot options, an external program is needed that does the actual reboot. The name for this program is the same as for DFSEE, with 'X.exe' added to name. So, for DOS this would be DFSDOSX.exe, for OS/2 it is DFSX.exe and for NT it is DFSNTX.exe. It will be searched for in the same path as DFSee was found and in the current directory. A parameter with value "reboot" is passed to the program. - The reboot from DFS.EXE requires DOS.SYS to be loaded! - The reboot from DFSDOS will probably NOT work on Win9x using the internal reboot function, copying the DFSNTX.EXE to DFSDOSX.EXE should work for Win9x however. STARTABLE pid [multi] = Make partition 'pid' startable (bootable) Purpose: Make the selection partition the 'active' one to be booted Parameters: pid mandatory Partition id, see PART and MAP display multi optional Allow multiple primary partitions per disk Output: Progress information and confirmation messages Remarks: The partition status will be set to 'active' (0x80) and, if needed the partition will be made visible. All other primaries on the same disk will be made hidden, except when the 'multi' parameter was given. CREATE plt type [size [loc [pos [BM-name]]]] = Create a new partition Purpose: Create one new partition in an area that is now freespace Parameters plt mandatory Primary/Logical identifier; log | l Logical partition prim | p Primary partition type mandatory System-type for new partition; hex Hexa-decimal value 0..0xff symbolic A name from the pre-defined set of partition-types. (see SETTYPE for a list) size optional Desired size for the partition; * Use maximum size for the selected freespace-area number[[,d|x]m|c|s] Specific value, hex or decimal. Megabytes, Cylinders or Sectors. Default: decimal Megabytes loc optional Location to place new partition; * Use first 'matching' area @fsp-id Specific freespace area disk Use first matching area on the specified disk pos optional Position in loc-area; * Default position (at start) [+|-|@|{|}]number[[,d|x]m|c|s] Specific value, hex or decimal Megabytes, Cylinders or Sectors. Default: decimal Megabytes Prefix modifiers are: + Relative to start or area - Relative to end of area @ Absolute from start of disk { Relative, before 1024-cyl limit } Relative, after 1024-cyl limit Note: The corresponding value with the prefix can be 0 or empty BM-name optional Add to the bootmanager-menu using this name Output: Progress information and confirmation messages Remarks: none DELETE pid [disk [clean]] = Delete on or more partitions Purpose: Delete one or more partitions. Parameters pid : Partition-id for 1 partition or '*' for all partitions disk : Physical disk number for 1 disk or '*' for all disks clean : Zero out complete table-entry, not just the system-type Output: Progress information and confirmation messages Remarks: The partition will by default be deleted by changing the system-type to hex '00'. This is the minimum required change. This allows for relatively easy recovery or rollback. The 'clean' option forces the complete table-entry, 16-bytes to be set to all zeroes. Note that the extended-boot-records (EBR) are NEVER removed from the EBR chain by the delete command. Even if an EBR remains empty, it is left in the chain. Most operating systems have no problems with a setup like this. You can use the 'cleanup' command to clean this up when needed. A subsequent 'CREATE' will also clean the EBR-chain up. TYPE [system-type ] = Show system-type description (for 00..ff) Purpose: Show short description for one, or all known system types Parameters: type optional one system type to query Output: Single line when one type queries, or 4 descriptions per line covering all known system-types from 00 through ff Remarks: none DOS2OS pid [disk] = Change FAT-BR bootcode from DOS to OS/2 Purpose: Replace DOS based bootcode by OS/2 based bootcode for FAT Parameters pid : Partition-id for 1 partition or '*' for all partitions disk : Physical disk number for 1 disk or '*' for all disks Output: Progress