DFSee version 11.0 21-12-2011 (c) 1994-2011: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Global program switches = Switches for DFSee startup Summary of commands = summary Command reference = reference of general DFS commands _______________________________________________________________________________ G L O B A L P R O G R A M S E T T I N G S: _______________________________________________________________________________ The DFSee program has quite a few global settings that control the behaviour of various parts of the program. They all have default values that can be overruled by specifying one or more 'switches' as specified below. The switch character for dfsee switches is '-' or '/'. All single letter switches are case-sensitive. Long switchnames like 'query' that do not have single letter abbreviations are not case-sensitive. When using "expanded" versions of single-letter switches, e.g. '-related', instead of '-r', they are still case sensitive. [global-dfsee-switches] [DFSee multi-command] -123[t][s][l][r][dxx] = trace level 123, [t]stamp; [s]creen; No [l]ogging;" [r]e-open [d]elay xx ms per line", -? = help on DFSee command line switches (this text) -7 = use 7-bit ASCII only (no 'graphic' characters) -$- = no variable/expression substitution in commands (SET var) -a = switch off usage of ANSI escape characters for color -A:nr = number of sector read attempts, default 1 (no retries) -b = batch option, automatic 'batch on' command at startup -B- = suppress the version/copyright banner on DFSee startup -c:[1|2] = CHS dummy style: 1=PQMagic, 2=MS, default 0=IBM/DFSee -dir:progpath = Explicit program install path to find key and scripts -d- = do NOT add the physical disks to devicemap at startup -d:[max] = show at most 'max' physical disks at startup (mounted) -D:letter = linux device letter, default is IDE, use 's' for SCSI -e[-] = include or suppress (-e-) command echo before each cmd -E:[c|i|q] = default error strategy Confirm, Ignore or Quit -f[-] = force or suppress border frame on text window and desktop -g = Display specific information to STDOUT only (Engine mode) -G = Display progress percentage to STDOUT only, every second -geocalc- = Do NOT calculate disk geometry from contents, use OS geo -h:[1|2|3] = PTE use hex SN+Size fields (1), CHS fields (2) or both (3) -H = Set default input radix for SECTOR and TYPE values to HEX -H:mask = Set HEX input radix for selected classes (see dfscmds.txt) -F- = no auto-Fail critical errors, use Retry pop-up (DOS only) -I[-] = use standard-Int13 when BIOS #cyl is below 1024 (DOS only) -I- = use standard-Int13, avoid ext-int13 check call (DOS only) -i- = do not ignore lock-errors, with extra pop-up, (OS/2 only) -L- = do not use large-file for > 2 GiB file support (OS/2 only) -l:logfile = start logging immediately to 7bit ascii file 'logfile.log' -l- = do NOT present dialog at startup to start logging to a file -m[:autoshow] = use 'map' or user defined cmd for 'autoshow' in FDISK mode -menu- = do not start the menu at startup, start on the commandline -menu:letter = startup with menu dropdown indicated by 'letter' activated -M:[0:1:2:3] = menustyle: 0=default, 1=no submenu right, 2=no auto drop -mouse = force display of OS2 mouse cursor in full-screen session -mouse- = do not react to mouse actions, disable mouse completely -O:[n|v|q|m] = default output verbosity Normal, Verbose, Quiet, Maximum -p = pedantic, allow all warnings and more low level details -P- = don't use prompting and input dialog windows by default -Q[-] = quit or do NOT quit automatically after last command -q = quiet option, automatic 'screen off' command at startup -query = execute a query command with logfile, quit automatically -r:regfile = registration filename with optional path and extension -R = start in Read-only operation, no write back to disk/volumes -S = shell mode, do not allow quit from DFSee (use as OS shell) -s:separator = specify a command separator character, default is '#' -synclvm = Try to synchronize LVM Engine on driveletter changes (OS2 only) -t[-] = include or suppress (-t-) timestamp before each command -simulate:nnn = simulate a BAD-SECTOR error on every modulo 'nnn' PSN read -skipfs:name = skip filesystems of type 'name' when matching driveletters -screen:WCxR = explicit size as Cols x Rows, like W80x25 or W120x39 (Linux) -scheme:name = window scheme: grey|3d|nobl|cmdr|half|full|white|black|dfsee -color:value = output colors, 0..7 add any: 0=std 1=invert 2=bright 4=blue -style:value = line style, 0..3: 0=std-double 1=3d 2=halfblock 3=fullblock -V- = Do NOT refresh the volumes list when starting a file-dialog -w[-] = force or suppress windowing, using a command line instead -W or -W:[sl] = screen resize prompt when scroll bars visible, or > [sl] lines For help use the '?' and '??' commands, use the key or read DFSCMDS.TXT Additional customizing, by running of some initial commands, can be done by creating an ASCII file called 'profile.dfs' in the same directory as the DFSee executable (or somewhere in the PATH). For an example, see the TEMPLATE file 'proftemp.dfs' in the distribution. You can customize that, and rename it to 'profile.dfs' to be used with DFSee. It can also be included in your own DFSee CDROM (See readme.txt with ISO) The default number base (radix) for parameter and input values is DECIMAL, but can be overruled using the '0x' prefix to force them to HEXadecimal. (values that contain any of the 'A' to 'F' digits are considered HEX too) Also, you can change the default to be HEX for all SECTOR-number and partition-TYPE values by using the startup-switch '-H'. You can set specific value 'classes' to default to HEX using '-H:mask' or the set command 'set radix mask-value' where the mask value is the addition of any of the following: 1 = standard / rest 2 = postfixed ,s values (sectors, like 123,s) 4 = postfixed, other units (like 456,m) 8 = DFSee sector values like start and end location 16 = DFSee size values like a wipe, clone or image size 32 = DFSee partition type values Note: Before version 9.11 the default radix 'mask' in DFSee was 42 = 0x2a, meaning all sector and type releated values would default to being HEX. _______________________________________________________________________________ G E N E R I C C O M M A N D O P T I O N S: _______________________________________________________________________________ Many of the DFSee commands accept options, a '-' sign plus a letter and an optional value that are specific to that command. There are a few options however that are implemented on a generic level and work for ALL commands: -B or -B- = Batch mode (no confirmations etc) or disable batch mode -E:[c|i|q] = error strategy : Confirm, Ignore or Quit -O:[n|v|q|m] = output verbosity : Normal, Verbose, Quiet, Maximum -P or -P- = use or don't use prompting and input dialog windows -Q or -Q:3 = Quiet screen mode, turn screen off while executing command -Q:2 or -Q:3 = Quiet log mode, turn logfile off while executing command -X- = Do NOT set next sector to the MFT/Fnode/Inode/Fat file data -l- = Do NOT create new list when displaying (directory) data -trace[-] = Explicitly switch tracing on or off for this command _______________________________________________________________________________ S U M M A R Y O F C O M M A N D S: _______________________________________________________________________________ The user interface has a choice of using the menu-system (default) or the command line with a command entry-field plus history buffer so previous commands can be recalled. Output will be displayed to the screen in a large output buffer that can be scrolled up and down using plus arrow keys. You can switch between the menu and command line using the key. Output can also be copied to a file for later analysis. When using the menusystem, you don't need to know the actual command syntax, although most menu-selections will be translated to a corresponding command before being executed. DFSee commands are single words or (hexadecimal) numbers. Most commands have one or more parameters of which some are optional. DFSee keeps track of the current SN and some other useful SNs so they can be referenced faster, without having to type them in. They are: Name Cmd Description ---- --- ----------- up 'u [st]' up in hierarchy, as specified sector type down 'd [st]' down in hierarchy, as specified sector type down down in hierarchy this 't [st]' this (current), as specified sector type xtra 'x [st]' Extra or alternative, as specified sector type forward 'f [xx]' the next sector, or xx sectors forward backward 'b [xx]' previous sector, or xx sectors backward The [st] values are the single character sector types as displayed using the '???' command, or the 'Help -> Available sector types' menu. You can display and analyse either a physical disk, a partition, a volume or an imagefile. A physical disk can be opened using the 'disk' command. A disk-partition or volume needs to be opened first with the 'part' or 'vol' commands respectively. The following prompt will show some status info. After opening an HPFS partition, using 'Enter' a few times will take you to the superblock, root directory, possible sub-directories up to some file. Multiple commands can be chained if separated with a special character, the default is '#' but this can be changed with the 'sep' command. An overview of the available commands is given below, it can also be referenced from within the program using the 'help' command. HINT: When using DFSee to create a logfile, DO NOT USE ">" REDIRECTION, use the DFSee "log filename" command or the "-l" program switch instead. This will prevent littering the logfile with ANSI control codes. When browsing an LVM (WSeB, MCP or eComStation) system, set the screen width to over 100 characters when possible. This will allow complete display of the volume + partition names in the 'part' table _______________________________________________________________________________ A list of selection commands (output of the 'help' command) _______________________________________________________________________________ DFSee basic selection commands, use '??' for other generic commands For help on the command line switches (to the EXE) use 'DFSxxx.EXE -?' Batch mode can be forced with the '-B' option on the cmd as in 'FDISK -B' Any command not recognized will be passed to the Operating System The DISK, FDISK, PART and VOL commands can select a specific