information and confirmation messages Remarks: This command is intended to prepare a partition for booting OS/2 (FAT only), from a pure DOS environment. Step 1) Partition using DFSee FDISK (make at least 1 FAT) Step 2) reboot, to make DOS assign a drive-letter Step 3) Format the FAT partition using std DOS FORMAT Step 4) Use DFSEE DOS2OS command to make it OS/2 bootable Step 5) xcopy a saved set of OS/2 files to the partition, including OS2BOOT, OS2LDR etc Step 6) Boot that partition as OS/2 (direct or through BMGR) Command reference, FAT specific commands ---------------------------------------- Active filesystem : FAT, specific commands are: \path-spec = find and show file/directory relative to root (see find) ALLOC [+|-] = Display allocation map for FAT, more [+] or less [-] detail CL = Translate and display 'this' LSN as a cluster nr CL clust [cmd] = Translate specified cluster-nr to LSN, display using 'cmd' FATSELECT [fat] = Select fat to be used (cached), fat = 1 or 2; default is 1 FATSHOW [*|nr] = Display contents of the FAT from memory, [nr] entries SPACE [clust] = Show allocation for specified cluster or current LSN 'this' For an up-to-date list of commands, use the '?' command FAT specific sector types (see ??? command) '1' = First FAT area '2' = Second FAT area '3' = Start 12-Bits FAT '4' = Start 16-Bits FAT '8' = Start 32-Bits FAT '\' = Root directory 'd' = Sub directory 'D' = Directory data 'I' = File data 'X' = Bad sector-area ALLOC [+|-] = Display allocation map for FAT, more [+] or less [-] detail Purpose: Show usage and the distribution of data over the volume. Parameters: + or - optional Show more or less detail by changing the the number of Kb represented by each char Output: A single bitmap-graphic for the entire volume Remarks: Boot-sector, both FAT's and the Root-directory are represented in the first display=line using colors. The size of FAT/Root is proportional to their real size and the percentage of used entries in the root-directory is shown at the end of the line CL = Translate and display 'this' LSN as a cluster nr Purpose: Find out what cluster-nr corresponds to current LSN Parameters: none Output: The cluster number, or an error message when invalid CL clust [cmd] = Translate specified cluster-nr to LSN, display using 'cmd' Purpose: Display data using a cluster-nr instead of an LSN Parameters: clust mandatory The cluster-nr of interest cmd optional DFS generic command to execute with clust as its first and only parameter (like 'H') Output: The output for the cmd, when no explicit cmd is specified this will be the DFS default for the corresponding LSN, usualy a display of that sector(s) in an appropriate format. FATREAD [fat] = Read fat from disk into memory, fat = 1 or 2; default is 1 Purpose: Update the in-memory FAT from the disk-FAT Parameters: fat optional Number of the disk-FAT, either 1 or 2 Output: none Remarks: FAT12, FAT16 and FAT32 formats are supported FATWRITE [fat] = Write-back fat memory to disk, fat = 1 or 2; default is 1 Purpose: Update the on-disk FAT with the possibly changed in-memory FAT Parameters: fat optional Number of the disk-FAT, either 1 or 2 Output: Message indicating success or failure Remarks: This is a potentialy dangerous operation, also usualy both FATs on the disk need to be in-sync. So 2 writes are needed. FATSHOW = Display contents of the FAT from memory Purpose: List all FAT-entries separately for analysis Parameters: none Output: A list of FAT-entries with 8 values in each line, <free> <bad> and <eof> values are shown as such. SPACE [clust] = Show allocation for specified cluster or current LSN 'this' Purpose: Show size and fragmentation of allocated space for a cluster Parameters: clust optional Cluster number Output: A list of allocation-chunks with LSN's and sizes Remarks: none Command reference, NTFS specific commands ----------------------------------------- Active filesystem : NTFS, specific commands are: CL = Translate and display 'this' LSN as a cluster nr CL clust [cmd] = Translate specified cluster-nr to LSN, display using 'cmd' FIXBOOT = Recover NTFS bootsector from the spare-copy, if available MFT = Translate and display 'this' LSN as an MFT record nr MFT mft-recnr = Calculate LSN for MFT record-nr and perform default display MIR [mft-recnr] = Calculate LSN for MFT-mirror record-nr, do default display MFTEXT = Find all external MFT records (continuation for base-MFT) For an up-to-date list of commands, use the '?' command NTFS specific sector types (see ??? command) 'f' = MFT regular File 'z' = MFT deleted File 'D' = MFT regular Dir 'y' = MFT deleted Dir 'd' = Directory index For an up-to-date list, use the '???" command CL = Translate and display 'this' LSN as a cluster nr Purpose: Find out what cluster-nr corresponds to current LSN Parameters: none Output: The cluster number, or an error message when invalid CL clust [cmd] = Translate specified cluster-nr to LSN, display using 'cmd' Purpose: Display data using a cluster-nr instead of an LSN Parameters: clust mandatory The cluster-nr of interest cmd optional DFS generic command to execute with clust as its first and only parameter (like 'H') Output: The output for the cmd, when no explicit cmd is specified this will be the DFS default for the corresponding LSN, usualy a display of that sector(s) in an appropriate format. FIXBOOT = Recover NTFS bootsector from the spare-copy (saved by format) Purpose: Fix corrupted bootsector for an NTFS partition Parameters: none Output: Progress and confirmation info Remarks: This will locate the copy of the bootsector saved by format, and when found copy it to the bootsector location (sector 0) The partition-table info (type and size) must still be valid! MFT = Translate and display 'this' LSN as an MFT record nr Purpose: Calculate and display the MFT-record number from current LSN Parameters: none Output: The mft-record number, or 0xFFFFFFFF when not in an MFT record MFT [mft-recnr] = Calculate LSN for MFT record-nr and perform a default display Purpose: Display a sector, probably an MFT-record, by specifying its MFT number. The logical sector-number is based on the MFT-0 pointer in the boot-record an a calculated sectors-per-mft. Parameters: mft-recnr The record number for the MFT record 0 is the first MFT, regarding the MFT itself Output: Display of the MFT record contents, or an error message MIR [mft-recnr] = Calculate LSN for MFT-mirror record-nr, do default display Purpose: Display a sector by specifying its MFT number as an index in the MFT-mirror area. (effect as 'MFT' command) Parameters: mft-recnr The record number for the MFT record Output: Display of the MFT record contents, or an error message Remarks: The MFT mirror area only contains a subset (usually 16 records) The main purpose for the MFT mirror is as a backup for the important (system) files like the MFT and root directory. MFTEXT = Find all external MFT records (continuation for base-MFT) Purpose: Quickly find all MFT records that are continuations for others Parameters: none Output: Standard find-progress, and one line per hit Remarks: Continuation MFT records link back to the base-MFT, this link will be recorded in the 'up' shortcut. (command 'u') From the base MFT-record, the first external continuation MFT will be recorded in the 'xtra' shortcut (command 'x') Existence of a continuation record is a sure sign for very heavy fragmentation of the file in question. NTFS remarks: Date and time-information in the NTFS filesystem is stored as a time-offset in units of 100ns starting at 1st of januari 1601. It is a 64 bit number. The date and time is stored as a Universal Coordinated Time (GMT) and displayed as such by DFSee. If you want timestamps to correspond to your local timezone, you can set the 'TZDFSEE' environment variable to a signed number of minutes, being the offset to GMT. Command reference, HPFS specific commands ----------------------------------------- Active filesystem : HPFS, specific commands are: \path-spec = find