mode which makes more specific commands available, use '?' and '???' for details mcs-number = Analyse & display sector, SN using mcs-number sector LSN ? or /? = Show current FS (mode), specific commands and help info ?? = Show list of all generic commands with short description ??? = Show all recognized sector types for current filesystem (listed for generic ones and most filesystems further down) , u, x = Show next with , up with 'u' or extra LSN with 'x' _______________________________________________________________________________ A list of generally available commands (output of the '??' command) _______________________________________________________________________________ .NNN = Display numbered FS-entity marked .NNN from sector list A|a SSN [size] = ASCII-dump (half)sector, at SSN, 'size' sectors or bytes ABOUT = Show version and registration information for DFSee/TPlib ALLOC [options] = Display allocation map in various size, show RESIZE limits BASE [options] = Show (and set) base start and end values in several ways BATCH [on |off] = Set batch mode, no confirmation or locking-error reporting BPS SectorSize = Force sector size to specified value (decimal, bytes) BSFIND [type][a] = Find MBR/EBR/boot/LVM-sectors, on cylinders or ALL sectors CD [path] = Change current directory and current drive CL = Translate and display 'this' LSN as a cluster nr CL clust [cmd] = Translate cluster number to hex LSN, display with cmd CL2S clust = Translate cluster number to hex LSN, display LSN value CHECK [dr/nr] = Report all detected filesystem errors using SLT info CHS c h s = Analyse & display sector, using CHS (cylinder head sector) CLONE [options] = Copy sectors from other (disk/part/vol) to current store CMD [command] = Force execution of command by Operating System, not DFSee COMP [options] = Compare sectors from other (disk/part/vol) to current store CONFIRM [-y] msg = Show a notification, or a confirmation message [-y] CS [sn] [-v:cs] = Calculate 32-bit checksum for sector, optional verification DELSHOW [sel] = Show delfind list, with selection wildcard and threshold DFSCHECK[part|*] = Run dfsXXXX analysis for one or all partitions => DFS*.P* DFSDISK [disk|*] = Run DFSDISK analysis for one or all disks => dfsdiski.* DIRFIND [l][dir] = Put [l] levels of filenames from [dir] in the sector list DISK [disk-nr] = Select a physical disk and show the MBR, [-r] = reset geo DISPLAY = Show current display size in rows and columns EDIT [-a -h -u] = String replacement edit, using Ascii, Hex or Unicode string EDIT [options] = Start HEX sector-editor on current or specified location EDIT filename = Start HEX sector-editor on specified file (binary edit) EXPAND [options] = EXPAND FS to a new LARGER size, incl. Part-table update EXPORT [fn] = Export LSNs in the sector list, to file [fn] FDISK [FdiskCmd] = Activate the FDISK fs (mode) and optionally execute cmd FI [SSN] = File information on specified symbolic-SN, default 'this' FIND options [s] = Find sectors based on options, and optional string [s] FINDPATH path = Find and show file/directory specified by path-spec FIXBOOT [opts] = Fix a filesystem bootsector, FAT(32), HPFS, NTFS, JFS FIXPBR [options] = Fix HiddenSectors and Geometry bootsector to match p-table FS fsys-name = Force analysis mode for filesystem 'fsys-name' GB [distance] = Go backwards 'distance'; an mcs-number, default is 1 sector GF [distance] = Go forward 'distance'; an mcs-number, default is 1 sector GEO ?|c h s f b = Set/Display specified geometry on opened object, ?=adjust HELP [*] = Show list of generic commands with short description H|h SSN [size] = Hex-dump (half)sector, at SSN, 'size' sectors or bytes ID [ SSN | -L ] = Identify 'this', specified SSN or LAST sector, using SLT IM [file | dir] = Open a file with a FS-image (.img) for display & analysis IMAGE file [opt] = Save an object to imagefile(s) using specified options IMZ2RAW imz raw = Create uncompressed (RAW) image from an IMZ compressed one IMPORT [fn] = Import LSNs to the sector list, from file [fn] LIST [opt] [str] = Display LSNs in the sector list, using options/string LOCK = Lock physical disk or logical partition to avoid conflicts LOG [file | .] = Start, stop or resume logging, (appending) to a file MAP [disknr opt] = Display graphical map of partitions on a disk MEM lsn [pos] = Store sector number LSN in the sector list at [pos] MENU [pd-letter] = Activate the menu, opening default or selected pulldown MODE [c,r] [-w-] = Set columns and rows for display, -w- is non-windowed MOVE -b|-e | -f = Move towards Begin or End, or move/copy to Freespace area PART [pid|drive] = Show partitions, or select one using nr or drive-letter PRITEMS x [name] = Set number of items/passes for the progress indicators PSN xx = Analyse & display sector xx, using physical sector number PT [*|pid|drive] = Display partition table for all, current or specified part PTE [xx | pid] = Show & edit partition table at sector [xx] or part [pid] QUERY item [n] = Query specified item value for disk/partition/freesp [n] RAW2IMZ raw imz = Create a compressed imagefile (IMZ) from a RAW image file REPEAT [command] = Repeat a (multi) command string, counted or forever ... RECOVER path sel = Recover files from sector list to a path, using selection RESIZE [options] = RESIZE FS to a new SMALLER size, incl. Part-table update RESTORE file = Restore an imagefile to the currently selected object RUN [script] [p] = Run a DFSee script, with optional parameters and options S2CL lsn = Translate hex LSN to hex cluster number and display that SAVETO [d][l][n] = Save filedata for current file to new file, optional rename SCAN [wr [NoId]] = Scan bad sectors; use read/Write verify; No automatic id SCL clsize = Force cluster size to specified value (decimal, sectors) SCRFILE [fn] [l] = Save screen buffer to file [fn], last [l] lines SERIAL [serial] = Set new Volume serial Number in the bootsector for a FS SET [prop value] = Set DFSee property to a value, 'SET' lists all properties SHIFTL [options] = Shift data inside sectors towards beginning (aka LEFT) SHIFTR [options] = Shift data inside sectors towards the end (aka RIGHT) SLEEP [seconds] = Sleep for specified number of seconds, default is 1 SLT [p [s]][opt] = Display Sector Lookup Table at index 'p', showing 's' lines SLT2LIST [opts] = Add (selected) sectors from the SLT to the sectorlist SORT [-d] [-u] = Sort sector list; [-d] = descending [-u] = no duplicates STORE [letter] = Select store to be the current store; or display stores SYNCLVM vol [dr] = Sync LVM engine to use [dr] letter for volume, or HIDE it t [sector type] = Display 'this' sector as Hex or specified sector type TRACE [lvl-opts] = Set trace level/options for DFSee functional tracing TRANS [-type] xx = Translate and display value 'xx' as Lsn, I13, CHS and PSN TXDIR fn [o] [a] = List files for wildcard selection 'fn' and several options u [sector type] = Display 'up' sector as Hex or specified sector type UNLOCK = Unlock physical disk or logical partition VOL [drive] = Show all volumes, or select one using drive-letter WIPE pat [f s] = Wipe disk/vol/part area with pattern at LSN [f], size [s] WIPEFREE [part] = Wipe freespace in a filesystem to all zeroes (wipe -f) WIPELST [sel][p] = Wipe [sel]ected sectors in list with specified [p]attern WIPESECURE [-f] = Wipe disk/vol/part area in a SECURE way (DoD spec, slow!) WRITE [ . | sn ] = Write sector back to current or specified sector number x [sector type] = Display 'xtra' sector as Hex or specified sector type q = Quit DFSee OS2: 8.01 04-04-2006 (c) 1994-2006: Jan van Wijk _______________________________________________________________________________ C O M M A N D R E F E R E N C E: _______________________________________________________________________________ SSN = Analyse & display sector, SSN is a Symbolic Sector Number, an mcs-number (see DFSTERMS.TXT) or one of the predefined: . = current sector t = current sector (this, Ctrl-T) d = down sector, depending on context (next, Ctrl-N) u = up sector, depending on context x = extra sector, depending on context Purpose: Display a sector in the most useful format Parameters: none Output: Sector display, format selected based on sector contents Remarks: The SN is specified as an mcs-number and can take many forms First digit needs to be 0..9 or a..f to avoid misinterpretation Prefixing the SN with '0' will avoid any conflicts. Examples: 3ec1 ;sector at 3ec1 (hex) 10 ;sector at 10 (hex) 0t10 ;sector at 10 decimal 150,c ;sector at cylinder 150 (decimal) 8,g ;sector at 8 GiB from start _______________________________________________________________________________ .NNN [id] = Display numbered FS-entity marked .NNN from sector list Purpose: Display one of the entries from the list last shown It can be applied on Directory as well as Allocation-lists The number (NNN) to use is displayed to the left of the list This is a decimal number with 1 to 5 digits. Parameters: NNN The zero-based decimal entry number to show id optional Identifier for LSN list (see list command) Output: Sector display, format selected based on sector contents _______________________________________________________________________________ ??? = Show all recognized sector types for current filesystem Purpose: Find out which sector types are known and supported in this mode Parameters: none Output: A list with generic sector types, followed by mode specific ones. DFS generic sector types 'I' = File data 'X' = Bad sector area 'H' = Unidentified data 'h' = Hex format data 't' = Text format data 'T' = DFSee compressed 'l' = LVM DLAT info sec 'L' = LVM BBR signature 'V' = LVM BBR V-deleted 'p' = LVM BBR drivelink 'P' = LVM BBR drv-table 'q' = LVM BBR badblocks 'Q' = LVM BBR bad-table 'r' = Master Boot Rec 'e' = Extended Boot Rec 'b' = Fsys boot sector 'n' = Non-std Boot Rec '2' = FAT32 2nd BootSec '3' = FAT32 3rd BootSec '6' = FDISK xF6 cleared 'R' = Fsys reserved sec '+' = any known type '*' = any sector '~' = No contents shown '@' = Free space '.' = End of Part/Disk! AUX specific sector types 'v' = VRAID phys device 'w' = VRAID devicetype1 'W' = VRAID devicetype2 EXT specific sector types 's' = EXT superblock FDISK specific sector types 'A' = MAC DDM, dr descr 'a' = MAC DPM, part map FAT specific sector types '1' = First FAT area '2' = Second FAT area '3' = Start 12-Bits FAT '4' = Start 16-Bits FAT '8' = Start 32-Bits FAT '\' = Root directory 'd' = Subdir, non-ROOT 's' = Subdir from ROOT 'D' = Directory