and show file/directory relative to root (see find) ALLOC [+] = Show data-band allocation bitmaps, compact or [+] verbose ALBIT a [lsn s] = Set/reset allocation bit in bitmap for lsn-range AUTOBASE [t][l] = find the start of an HPFS partition by searching sectors of types [t], default 'spad'; [l] is last valid sector BITMAP [xx,s,D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format CA [lsn][opt] = Check Allocation integrity for (current) fnode lsn CHECK [drive] = Check filesystem integrity for drive-letter (CHKDSK) DELFIND [s] [o] = Find deleted files, name start with [s], using options [o] DIRMAP = Show directory band allocation and usage map FINDROOT [n] = find the Root directory without using the superblock starting the search at LSN [n] FIXBOOT = Create HPFS bootsector from template and partition-table FIXBS [clear] = Update bad-sector table with LSN's from DFS badsec-list FIXCP = Update superblock with found LSN for codepage info FIXCS = Calculate checksums and write super- and spare-block FIXROOT = Update superblock with found LSN for root-directory GETBS = Read HPFS bad-sector table into DFS badsec-list PATH [n] = Show all path-components for current fnode, upto root For an up-to-date list of commands, use the '?' command HPFS specific sector types (see ??? command) 'I' = File data 'E' = EA data 'A' = ACL data 'B' = Boot area 's' = HPFS superblock 'p' = HPFS spareblock 'H' = Hotfix table 'h' = Hotfix data 'x' = Bad sector-list 'X' = Bad sector 'S' = Spare dirblocks 'D' = Directory Fnode 'y' = Deleted Dir Fnode 'f' = File Fnode 'z' = Deleted FileFnode 'a' = Allocation block 'Z' = Deleted All-block 'd' = Directory block 'P' = Dir-band (free) 'Q' = Dir-band bitmap 'c' = Codepage info 't' = Codepage data 'i' = HPFS386 User-id 'm' = Bitmap Tables 'M' = Bitmap data For an up-to-date list, use the '???" command AUTOBASE [t][l] = find the start of an HPFS partition by searching sectors Purpose: Force a different partition start sector-nr for HPFS partition Parameters: t One or more sector-types to use in the search default is "spad", Super, Spare, Alloc and Dirblock f for fnode can also be used but is less reliable sl Sector-number to use as end for partition (optional) Output: Search progress and final result when HPFS partition found Remarks: Can be used if start of partition / partition-tables are bad Use the "fs hpfs" command first to force HPFS mode. ALLOC [+] = Show data-band allocation bitmaps, compact or [+] verbose Purpose: Show usage and the distribution of data over the volume. Parameters: none Output: A single bitmap-graphic for the entire volume or for each allocation-band when verbose format is selected Remarks: System-reserved and Directory-band are indicated with 'S' and 'R' respectively. Other area's are filled in according to the degree of usage (allocation) DIRMAP = Show directory band allocation and usage map Purpose: Show usage of the pre-allocated directory-band Parameters: none Output: A single bitmap-graphic showing the allocation of the pre-allocated directory band. Remarks: If 100% is allocated more directory information will be allocated elsewhere on the volume. BITMAP [xx s D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format Purpose: Show a bitmape located at specified LSN, alloc or DIR format Parameters: xx mandatory LSN of a bitmap sector s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 4 sectors (default bitmap size) D optional Directory-format flag Output: One bitmap-graphic for the specified bitmap LSN. Remarks: Specifying an LSN that is not a bitmap-LSN will result in a garbage bitmap display. ALBIT a lsn s = Set/reset allocation bit in bitmap for lsn-range Purpose: Manualy set or reset allocation bits in the bitmap Parameters: a mandatory 's', 'a' or '1' will set to "allocated", others will set to "free" state. lsn optional Start LSN for the range, default is 'this' s optional size for the LSN-range, default is 1 Output: none Remarks: This is a potentialy dangerous operation. \path-spec = find and show file/directory specified by path-spec Purpose: Locate the fnode for a known file- or directory Parameters: path-spec full path specification with no intervening space after the '\' command character or absolute- or relative path specification with an intervening space. If the path does not start with a '\' it is relative to the current directory (see CD cmd). Output: Searchlist starting at the ROOT directory upto the requested file or directory. It is either followed by an error message if the path-spec was not found or by the display of the corresponding fnode information. Remarks: The search algorithm depends on the ROOT fnode being known. When the superblock is corrupt this fnode can be resolved using the 'findroot' command. PATH [n] = Show all path-components for current fnode, upto root Purpose: Show the directory-branch that contains current file/dir Parameters: n optional Start LSN for the search Output: One line for each found 'parent' directory, upto the root Remarks: CA [lsn][opt] = Check Allocation for (current) fnode lsn Purpose: Check allocation integrity for current fnode Parameters: lsn optional LSN of the fnode opt optional Options: v = Verbose, show progress Output: Σ Start of an allocation-sector (heavily fragmented) » Start of one file-extent (fragmented file) · One sector, green small dot is allocation OK ■ One sector, red big dot is allocation error Also a summary is given with the number of (failed) sectors Remarks: Fnode maybe for a regular file (sectors must be ALLOCATED) or for a deleted file (sectors must be FREE) FINDROOT [n] = find the Root directory without using the superblock Purpose: Find the fnode for the ROOT directory, even if parts of the volume, including the superblock, are damaged. Parameters: n optional Start LSN for the search Output: Search-list starting at the first fnode encountered upto the fnode for the ROOT directory when found. Remarks: Specifying a startlsn might be needed if reading at the start of the volume results in device errors, or if some fnodes in the sequence are corrupted. FIXROOT = Write the root-LSN found with the 'findroot' command back Purpose: Fix bad Root-LSN pointer, after CHKDSK bugs or other corruption Parameters: none Output: none Remarks: It is better to lock the physical disk before writing to it FIXBOOT = Create HPFS bootsector from template and partition-table Purpose: Fix corrupted bootsector for a HPFS partition Parameters: none Output: Progress and confirmation info Remarks: This will create a valid bootsector based on WARP version 4 bootsector code and size-info from the partition table. Only the bootsector is written, to make the partition boot properly, it might be needed to run 'sysinsx' afterwards The partition-table info (type and size) must still be valid! FIXCP = Write the CodePage-LSN found with the '0#f c' command back Purpose: Fix bad CodePage-LSN pointer Parameters: none Output: none Remarks: It is better to lock the physical disk before writing to it FIXBS [clear] = Update bad-sector table with LSN's from DFS badsec-list Purpose: Replace the internal HPFS bad-sector list with the DFS bad-sector list, or clear the liste completely. Parameters: clear optional Make internal and DFS bad-sector list empty Output: none Remarks: The list can be the result of the "scan", "getbs", "mem" or "import" cmd, allowing modification off-line with an editor. The OS/2 chkdsk command will give erronous results on "reserved for system use" until the next reboot. It is better to lock the physical disk before writing to it See 'lock' and 'unlock' commands GETBS = Read HPFS bad-sector table into DFS badsec-list Purpose: Replace the DFS bad-sector list with the internal HPFS one Parameters: none Output: none Remarks: none CS = Calculate HPFS style checksum on last-read sector Purpose: Show / check checksum on HPFS sector (super/spare) Parameters: none Output: Checksum value Remarks: Only meaningfull for superblock (10) and spareblock (11) These