data 'E' = EA data, attached 'A' = EA data. sf index HFS specific sector types 's' = HFS superblock HPFS specific sector types 'E' = EA data 'A' = ACL data 'B' = HPFS Micro-FSD 's' = HPFS superblock 'p' = HPFS spareblock 'U' = Hotfix table 'u' = Hotfix data 'S' = Spare dirblocks 'x' = Bad sector list 'f' = File Fnode 'D' = Directory Fnode 'y' = Deleted Dir Fnode 'z' = Deleted FileFnode 'a' = Allocation block 'Z' = Deleted All-block 'd' = Directory block 'P' = Dir-band (free) 'Q' = Dir-band bitmap 'c' = Codepage info 'C' = Codepage data 'i' = HPFS386 User-id 'm' = Bitmap Tables 'M' = Bitmap data JFS specific sector types 's' = JFS superblock 'f' = File Inode 'D' = Directory Inode 'y' = Deleted Dir Inode 'z' = Deleted FileInode 'g' = Aggregate Inode 'u' = Unused/BAD Inode 'a' = Data Btree+ Page 'd' = Dir Btree+ Page 'E' = EA data 'A' = ACL data 'G' = Pri Agg Inode Map 'm' = Sec Agg Inode Map 'i' = Sec Aggreg. Inode 'v' = Agg Inode map IAG 'w' = Fs1 Inode map IAG 'F' = Fileset Inode Map 'x' = Fileset Inode Ext 'S' = Pri Agg Inode Ext 'o' = Sec Agg Inode Ext 'M' = Block Alloc. Map 'C' = FSCK working area 'J' = Inline Log area 'B' = Micro-FS bootcode 'c' = Last-block slack NTFS specific sector types 's' = NTLDR, 1st sector 'f' = MFT regular File 'D' = MFT regular Dir 'm' = MFT 2ndary File 'M' = MFT 2ndary Dir 'y' = MFT deleted Dir 'z' = MFT deleted File 'd' = DIR filename INDX 'i' = SII security INDX 'S' = SDH security INDX 'j' = LOG restart Area 'J' = LOG record Page 'Z' = MFT Ghost record 'Y' = MFT empty record 'c' = Past last cluster REISER specific sector types 's' = RSR superblock XFS specific sector types 's' = XFS superblock SWAP specific sector types 's' = SWAP superblock _______________________________________________________________________________ Enter = down in hierarchy (Enter = down) Purpose: Display the next, most likely wanted, sector Parameters: none Output: Sector display, format selected based on sector contents _______________________________________________________________________________ A|a x [size [S]] = ASCII dump sector, SN x, size sect/bytes; force [S]ector Purpose: Display current or specified sector in ASCII (text) format Parameters: x optional LSN of sector to dump size optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 512 bytes for the 'H' command and 256 bytes for the 'h' command S optional Force size parameter to be sectors Output: Sector contents displayed as plain ASCII text _______________________________________________________________________________ ABOUT = Show version and registration information for DFSee/TPlib Purpose: Show details about the DFSee program like version and copyright Options: -c- Do NOT show the main DFSee program, just components -P- Do NOT present the info in a pop-up window -r Refresh cached information (like kernel revision :-) Output: Version information for DFSee, library, used 3rd party stuff and the Operating System that is currently running. _______________________________________________________________________________ ALLOC [details] = Display allocation map in various size, show RESIZE limits Purpose: Show usage and the distribution of data over the volume. Parameters: details optional Vary detail shown, and size of the map @ Lowest detail exactly 1 line ~ Lowest detail 2 to 4 lines - Low detail 8 to 16 lines + Medium detail 32 to 64 lines * High detail 128 to 256 lines $ Extreme detail, 512 to 1024 lines spc size per character as an mcs-number, in sectors, Kib, Mib, or Gib -l:lines Map with specified number of lines -l:lines Map with specified number of lines When not specified, the amount of detail is calculated to result in a map about 1 screen page in size when possible. Output: A single graphic for the entire object, either a filesystem like FAT, HPFS, NTFS or JFS, or a whole disk. Each character in the display will represent a certain amount of diskspace, filled in according to the degree of usage. Remarks: Depending on the current filesystem, specific areas might be represented in the display. For FAT: Bootsector, both FATs and the Root directory are shown in the first display line using colors. The size of FAT/Root is proportional to their real size and the percentage of used entries in the root directory is shown at the end of the line The largest cluster number used is also shown at the end, this is useful to determine the minimum size on a resize (or truncate) For a DISK: The MBR/EBR and boot-sectors will be represenyted by a 'B' Unallocated areas (freespace between partitions) by an 'f' _______________________________________________________________________________ BASE [options] = Show (and set) base start and end values in several ways Usage: BASE . | * | SSN [sl] or: BASE -a:start-pos [-s:size] [-logical] or: BASE -p:pid | -t:pid | -f:fid [-logical] Purpose: Set the start (LSN 0) and end position (largest LSN) to view. Parameters: . set base to current sector, to end of disk * keep base the same, but specify a different sl value SSN starting sector number for area to view or a symbolic-sector number (see DFSTERMS.TXT) sl ending sector number for area to view Options: -a:pos area position as mcs-number (see DFSTERMS.TXT) -s:size area size as mcs-number -logical align start-position for a logical partition -p:pid set start to bootsector of specified partition id -t set start to partition Table for current partition -t:pid set start to partition Table for specified part id -f:fid set start to begin of the freespace area specified PID and FID as listed in Part-table left-column Output: Display of current physical start and end values (after set) Examples: base 3ec1 ;base at sector 0x3ec1, to end disk base -f:2 ;freespace area 2, for a primary base -f:5 -log ;freespace area 5, for a logical base -a:122,c -s:200 ;area at cylinder 122, size 200 MiB Remarks: Can be used if the start of partition/P-tables are bad or if you want to view a freespace area on a disk (lost partition) These BASE values will normally be set automatically when you select a partition with the 'part' command. _______________________________________________________________________________ BPS SectorSize = Force sector size to specified value (decimal, bytes) Purpose: Force a specific number of bytes per sector Parameters: seCSize mandatory Number of bytes per sector (decimal) Valid are: 512, 1024, 2048 and 4096 Output: none Remarks: Should be automatically correct, special purpose usage only The BPS value can be specified with the 'GEO' command as well, by using the '-bps:n' option _______________________________________________________________________________ BSFIND [type][a] = Find MBR/EBR/boot/LVM-sectors, on cylinders or ALL sectors Purpose: Find MBR, EBR or filesystem bootsectors on a disk Parameters type optional type of sectors to search, default is '*' '*' means all the relevant types: 'brelLs' a optional search ALL sectors, not just cyl boundaries Options -f:pos Set start position to search FROM as mcs-number Useful to start searching from xx GiB on a disk Output: A single line with position and type information Remarks: This command is intended to collect info for 'unfdisk' type of recovery in the fastest way possible. When the 'a' option is not specified, it only inspects sector 1 on head 0 and 1 on each cylinder. This makes it DEPENDENT on the geometry currently being used on the disk. It is also very FAST! You could try using different geometries with the 'diskgeo' command if the actual geometry is uncertain. When another mode than "Mode=FDISK" is active, filesystem dependent structure may be included in the search if they have the 's' search-id. This is usually the case for any filesystem that has explicit superblocks like HPFS and JFS. Some FDISK specific structures may not be found in these modes However, MBR, EBR and Bootsectors are always included. Afterwards, a useful detailed list can be made with 'list -s' and 'list -b'. This is automated in DFSDISK.CMD/DFSDISK.BAT and the 'Actions -> DFSDISK, find partitions' menu item. Examples: bsfind ;search any sector on cylinder boundaries bsfind * all ;search any sector in any sector (SLOW!) bsfind b all ;search bootsectors in any sector (SLOW!) bsfind b ;search bootsectors on cyl. boundaries bsfind -f:22,g ;search bootsectors, start at 22 GiB _______________________________________________________________________________ CD [path] = Change current Directory Purpose: Change both the current directory and the current drive Parameters: path optional Absolute or relative path specification Output: The resulting current drive and directory Remarks: '.' and '..' can be used in the relative path specification _______________________________________________________________________________ CL = Translate and display 'this' LSN as a cluster nr Purpose: Display cluster value for the CURRENT sector 'this' Parameters: none Output: cluster value Remarks: none _______________________________________________________________________________ CL clust [cmd] = Translate hex cluster number to hex LSN, display using cmd Purpose: Display sector for specified cluster in default or cmd format Parameters: clust mandatory Cluster value 2 .. max-cluster cmd optional Command to use for displaying the sector Output: display of the sector Remarks: none _______________________________________________________________________________ CL2S clust = Translate cluster number to hex LSN, display LSN value Purpose: Display hexadecimal sector number for specified cluster number Parameters: clust mandatory cluster value 2 .. max-cluster Output: cluster and corresponding sector number (LSN) Remarks: none _______________________________________________________________________________ CHECK [dr/nr] = Report all detected filesystem errors using SLT info Purpose: Check filesystem integrity using SLT info (chkdsk function) Parameters: drive-letter or partition nr to check, default opened partition Options: -r optional Force refresh of SLT information -M optional Force creation of 'magic' recovery names to (unmounted) JFS filesystems. (JFS only) Output: Verbose list of all SLT entries that have an error flagged. This will include path+filename when available and textual explanation of the error(s) Errors reported by the 'CHECK' command for a specific filesystem are listed in the dfs[FS].txt files (i.e. DFSHPFS.TXT for HPFS) Generic error-codes with their description are: 0x000001 Linked to some structure, but not in allocation-map 0x000002 Allocated in allocation-map, but no known link 0x800000 The filesystem is DIRTY or MOUNTED (in use by OS), operations like resizing are NOT advisable now! The overall returncode for the command will be set to the number of errors found, to be used in further processing like scripting or perhaps a GUI frontend. Remarks: The reported errors are the same as listed with the SLT command. 'check' is an alias for "SLT 0 * -m -1- -d-" _______________________________________________________________________________ CHS c h s = Analyse & display sector using CHS specification Purpose: Display sector using Cylinder, Head and Sector addressing Parameters: c mandatory The zero-based decimal Cylinder number Range 0 to disk-specific maximum and usually below 1024. h mandatory The zero-based decimal Head number Range 0 to disk-specific maximum but never more than 255 s mandatory The one-based decimal Sector number Range 1 to disk-specific maximum but never more than 63 Output: Sector display, format selected based on sector contents Remarks: Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) _______________________________________________________________________________ CLONE [options] = Copy sectors from other (disk/part/vol) to current store Purpose: Make an exact copy of (part) of another store to the current one, the stores representing disks, partitions or volumes. Parameters: at optional start sector 'to' store, default is 0 size optional size to clone in sectors Options: -a:mcs start sector 'to' store, default is 0 decimal MiB -s:mcs size to clone, default whole area in MiB -d[:disk] disk number to clone FROM, 1 .. max -p[:pid] partition to clone FROM, PID/driveletter -v[:vol] volume to clone FROM, driveletter -f:mcs start sector 'from' store, default is 0 MiB -b[:sectors] buffer size = 1 .. tracksize (default tracksize) -E:i ignore errors, continue cloning on read errors -E:q quit on any read errors, exit (batch default) -E:c confirm by user on read errors (normal default) -L exclude LVM signature area, clone FS-area only -M Do not write fixed 0xFE pattern on bad sectors in the source, but keep the possibly correct contents at the destination sector (merging). This option is set by default when the CLONE is initiated from the DFSee main menu. -R Reverse copy direction, from High to Low LSNs -S Smart skip unused space in filesystem or disk -skipbads:n Skip 'n' sectors on each bad-sector area detected Implies -E:i = 'ignore errors' and -M = 'merge' -D[:disk] TO disk, disk number to clone TO, 1 .. max -P[:pid] TO partition, partition to clone TO, PID/letter -V[:vol] volume to clone TO, driveletter -! or -!- Force, or skip the generic CLONE dialog Output: Clone parameter details, confirmations and progress info Examples: clone -d:1 ;Clone disk-1 to current clone -p:C ;Clone partition C: to current clone -p -P ;Partition to partition clone, dialog clone -d:1 -D:2 ;Clone disk 1 to disk 2, no dialog Remarks: When using the menu system and dilog, select the type of FROM and TO object you want to clone between, the fill in the remaining paramaters and options in the dialog. When using the commandline (or a script) you either select a specific destination using one of the -P, -D or -V options, OR you MUST select the disk, partition or volume to clone TO (destination) BEFORE using the 'CLONE' command itself. You CAN NOT clone a partition to freespace, partitions are not created automatically by CLONE. You MUST do that manually. To make a copy of a partition in freespace (or move it there) use the 'MOVE' command instead, this integrates the CLONE and the required CR command in one. Related menu items are called 'Copy Part to freespace area' and 'Move Part to freespace area' The default error strategy (-E:) is 'quit' for batch mode and 'confirm' otherwise, unless overruled by the global switch -E: on DFSee startup To CLONE a physically damaged disk for recovery, the following options are recommended for maximum reliability: -E:i to continue cloning after read errors (incl retries) -b:1 to force single sectors reads, this is very slow but will result in a minimum number of unreadable sectors Note that unreadable sectors on the destination disk will contain [512] 0xFE bytes, easy to recognize as invalid. This can be overruled by using the '-M' option (merge), which allows recovery of a partition with bad sectors by creating a same size FORMATTED empty destination partition and CLONING all readable sectors, skipping the bad ones. WINDOWS When cloning a whole disk, containing a bootable Windows ALERT! do NOT boot with BOTH disks attached to the system until you have changed the unique NT-signature in the MBR sector of the cloned disk. (it is OK to boot with just the clone) Booting with identical disks may cause registry settings in the Windows partition to point to the WRONG physical disk, causing failure as soon as that disk is taken out of the system later. To avoid the problem use the DFSee menu item: Mode=FDISK -> MBR area fixes incl NEWMBR -> Update NT-signature in MBR ... select the clone ... _______________________________________________________________________________ CMD [command] = Force execution of command by Operating System, not DFSee Purpose: Execute an external command, using the OS command processor Parameters: command optional The command to be executed by the OS It will be executed using a "system" call for the specified command with all output redirected back to DFSee. This uses a PIPE interface and an extra thread on OS/2, but a temporary file on DOS, Windows and Linux (requires write access to current directory) When no command is specified the default shell program as defined by the 'COMSPEC' environment variable will be executed. Return to DFSee is usually with the 'exit' command from such a shell, but that may differ between shell programs. Options -B optional Consider any command given as 'trusted' by suppressing the explicit check. Output: Any normal output (stdout, stderr) from the command will be redirected to the DFSee text output buffer in the standard colors used there by DFSee. Input requested by the program can be typed at the current cursor position, which is most often the DFSee command line but may be changed to any location by the program. This may cause some confusion :-) If the command is an interactive (text mode) application, it will most likely work correctly, temporarily taking the whole screen away from DFSee. Depending on the implementation however, either screen output or the entry of commands might be incorrect. Examples: cmd ;start the default COMSPEC shell cmd mode co80 ;execute a mode command externally ;(and not the built-in DFSee one) Remarks: In many cases it is NOT NEEDED to use the 'cmd' command since any command not recognized by DFSee will be executed as an external command anyway. However, when the external command or program has the same name as a DFSee command, you can explicitly execute it as 'external' this way. In all cases, the command to be executed externally are checked against a list of 'trusted' commands. When in the list the command is executed directly, otherwise you will get a confirmation pop-up to as if you really want to run this external command. This confirmation makes sure that no dangerous commands, perhaps the result of a typo, get executed without warning. _______________________________________________________________________________ COMP [options] = Compare sectors from other (disk/part/vol) to current store Purpose: Compare the contents of (part) of another store to the current one, the stores representing disks, partitions or volumes. Parameters: at optional disk nr, default is current if open or 1 size optional size to compare in sectors Options: -l compare ALL, and add differences to the list -a:sector start sector current store (default is 0) -b[:sectors] buffer size = 1 .. track ize (default track size) -s:mcs size to compare as mcs-number (see DFSTERMS.TXT) -d:d disk number to compare to, 1 .. max -p:p partition to compare to, PID/driveletter -v:v volume to compare to, letter default is C: -f:sn start sector 'other' store, default is the same value as 'at'", -S Smart skip unused space in filesystem or disk Note: Most of these options are exactly identical to the CLONE command, this makes it easy to use COMPARE after cloning. Output: Compare parameter details, confirmations and progress info Examples: comp -disk:1' ;compare disk-1 to current one comp -part:C' -l ;compare partition C: to current and ;record all differences in the sector list Remarks: If no disk, part or vol is specified, the 'alternate' store is used as area to compare with (if possible). If the '-list' option is not specified, the compare will stop on the first sector that is different. The list is limited in size (currently to 409600, 200 MiB) so completely different stores will not have all sectors recorded. _______________________________________________________________________________ CONFIRM [-y] msg = Show a notification, or a confirmation message [-y] Purpose: Display a message, and ask confirmation Parameters: msg optional textual message including spaces. A new line can be started using the vertical bar: '|' Options: -y Use [Yes] [no] [Cancel] instead of [OK] Output: None when in windowed mode, message and response otherwise Remarks: In windowed mode the confirmation will be presented in the form of a dialog with buttons. When the dialog is completed with anything else than [OK] or [No], the return code will be set to nonzero. This can be useful in scripts to control further execution of commands. _______________________________________________________________________________ CS [sn] [-v:cs] = Calculate 32-bit checksum for sector, optional verification Purpose: Display, and optionally verify, the checksum value for a sector Parameters: sn optional Sectornumber to calculate the checksum for. When not specified, current sector 'this' Options: -v:cs verify the checksum against specified value -m[:"msg"] Display msg (popup) when checksums do NOT match Output: Display of sectornumber and calculated checksum Remarks: For a non-matching checksum, and -v specified, the returncode for the command is 'sector mismatch' with value 246. This can be used in scripts to verify sector contents: cs 0 -v:0x12345678 -m:"MBR checksum failure, wrong disk!" _______________________________________________________________________________ DELSHOW [sel] = Show delfind