checksums are also stored by HPFS in the spareblock. FIXCS = Calcualte checksums and write super- and spare-block Purpose: (re)calculate the checksum for superblock and spareblock and write them both back to the disk Parameters: none Output: none Remarks: none SAVETO [dir][l] = Save filedata connected to (current) fnode to a file Purpose: Recover a file if the fnode can still be found, by making a low-level sector-by-sector copy of its data to a new file. (basic functionality to be used for undelete operations) Parameters: dir optional Path to save the file copy, default a:\ l optional LSN of the fnode of the file to recover default is the current LSN (This) rename optional new name for destination file, allowing long-filenames to fit 8.3 names (floppy) Output: Progress is reported with output like the "ca" command, error messages will be given as appropriate Remarks: Only the file contents is recovered, date&time and attributes are lost. On HPFS EA's are recovered as well. If no directory is specified it will default to the last directory given, or "A:" when it is the first time If the directory does not exist it will be created Make sure that this is on a DIFFERENT drive, otherwise it might overwrite the data you are recovering or still need to recover later. DELFIND [s] [o] = Find deleted files, name start with [s], using options [o] Purpose: Find deleted files, with name starting at current LSN Parameters: s optional shortname, first part of filename wanted o optional options ! = fastest but silent search Output: Find-result list (as "find* z") on screen and in memory Remarks: List can be manipulated as usual, best viewed with "delshow" Diagram of an example HPFS structure Basic HPFS data-structure for Root-directory with AUTOEXEC.BAT, README file, an OS2 subdirectory and lots of other files. The README file has it's data allocated in 2 alloc-chunks. ╔═════════╗ ╔══════════════════╗ ╔═══════╗ ║SUPER ║ ┌──>║ DIR block ║ ┌──>║ FNODE ║ ║ ║ │ ║ ║ │ ║ ║ ║ ║ ╔═══════╗ │ ║┌────────────────┐║ │ ║ ║ ╔══════════ ║Root LSN ────>║ FNODE ║ │ ║│*Special**Start*│║ │ ║ ALLOC ──>║ DIR block ╚═════════╝ ║ ║ │ ║│entry FNODE LSN│║ │ ╚═══════╝ ║ ║ ║ │ ║│BtreeDownPtr LSN│║ │ ║┌───────── ║ ALLOC ──┘ ║└────────────────┘║ │ ║│8514.RC ╚═══════╝ ║┌────────────────┐║ │ ║│entry FNO ║│OS2 (subdir) │║ │ ║│BtreeDown ║│entry FNODE LSN├────┘ ║└───────── ┌─────────────────────────────┤BtreeDownPtr LSN│║ ║┌───────── │ ║└────────────────┘║ ║│ANSI.EXE │ ║┌────────────────┐║ │ ║│Special-end │║ │ ╔══════════════════╗ ║│entry FNODE LSN│║ ╔══════════════════╗ └─>║ DIR block ║ ║│BtreeDownPtr LSN├───────>║ DIR block ║ ║┌────────────────┐║ ║└────────────────┘║ ║┌────────────────┐║ ║│*Special**Start*│║ ╚══════════════════╝ ║│*Special**Start*│║ ║│entry FNODE LSN│║ ║│entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ ╔═══════╗ ║│BtreeDownPtr LSN│║ ║└────────────────┘║ ┌─>║ FNODE ║ ║└────────────────┘║ ║┌────────────────┐║ │ ║ ║ ║┌────────────────┐║ ║│AUTOEXEC.BAT │║ │ ║ ║ ╔═══════════ ║│PP... filename │║ ║│entry FNODE LSN├───┘ ║ ALLOC ──>║┌────────── ║│entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ ╚═══════╝ ║│ 1st data- ║│BtreeDownPtr LSN│║ ║└────────────────┘║ ║└────────── ║└────────────────┘║ ║┌────────────────┐║ ║┌────────────────┐║ ║│OS1.. filename │║ ║│README filename │║ ║│entry FNODE LSN│║ ┌───────────────────────────┤entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ │ ║│BtreeDownPtr LSN│║ ║└────────────────┘║ │ ║└────────────────┘║ ║┌────────────────┐║ │ ║┌────────────────┐║ ║│**Special**End**│║ │ ║│XXX... filename │║ ║│entry FNODE LSN│║ │ ║│entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ │ ║│BtreeDownPtr LSN│║ ║└────────────────┘║ │ ║└────────────────┘║ ╚══════════════════╝ │ ║┌────────────────┐║ │ ║│**Special**End**│║ │ ║│entry FNODE LSN│║ │ ║│BtreeDownPtr LSN│║ │ ║└────────────────┘║ │ ╚══════════════════╝ │ │ ╔════════════════════════╗ │ ┌───>║┌──────────────────────┐║ │ │ ║│ 1st data-sector │║ │ │ ║└──────────────────────┘║ │ │ ║┌──────────────────────┐║ │ ╔═══════╗ │ ║│ 2nd data-sector │║ └─>║ FNODE ║ │ ║└──────────────────────┘║ ║ ║ │ ╚════════════════════════╝ ║ ─────┘ ║ ALLOC ║ ╔════════════════════════╗ ║ ─────────>║┌──────────────────────┐║ ╚═══════╝ ║│ 3rd data-sector │║ ║└──────────────────────┘║ (c) 1995 ║┌──────────────────────┐║ J. v. Wijk ║│ 4th data- Examples of DFS usage --------------------- 1) Resolve original name of FILExxxx.CHK files (created by CHKDSK) When CHKDSK recovers files it will place in a FOUND.xxx directory in the root-directory. This directory contains one or more recovered files with names like FILE0001.CHK The original name of the file is still in the Fnode, it can be shown using the following dhpfs commands (assuming drive c:) : Command Explanation DFS disks Start DFS and scan physical disks part id Select partition 'id' (must be HPFS) \found.000\file0001.chk Search and display Fnode for .CHK Now 15 characters of the original name are shown as "Fnode Name String" 2) Show freespace area's (HPFS) "slt $" 3) Undelete a file; Find the fnode using: "find z" find the next deleted fnode "find z shortname" next deleted named shortname (case-sensitive) "find$@ z shortname" next deleted named shortname (case-insensitive) Add a '*' to the find command to do a repeated search (see 'find' cmd) Use "saveto" command to copy the data for the deleted file to a directory. Notes: - It's best to use a different drive to avoid overwriting 4) Save and restore (parts of) a disk The "sim" command can be used to save a complete disk, including partition information to one (very large!) file on a different (network) drive. The save the entire unit (opened disk/partition or volume) use: "sim img-name 0 $" It can be restored using the "wrim" command, if and only if the destination disk has exactly the same geometry as the source disk (heads, sectors cyl). This could be used to clone one workstation to multiple machines. 5) List all "undeletable" files Find the FNODES for possibly deleted files using "find* z" or for specific files: "find*$@ z shortname" Now list them, including PATH and recovery reliability using: "list f+f" Or list just a subset using any combination of wildcards: "list f+f *\testdir\data?.txt Use the .NNN command to select a file to undelete, and then use the "saveto [destination-path]" command to actualy undelete it. ==> use the "delfind", "delshow" and "delsave" to work on multiple files 6) Update the bad-sector list with the results of a DFS-scan Find all sectors that are unreadable: "scan" Optionaly: list, export/modify/import the resulting bad-sector list "list +f" (list, including PATH if sector is Fnode) "export b badguys" (Place in an ASCII file badguys.lsn) Now edit it off-line, save as 'modified.lsn' "import b modified" Now replace the internal bad-sector list with the new modified one: "fixbs" 7) Save a list of currently deleted files on an HPFS volume: Find deleted files (could take quite a while!): "find* z" Save the deleted-Fnode LSN's in a file: "export deleted" Optionaly, also save PATH info and recovery chances using a logfile: "log deleted" "list f+f" "log" - This will result in a (possibly large!) deleted.log with one line per deleted file with size, recovery percentage and PATH+filename 8) Show the list of free diskspace area's for HPFS volumes "slt $ a" 9) Show all detected anomalies in the SLT (like allocation errors) "slt * * * +" 10) Display the FAT for a diskette in drive A: "dfs vol a" "fatshow" 11) Display the FAT Root-directory for partition C: "dfs part C" "root" 12) Save the master-boot-sector on a different PC connected with a parallel laplink cable and running the LPT tool (see www.fsys.demon.nl): "dfs disk 1" "sim [lpt.exe]d:\images\mbr.img 0 1" 13) Restore the master-boot-sector from a different PC connected with LPT: "dfs disk 1" "wrim [lpt.exe]d:\images\mbr.img 0 1" 14) Collect information to perform a manual un-fdisk (find all boot sectors): "log unfdisk" "disk 1" "find* erb" "list +d" "export unfdisk" 15) Recover