list, with selection wildcard and threshold Purpose: Display a list of (deleted) filenames from the sector list Parameters: sel optional File selection parameters, in the form: wildcard%threshold (sometimes shown as [w%t] in usage) wildcard = wildcard selection for display/recover threshold = +nn = Minimum allocation OK percentage or -nn = Maximum allocation OK percentage default: *%-100 ==> all except 100% ones Parameters: w optional wildcard selection for display t optional +nn = Minimum allocation OK percentage -nn = Maximum allocation OK percentage Output: LSN list in fnode format (as "list -f *%1" command) Remarks: Default wildcard is '*', default percentage is 0 Minimum will list all values larger, maximum all values 'up to' Wildcards are real (UNIX style) wildcards using '*' and '?' Wildcards can appear at multiple places in the path string. Examples: delshow *%100 ;All files perfectly recoverable delshow *.ini%50 ;All *.ini files at least halfway OK delshow *%-100 ;All files not fully recoverable _______________________________________________________________________________ DFSCHECK [part|*] = Run dfsXXXX analysis for one or all partitions => DFS*.P* Purpose: Run the dfsXXXX.dfs script for the specified partition(s). Collect information to aid in filesystem and other recovery situations. Output will be in DFSyXXXX.P* files Parameters: part optional Specific partition to run the analysis for Not specified or '*' means all partitions FSYS optional Explicit filesystem name (like FAT) when one specific partition is being checked Remarks This is a built-in alternative for the 'DFSCHECK' + 'DFSCPART' command files that are normally used for the same purpose. It is used from the menu-system as well, when selecting: Actions -> Check partition filesystem -> ... Apart from running the DFS script 'dfsXXXX.dfs' this command will also create the logfile 'DFSyXXXX.Pnn' and two binary files which will not be created if you simply run that script. Used as a startup-command for DFSee as in 'dfsdos chkpart *' the command will quit DFSee automatically when finished. Output: Some progress info, real information in the DFSyXXXX.P* files _______________________________________________________________________________ DFSDISK [disk|*] = Run DFSDISK analysis for one or all disks => dfsdiski.* Purpose: Run the DFSDPROC script for the specified disk(s). Collect information to aid in UNFDISK and other recovery situations. Includes a backup of partitioning information and a generic overview. Output will be in DFSDISK?.* files Parameters: disk optional Specific disk to run the analysis for Not specified or '*' means all disks CYL optional Search cylinder boundaries only (default) ALL optional Search every sector (very slow) c | ? optional cylinder value for specific GEO to use '?' causes Cyl-value to be calculated h optional heads value for specific GEO to use s optional sectors value for specific GEO to use Options: -s:fs Filesystem for which SUPERBLOCKS will be included in the search. -b:basename Base filename for resulting files, when not specified, this will be 'DFSDISKI' This basename may include a PATH as well to direct the files to a different drive or directory. Remarks This is a built-in alternative for the 'DFSDISK' command files that are normally used for the same purpose. It is used from the menu-system as well, when selecting: Actions -> DFSDISK, find Partitions -> ... Apart from running the analysis script 'dfsdproc.dfs' it will also create the logfiles 'dfsdisk?.sk*' which will not be created if you would simply run that script. Used as a startup-command for DFSee as in 'dfsdos dfsdisk *' the command will quit DFSee automatically when finished. Output: Some progress info, real information in the DFSDISKI.* files _______________________________________________________________________________ DIRFIND [l][dir] = Put [l] levels of filenames from [dir] in the sector list Purpose: Find normal files (not deleted) in a directory and optionally it's subdirectories up to the number of levels specified. Parameters: l optional number of directory levels to include in the list, or 's' for all levels dir optional directory specification, starting from the root directory Options: -l:wildcard Automatically list the found files, limiting the output to files matching the specified wildcard string. Without a wildcard, the "-l" option will list all the found files. Output: Sector list in memory to be used in following operations Remarks: List can be manipulated as usual, best viewed with "list -f" To copy (a selection of) the found files to a different disk or partition, use the "recover" command. For HPFS filesystems, the names used will be significant in the first 15 characters only, the rest of the name will be replaced by hyphens ('-'). This is needed because the FNODE only stores the first 15 characters of the name. The list option "-l:*test*" equals a "list -f *test*" command. Examples: dirfind s \os2 ;Put \os2 tree in the list dirfind 1 \os2 -l:*.add ;Show all .ADD files in \os2 dirfind s \ -l:*.dll ;Show all .DLL files _______________________________________________________________________________ DISK [disk] = Select a disk (partitionable medium) and show the MBR Purpose: Select a physical, RAW-imagefile or virtual disk Parameters: disk optional disk nr, default is current if open or 1 Options: -q Quiet, select only, no display -R open the disk in Read-only mode -R- force the disk in Read-write mode -fs:'fsname' Set mode to filesystem 'fsname' on large-floppy -F Force use of First EXT-container (reread too) -g Show disk geometry too (reread too) -i Industry std letter assignment (reread too) -L[:0|1|2] Show preferred: none (0), LVM (1), Windows (2) -m Identify MBR, and show I13 limit (reread too) -r Refresh partition tables from disk (reread) and RESET previously forced geometry Output: Disk Geometry and default display of sector 0 (usually MBR) Remarks: The dfs_number variable for REXX will be set to number of disks See also: WALK command _______________________________________________________________________________ DISPLAY = Show current display size in rows and columns Purpose: Display current display size, most likely after changing that Parameters none _______________________________________________________________________________ EDIT [-a -h -u] = String replacement edit, using Ascii, Hex or Unicode string Purpose: Make any kind of modifications to sector contents At least one of the options 'a', 'h', 'u', 'm' or 'P' must be present, or the HEX sector editor will be started instead! (as described in the next section) Parameters pos optional Decimal or Hex offset, start of edit-area str optional A string to be placed at the specified position in the current sector. The syntax for this string is exactly the same as for the find ('f') command. So ASCII and binary specifications are possible. Note on quoting: The outermost set of quotes, which can be either single or double-quotes, will be stripped off by the parameter parsing logic before it is passed to the 'find' command. You CAN use that same quote character again in the parameter using the 'escape' character '\' Example: "The \" is a double-quote" Options: -p:pos edit position, decimal or hexadecimal (0x...)", -a:'asc' ASCII replacement value, string -h:'hex' HEX replacement value, sequence of hex pairs -u:'uni' UNICODE replacement value, string -P Prompt, allowing editing of the specified value with one of the -a, -h, -u or -m options -B Batch mode, do not prompt when values given -w- Do NOT write the sector back to disk directly Examples: edit 0x1be -h:'00' This will set the byte at offset 0x1be to the value 0x00, without any further prompting. (quotes are mandatory!) edit 126 -h:'00' -P This sets the byte at offset 126 (decimal) to the value 0x00, but will allow editing of the hexadecimal value(s) to use. edit -p:0x30 -h:'3e 54' This will replace 2 bytes at position 30 and 31 hexa-decimal, to the values 0x3e and 0x54 respectively. edit -p:27 -a:Test This will replace 4 bytes at position 27 decimal, to "Test" edit 3f -u:test This will replace 8 bytes at position 3f with Unicode "test" without prompting edit -h -P This will prompt for a position and a value in hexadecimal ... Output: Hex-dump BEFORE and AFTER for the changed sector area Remarks: The edit command will prompt you to write the data back, unless you use the '-w-' option. Then, after multiple edits perhaps, write back the data explicitly using the 'write' command. The 'show' command can be used to view the sector before writing back or making more changes. It is similar to the 'H' and 'h' command, but it does not read from the disk, it just displays the current sector buffer contents. Specifying a 'pos' parameter or the '-p' option are mutually exclusive. Using the '-p' option will cause the specified value to be used as a default in a prompt dialog. Specifying the 'str' parameter is mutually exclusive with using any of the '-a', '-h' or '-u' options. _______________________________________________________________________________ EDIT [options] = Start HEX sector-editor on current or specified location Purpose: Interactively make any kind of modifications to sector contents in the current object (including files), needed if no specific FIX commands for the data in question are available. Parameters: SSN optional Symbolic sector number (see DFSTERMS.TXT). This includes MCS-style values like '3,c' The default numberbase is hexadecimal! fname optional Name of a file to be edited binary (HEX/ASCII) Options: -p:pos edit position, decimal or hexadecimal (0x...)", Determines de location of the cursor in the item when the HEX edit window is started -F:ssn Symbolic sector number to start the edit session. -M:position Start position of initial marked area in hex editor -m:bytes Size in bytes for initial marked area (Alt-B/L/U/F) -s:size Item size for HEX editor in sectors The default is the current cluster-size. -d Start in disassembly mode, maximized window -B Batch mode while editing, the main effect will be that the write-confirmation popup is skipped and all changes are written back unconditionally. Examples: edit Start the HEX editor starting at the CURRENT sector (this) edit 10 Start the HEX editor at logical sector 0x10 edit -p:0x30 -s:4 Edit at the current sectornumber (this) with an initial cursor position of 0x30 and an itemsize of 4 sectors (2Kb) edit -F:23,c Edit starting at Cylinder 