a 'lost' NTFS partition where the boot-sector is damaged and the partition is not recognized by NT anymore (assuming 3rd partition): "part 3" "fs NTFS" "fixboot" 16) Automatically FDISK a workstation using a batch- or command-file like: echo DFSee FDISK generic workstation > dfsfdisk.log dfsdos fdisk! newmbr 1 clean dfsdos fdisk! create primary bmgr dfsdos fdisk! startable 1 dfsdos fdisk! create logical fat 6 1 -1,c MAINT dfsdos fdisk! create primary hpfs * 1 +0 WARP This will create a disk with bootmanager (image prepared with DFSIBMGR) a small maintanance partition at the end of the disk minus 1 cylinder and a primary partition filling the rest of the disk. 17) Automatically FDISK a server-machine using a batch- or command-file like: echo DFSee FDISK RAID server > dfsfdisk.log dfsdos fdisk! newmbr * clean dfsdos fdisk! create primary bmgr dfsdos fdisk! startable 1 dfsdos fdisk! create primary hpfs 300 1 0 SYSTEM dfsdos fdisk! create logical fat 200 1 dfsdos fdisk! create logical hpfs * 1 0 RESTORE dfsdos fdisk! create logical hpfs * 2 dfsdos fdisk! create logical fat * 3 dfsdos fdisk! setboot 0:SYSTEM dfsdos fdisk! setboot m:advanced Known limitations and bugs -------------------------- - There is only recognition for BeFS, the BEOS journalling filesystem - There is recognition for NTFS, and most of the MFT record display - FAT32 is implemented and tested using Henk Kelders OS2FAT32.IFS, no support for the special OS2FAT32 EA's is there yet. - Allocation integrity checks do not check the allocation for EA's - Accessing (large ?) partition using the 'vol' command in the DFSDOS version seems to be unreliable. Wrong data is sometimes returned. On a diskette (vol a:) everything seems to be OK, so I recommend using only the 'part x' command for accessing hard-disk partitions and use the 'vol' command only for floppies. (DFSDOS restriction only) - LZW compression on the SIM/WRIM commands does not work yet in combination with the (OS/2 only) LPT tool using I/O through a named-pipe. - LZW compression seems to be UNRELIABLE on large images! - Automatic reboot (in SETBOOT) doesn't work with DFSDOS and Win9x Considered improvements ----------------------- Rewrite of this documentaion in a description, command-reference and technical info on filesystems (possibly in HTML) More automatic detection of inconsistencies (like CHKDSK, FST, HVA, CHKPART) This will show HPFS problems like CHKDSK does, but in more detail and maybe some more types of inconsistencies. Real coverage of other file-systems besides HPFS like FAT, EXT2, NTFS ... VFAT date/time info and long filenames added in ver 2.56 FAT32 functionality added/fixed in ver 2.65 NTFS functionality expanded in version ver 2.80 Generic edit and write capability, This will allow recovery operations without using other (third-party) utilities. The user interface needs to support screen-editing for this. Note: Some write enabled commands have been implemented starting with 1.90 Improved volume/disk locking implemented in version 2.25 Basic edit and write capability added in version 2.50 Writing to a 'volume' and from the DFSDOS version in 2.55 Recovery for missing/damaged bootsector resulting in FDISK display of "unformatted". (Note: implemented for HPFS and NTFS as of 2.82) Recovery for a 'quick format' on HPFS (unformat) Recovery for repartitioning (un-fdisk) Save and restore complete partitioning schemes using diskarea's or diskette LINUX version, port being investigated, low priority. More FDISK and some FORMAT capabilities, creating FAT or HPFS partitions This will allow unattended, batch-like installation procedures to be started from DOS diskettes. FDISK query command(s) to determine disk-sizes, nr-of-partitions etc. from the command-line or a batch-file (in RC / errorlevel) Save and restore complete partitioning info to/from a file or harddisk area. More complete Logical Volume Manager support (LVM) and support for the Journalled File System (JFS) for OS/2 Warpserver for e-bussines (Aurora)