23 (decimal, Cyl:23 H:0 S:1) This could be used to edit an EBR at that cylinder, perhaps to update the partitiontable ... edit 0 -M:0x1be -m:64 -p:0x1c2 Edit the MBR sector and highlight the partitiontable bytes in there by marking them. Put the current cursor position on the TYPE byte in the first table entry. Output: One line with the starting sector-number, then one more line for every sector when it is modified, and finally the sectornumber when leaving the editor, if different ... Remarks: Each time you navigate 'out' of a sector/item with changes, you will be prompted with a write-back confirmation that includes the sectornumber and number of changed bytes. For further help and usage of the sector editor, use the context sensitive help once in the HEX editor. _______________________________________________________________________________ EXPAND [options] = EXPAND FS to a new LARGER size, incl. Part-table update TRUNC Usage: EXPAND size | -size:new | -s Purpose: Make a filesystem in a partition on a disk larger, usually to use some freespace that is available after it on the disk. Parameters size optional Specifies new filesystem/partition size Without a specified size, the user will be prompted for the desired new size. Options -s:new New expanded size as mcs-number -s Expand to maximum possible size -F Force resize even if larger than indicated maximum size. Can be useful if allocation information is not correct. Output: Progress, calculated new sizes and partition end position, plus a confirmation message when not working in batch mode. Finally a success or failure message. Examples: expand 1500 ;Expand to new size of 1500 MiB expand -s:5000 ;Expand to 5000 MiB expand -s ;Expand to maximum size, using ALL freespace expand ;Prompt for new size, then expand ... Remarks: The mcs-number format is [0x]nnnn[,m|c|s] with a HEX or decimal value, in MiB, Cylinders or Sectors. Default decimal MiB. The EXPAND command is implemented as a generic command, but requires a filesystem dependent part to be implemented. Currently that is only available for FAT, FAT32, HPFS and NTFS FAT(32) partitions can not be expanded by DFSee normally, the exception is when the partition has been resized to a smaller size with DFSee before. This restriction might be lifted in a future version of DFSee. An easy rollback (UNDO) can be achieved by saving all partition information first (using PSAVE) before the actual EXPAND. After a PRESTORE, the EXPAND will be rolled back and the partition is back to its original size. The EXPAND command is implemented as a combination of a DELETE, CREATE and RESIZE command with the options as required by the expand operation. _______________________________________________________________________________ EXPORT fname = Export sector list, to LSN file and optional data file Purpose: Save an LSN-list in a file for modification or later use Parameters: fname Destination filename for the LSN-file Options: -d:dname Write data, using dname for the sector data -d Write data, using fname for the sector data Note: default extension for data file is .bin default extension for LSN file is .lsn Output: Progress information Remarks: The LSN file has one LSN per line, editable with a text editor. The data file holds the contents of each sector (512 bytes) as indicated by the LSNs in the list, and in the same order. (This is the same format as required by IMPORT) _______________________________________________________________________________ FDISK [Command] = Select FDISK mode, pass (optional) command to execute Purpose: Make FDISK the active analysis mode and command set Parameters: command optional Specific FDISK command (try FDISK ??) When no command is specified, the default is a 'part' command that will show all partitions on all disks. Options -r- Do NOT read the partition tables again, just display them ... Output: none, or output for the specified command. Remarks: When the 'batch' mode is forced using the '-b' program switch, and a command is specified, DFSee will do an automatic quit after completing the command. This is useful to execute a series of FDISK commands from a batch- or command file. _______________________________________________________________________________ FI [SSN] = File information on specified symbolic-SN, default 'this' Purpose: Display compact one line of infomation about the specified sector, when possible in the form of path+filename info. Parameters: SSN optional Symbolic sector number (see DFSTERMS.TXT). Output: One line of information on the sector number, path+filename when available or CHS+PSN translations when not. Remarks: This is the same format as used with the 'list -f' command. _______________________________________________________________________________ FIND str = Find a string using specified options and sector types Purpose: Perform a sector search starting from the current LSN until a sector of the specified type and optionally (not) containing a specified ASCII/HEX string is found. Parameters: str optional The string to search for (usually in quotes). A string of bytes (ascii/unicode/hex)that have to be present in the wanted sector. When the '$' string option is not given, it can be specified as a mix of ASCII, UNICODE and HEX. The starting mode is ASCII, switching to HEX and back is done with the ' character. Switching to UNICODE and back with " Leading white space is skipped, in HEX mode spaces can be used to improve readability. For case-insensitive UNICODE only search, use the '$/' options, specify the search string in plain ASCII. (see -a, -h and -u options too!) Note on quoting: The outermost set of quotes, which can be either single or double-quotes, will be stripped off by the parameter parsing logic before it is passed to the 'find' command. You CAN use that same quote character again in the parameter using the 'escape' character '\' Example: "The \" is a double-quote" Example 1: "last'0d0a'first" This will search for the word "last" followed by a carriage-return line-feed combination and the word first Example 2: "'e9bd13 0d4023 49 42 4d 3a38 2e'" This will search for a byte sequence, in this case the start of COMMAND.COM Options: -o:find-Opts Search and display options, default is '+' Q = Quiet search, NO display of found sectors (fast) M = Multiple hits within one sector are possible F = Find directory entries for FAT types 'D' or 'd' Fd = Find directory entries for deleted files only Fe = Find normal files by extension, not full name Ff = Entries for normal (not deleted) files only FD = Entries for normal DIRECTORIES only s or 1 = Single find, display sector when found * = Repeat find, building a list (find all ...) % = No sector spanning, => fast text search [ = Freespace only => fast undelete ] = Allocated space only => fast file-grep ! = Just list found, faster and better log-format + = Verbose output even when repeating - = Backward search, towards lower sector numbers ~ = Search on sector 1 head 0/1 only, bootsectors $ = Use a case-insensitive string compare / = Assume UNICODE strings, can be combined with '$' ^ = Inverted search, find sectors NOT containing ... @[pos] = Compare at sector position [pos] only (with type dependant defaults for [pos]) -t:types Types of sector wanted, default is any KNOWN. Specify multiple types in a single string For an up-to-date list, use the '???' command -a:'asc' ASCII find-pattern value, string -h:'hex' HEX find-pattern value, sequence of hex pairs -u:'uni' UNICODE find-pattern value, string -m:'mix' Mixed ASCII/HEX/UNICODE find-pattern -A:'asc' 2nd 'AND' ASCII find-pattern value, string -H:'hex' 2nd 'AND' HEX find-pattern value, hex pairs -U:'uni' 2nd 'AND' UNICODE find-pattern value, string -M:'mix' 2nd 'AND' Mixed ASCII/HEX/UNICODE find-pattern -f:pos Set start position to search FROM as mcs-number Useful to start searching from another position than the current one (THIS). The value specified is the offset to the START of the current object Default unit in the mcs-number is 's' (sectors). -i:step Number of sectors to STEP to get to the NEXT. Default is 1 so every sector will be searched. Larger values can speed up the search considerably but of course SKIP sectors then. Useful if the wanted sectors are on EVEN sectors (step=2) or when 'probing' a huge disk for certain type of sectors like FNODE/MFT-records (step=1000 or so) This option is ignored when the '~' find-Opt is used to search on cylinder aligned sectors only. -P Prompt, allowing editing of the specified value with one of the 'ahum' or 'AHUM' options. -n[:offs] Start searching from NEXT/PREV sector, or from a specified offset in the current sector. Might be needed when searching again for the same pattern, to avoid finding the same one again :-) Output: Sector display, format selected based on sector contents, or a single line with position and type info when repeating Remarks: When a search 'str' is specified, the default option is "1" resulting in a 'single search' and display of a found sector. Otherwise a repeated search for the specified type(s) will be performed and each sector will be listed. Specifying the 'str' parameter is mutually exclusive with using any of the '-a', '-h', '-u' or '-m' options. When these options are specified their value is used directly, or as the default in a prompt dialog. The '-A', '-H', '-U' or '-M' options specify a 2nd argument that must be present in the same sector, to make a match. (logical AND function, find xxx AND yyy) When any of the 'ahum' or 'AHUM' options is specified without a value, the user will be prompted for one. The find command is often called by other commands to implement the actual required search (like "delfind" and "bsfind") Starting with version 7.00, you can also start a FIND dialog from the menu (Edit -> Find sector data) or the Ctrl-F key. _______________________________________________________________________________ FIXBOOT [opts] = Fix a filesystem bootsector, FAT(32), HPFS, NTFS, JFS Purpose: Fix corrupted bootsector for one of the supported filesystems Parameters: depend on the specific filesystem, see corresponding DFSxxx.TXT Output: Progress and confirmation info Remarks: The FIXBOOT command is implemented with the filesystem specific code for each of the filesystems, and is documented there. It is available from the corresponding 'Mode=xxx' menu too. _______________________________________________________________________________ FIXPBR [options] = Fix HiddenSectors and Geometry bootsector to match p-table Purpose: Make bootsector value for 'hidden sectors' consistent with the corresponding offset value in the partition table, and the geometry Head/Sectors fields match the current disk-geometry. Parameters: none Options: -g- Do NOT update the geometry head/sector values -h- Do NOT update the hidden sectors value Output: progress information and confirmation Remarks: A consistent value is required on operating systems like OS/2 and eComStation to allow a filesystem to be mounted correctly The value can become inconsistent when a partition is relocated from one primary location to another, or between primary and logical locations. This could happen with CLONING, or restoring an imagefile. The 'FIXHS' command is a deprecated form of this command that only fixes the hidden-sectors value, but is still supported for backward compatibility with older scripts. _______________________________________________________________________________ FS fs-name = Force analysis using specified filesystem knowledge Purpose: Use specific FS knowledge if the default is not correct Parameters: fs-name Filesystem name, like FAT, NTFS or HPFS Output: none Remarks: For some filesystems it is possible to force a specific mode of analysis using the fs-name, implemented are: FAT12 force a 12-bit FAT analysis FAT16 force a 16-bit FAT analysis FAT32 force a 32-bit FAT analysis _______________________________________________________________________________ GB [distance] = Go backwards 'distance'; an mcs-number, default is 1 sector GF [distance] = Go forward 'distance'; an mcs-number, default is 1 sector Purpose: Move backward or forward by specified distance, usually sectors and display the sector found there in its default format Parameters: distance The distance to move from the current sector (this) as an mcs-number, so sectors, KiB etc can be specified in either hex or decimal format. Default is hex sectors Output: Display of the sector at specified distance, in a default format Remarks: The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. Examples: gb 5 ;go back 5 sectors gf 3,c ;go forward 3 cylinders gf 100,k ;go forward 100 KiB gf ;go forward 1 sector _______________________________________________________________________________ GEO ?|c h s f b = Set/Display specified geometry on opened object, ?=adjust Purpose: Show current or force different geometry to be used for interpreting and analysing the current physical disk Parameters: none Display the geometry currently in use, including possible overrides by previous 'diskgeo' commands c h s Overrule current geometry by the values specified for cylinders, heads and sectors. Not specifying a value, or specifying 0, will cause that particular value to stay unchanged in the GEO The value '?' can be specified for the cylinder value and will cause a recalculation for the cylinder count based on heads/sectors and the size of the disk at the time it was first selected. f optional first-sector or 'base' value to use with this. The base is the offset to LSN-0, usually the bootsector b optional number of bytes per sector Options: -b:nnn Number of bytes per sector to be used with the geometry Valid values are: 512, 1024, 2048 and 4096 -S Synchronize system-geometry (S-Geo) with new GEO too Output: The resulting geometry for the physical disk currently open Remarks: You can keep the current value for one of the items by specifying zero (0) or nothing for the override Examples: diskgeo 0 255 ;set the number of heads to 255 diskgeo ? . 32 ;set the number of sectors to 32 and ;calculate the right number of cylinders ;for that geometry and disksize _______________________________________________________________________________ H|h SSN [size [S]] = Hex-dump sector, SN x, size sect/bytes; force [S]ector Purpose: Display current or specified sector in hex-dump format Parameters: SSN optional LSN of sector to dump size optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 512 bytes for the 'H' command and 256 bytes for the 'h' command S optional Force size parameter to be sectors Options -4 Output 32-bit intel-reversed HEX values, in C or C++ syntax like: '0x12345678, 0x87654321, // xV4.!Ce. Output: Hex-dump of the sector, for the normal output that is On every line 16 bytes of data will be displayed, each line containing: - the relative offset in the record (4 hex digits) - 16 bytes in hexadecimal; separator after 8 bytes - the same 16 bytes represented as ASCII And for the Intel-reversed 32-bit values: - 16 bytes in 4 ULONG values; leading '0x' trailing comma - the same 16 bytes represented as ASCII Remarks: The ASCII representation is filtered, and non-printable characters are represented with a PERIOD character _______________________________________________________________________________ ID [ SSN | -L ] = Identify 'this', specified SSN or LAST sector, using SLT Purpose: Display the type for a specific sector and one major reference Parameters: SSN optional Symbolic sector number (see DFSTERMS.TXT) Default is the current sector Options: -L Use LSN of LAST used sector in FS (minimum for RESIZE) -l- Do NOT overwrite original sector list with new results when a directory gets displayed Output: One line specifying corresponding SLT entry, followed by a line specifying the type of the sector itself and a sector display of the 'reference' sector, in a format based on sector contents Remarks: This function is extremely useful to relate file-data sectors from fragmented files to the Fnode for a particular file. It will tell you exactly which file a certain sector belongs to. For best output, the sector lookup table (SLT) should be made available by the 'SLT' or 'CHECK' command. _______________________________________________________________________________ IM [file | dir] = Open a file with a FS-image (.img) for analysis Purpose: Work with a saved binary image Parameters: file mandatory Path or filename for the image, the default extension is '.img'. When the img parameter, ends in a '\', the imagefiles will be listed Options -A- Do NOT allow appending to the file on write -R Open the image in Read-only mode, no writes -e:'ext' Overrule default 'img' extension with 'ext' -f- Do NOT initialise for a Mode=xxx filesystem -fs:'fsname' Set mode to filesystem 'fsname' for image Output: The default display for the first sector of the image Remarks: Filesystem type is derived from first (boot) sector _______________________________________________________________________________ IMAGE file [opt] = Save an object to imagefile(s) using specified options Purpose: Save specified sectors as a binary RAW/compressed image Parameters: file Filename for the image, default extension is '.img' When prefixed with [lpt.exe], the data is actually written to named pipe \pipe\xxx.img to LPT.EXE which will be started in a separate session automatically This allows saving the image on a different PC that is attached using a parallel (laplink) cable. f First sector number to be saved, or: . or 'this' = current sector 'this' .NNN = value from sector list default: 0 s Size to save, in sectors, or: . or 'this' = up to current sector 'this' $ or 'all' or 'end' = up to end of current volume/disk .NNN = up to value from sector list default: $ default saves whole area Note: Parameters 'f' and 's' are intended for backward compatibility mainly, using the options '-F' and '-s' respectively is recommended. Options: -z Enable LZW compression on the image-file, this implies Non-raw format using DFSee info headers -R Raw format, no headers even when compressing -R- Non-raw format, add DFSee info headers -A Append to imagefile if it already exists -p- Does not count as a progress-item (see PRITEMS) -F:n First sector as mcs-number, default 0 -s:n Size to be saved as mcs-number, default ALL -L Exclude LVM signature area from image (LVM/JFS) -S Smart imaging mode (optimizing for size) Set unused sectors to ZERO in the image, or for a compressed image, use a run-length encoding, greatly reducing the size of compressed images for areas with a lot of unallocated space. DFSee compressed images with -S can be orders of magnitudes smaller than a simple ZIPPED raw image (even with zeroed sectors) and as a bonus, will restore much quicker too. Note: Does NOT work when a WHOLE DISK is imaged! -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. -m[:mcs-size] Maximum size of file(s) as mcs-number, using multiple files. Often used with compression. The size is unlimited when not specified at all. (but maybe limited by media or FS limits :-) -M Prompt the user to change the removable Medium for the next (size limited) file to be created -b:sectors Number of sectors to buffer, the default is to use the current number of sectors per track (18 for diskettes, usually 63 for harddisks) The maximum is automatically limited to the available buffer memory. -b or -b:1 Precise mode, 1 sector at a time, this is up to 20 times slower than optimal, but will result in the minimum number of bad sectors ending up as 'garbage' in the resulting image -6 Do NOT use CRC32 checks or advanced compression This will make the created images compatible with 6.xx and older versions of DFSee. -E:i Ignore errors, continue saving on read errors -E:q Quit on any read errors, exit (batch default) -E:c Confirm with user on read errors (normal default) -v Verify of imagefile integrity, displays details on every handled block of data (63 sectors) like length, compression and CRC-32 when available. -D[:disk] Disk number to make an image FROM, 1..max disk -P[:pid] Partition nr to make an image FROM, PID or letter -V[:vol] Volume letter to make an image FROM, driveletter -I[:"image"] Filename to make an image FROM, img filename Note: When a volume corresponds to a partition, using the -P option is STRONGLY recommended! -! Force option dialog to be used, even when sufficient parameters are specified. In this case, only the file name and the -m option is passed to the dialog, other options are ignored and need to be set in the dialog itself. Output: Progress information Remarks: When '.' is specified for s, sector 'f' up to 'this' is saved When '.' is specified for f, the start-sector is 'this' When '.' is specified for both, only the 'this' sector is saved The 'f' parameter is mutually exclusive with the -F option and the 's' parameter with the -s option. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. The default error strategy (-E:) is 'quit' for batch mode and 'confirm' otherwise, unless overruled by the global switch -E: on DFSee startup When using compression, the number of sectors (-b:xx) used for buffering MUST be the same in the IMAGE and RESTORE commands and it should be less than or equal to the number of sectors per track, or the RESTORE wil fail! Smart imaging, with the '-S' option is ONLY SUPPORTED for the filesystems fully understood by DFSee (allocation information). Currently that are FAT/FAT32, HPFS and NTFS. It will only work if the selected object is a SINGLE partition with that filesystem, never for a whole disk in one go ... When using the '-S' option, it is advised to use a buffer size not much larger than the track size (typically 63 sectors) to increase the chance on the buffer being completely unused so it can be skipped on the imaging action. For Windows-NT with NTFS and OS/2 versions with a kernel 4.50 or newer with JFS, the files CAN exceed 2GiB (large file support). This means you could write an image from a 9GiB partition to a large JFS partition for example. When imaging acros a network connection, the limits vary and may go undetected depending on the network protocols used. As an example, saving an image to a SAMBA share connected to a Reiser-filesystem on Linux results in a 4 GiB limit, but there will be NO warning when exceeding it. To avoid problems you can use the '-m' option to limit the size of (multiple) generated files to just below 2GiB. Note that unreadable sectors on the source will result in sectors with a 0xFE byte pattern in the image. This is easy to recognize as invalid. To create an image directly from the OS commandline, using the image dialog window, use a command like: DFSOS2 -w image -P:1 #confirm Press a key to exit ...#q And to run it in text-mode, no windowing, no dialog: DFSOS2 [-b] image -z -P:3 part3img#q The optional '-b' suppresses the confirmation, for batch use. The SIM command is an alias for IMAGE (deprecated) _______________________________________________________________________________ IMZ2RAW imz raw = Create uncompressed (RAW) image from an IMZ compressed one Purpose: Recreate the original uncompressed image from a small backup Parameters: imz Filename for the compressed IMZ inputfile raw Filename for the uncompressed RAW outputfile Options: -! Use dialog to check or specify more options Output: Progress information Remarks: This is a wrapper/front-end function for the RESTORE command, making it easy to recreate an uncompressed image from an IMZ. The output filename will default to the same path and name as the input, with a default file extension .IMG The IMZ imagefile can be a 'multiple files' one, and will be assembled into a single RAW imagefile. _______________________________________________________________________________ RAW2IMZ raw imz = Create a compressed imagefile (IMZ) from a RAW image file Purpose: Make a smaller image, for backup or other purposes Parameters: raw Filename for the uncompressed RAW inputfile imz Filename for the compressed IMZ outputfile Options: -m[:mcs] Maximum size per imagefile, default 650 MiB -M Media change prompt after each file (removables) -! Use dialog to check or specify more options Output: Progress information Remarks: This is a wrapper/front-end function for the IMAGE command, making it easy to create a compressed image from a RAW one. The output filename will default to the same path and name as the input, with an extension of .IMZ Multiple files are possible, to make them fit on a CDROM for instance, in the same way as with the IMAGE command. When no '-m' option is specified at all, there will be a single .IMZ file of unlimited size! _______________________________________________________________________________ IMPORT filename = Import LSNs to the sector list and optional data to disk Parameters: fname Source filename for the LSN-file with sector numbers Options: -d:dname Read data, using dname for the sector data -d Read data, using fname for the sector data Note: default extension for data file is .bin default extension for LSN file is .lsn Output: Progress information Remarks: The LSN file must be an ASCII file with one LSN per line. It can be the result of an export, derived from a log-file or created completely by hand. The verbose format resulting from a "list -v" or "list -f" and the "delshow" is also valid. (use "log" cmd to capture) This is often more convenient than bare LSN lists because the verbose format contains info like path/filename. The data file must have at least as many sectors (512 byte) as there are LSNs in the LSN file, and they must be in the same order as those LSNs. Each sector wll be written to the currently opened store, at the corresponding sector number. (This is the format as used by the EXPORT command) _______________________________________________________________________________ LIST [opt] [str] = Display LSNs in the sector list, using options/string Purpose: Display the sector number list in a selected format Parameters str optional wildcard selection or command to execute For the '-f' options it is a wildcard select string on the complete path+filename, including threshold value for 'recoverability' as with RECOVER: wildcard%threshold wildcard = wildcard selection for list or recover threshold = +nn = Minimum allocation OK percentage or -nn = Maximum allocation OK percentage default: *%100 ==> list all 100% ones For the '-c' option, it is the command to be executed for each sector number in the list. The options are mutually exclusive, except for the -f:option values that may be combined as in -f:i8.3 Only the 1st char of an option value is significant. Options: -w Use wide format, 8 LSNs on each line -v Use verbose output, one line per LSN -f Verbose PATH info when available (is default) -f:i Verbose PATH, indirect using SLT information -f:8.3 Verbose PATH, use short 8.3 name (NTFS only) -d Display sector contents, default format -d:hex Sector contents, default + hex dump -c One line LSN info + execute command per LSN -g Show lsn -> PSN -> CHS logical geometry -g:system Show lsn -> PSN -> CHS system geometry -s Show size offset in MiB, type, CHS and PSN -b Verbose bootsec, for BSFIND/UNFDISK analysis -n No contents list, just show number of entries -C FAT only, display location as CLUSTER, not sector Combine with '-e' for EA or '-I' for EA-RelativeClust -e FAT only, display EA-data location, not regular data -I FAT only, show decimal EA-index value as location -X Only display files that have EA-data attached (these options work in combination with '-f' only) -l- Do NOT create new lists when displaying directory information. This allows displaying a list of found directories, like resulting from the SUBFIND command. The -l- option is FORCED when using the '-d' option. Output: List of sector numbers in compact, verbose or special format For the formats with just a SINGLE line of output for every value in the list, there will be an underlined header-line explaining the different pieces of information in the line. For large lists, this will be repeated at the end. Remarks: List also available for REXX in the dfs_sn. stem variable Lists can be imported and exported to files, see import/export When using the '-c' option, the '-f' option can be added to get an additional line of path+filename info preceding the actual command output. The '-f:i' option is only useful when the SLT information is collected (using the SLT or CHECK command). It will list PATH info for file-data. It is most useful AFTER using the '-f' option, since that will list PATHS for the file Fnode sectors. Together, all file PATHS for Fnodes and file-data are shown. The column format for the '-f' format is approximately: .Index = Value : T Pct Location Size Path Index Index in the sector list range 0 .. max Value Hexadecimal value on that index in the list T Type of the sector when known (f = file) Pct Percentage recoverability, approximation Location Location of associated data, sector or cluster Size Size of the file, rounded UP to sector boundary Path Name of the file, including PATH when known For FAT filesystems only, the location may contain the index in the extended-attribute file "EA DATA . SF" with option '-I' or relative cluster nr in "EA DATA . SF" with options '-I -C' or the location of EA-data for the file as LSN, with '-e', or that location as a cluster number with the options: '-e -C' _______________________________________________________________________________ LOCK [ign] = Lock physical disk, to allow writing to it Purpose: Lock a physical disk Parameters: ign optional Ignore lock failure, do not prompt interactively for write permission Output: none _______________________________________________________________________________ LOG [file | .] = Start, stop or resume logging, (appending) to a file Purpose: Close current LOG, open new and capture DFS output in it Parameters: File specification, or '.' for last used logfile name If no parameter is specified, logging is stopped. Options: -7- Do NOT strip output to 7-bit ASCII, allow use of 'graphic' box characters in the logfile. Default is 7-bit ASCII only. -r Close and reopen log on each line (slow) -r- Open log just once (this is the default) Output: Concatenated output of DFS commands given after the 'log' command, up to next 'log' or 'q' command. ANSI control characters for colors and cursor positioning are not written to the logfile. Remarks: After logging has been stopped using a 'log' command, it can be resumed to the same file using 'log .' There is no check on available space on the destination drive, file may end up empty if disk(ette) is full. The same logfile specification can be used more than once, output will be concatenated. On each 'log' command the current logfile will be closed. Special characters such as the 'box' characters with the 8th bit set, will be translated to 7-bit ASCII unless the '-7-' option is given AND the global switch '-7' is not used. Reopening the log on each line can be useful if you have problems with a crashing program or computer, causing the logfile to be only partially written to disk. NEVER change diskettes or other removable media while DFSee is still logging to the same medium! This may make the medium inaccessible (until formatted again). The initial prompt for a logfile at startup (dfswork) can be suppressed by using the '-l-' or '-l:filename' startup switch: _______________________________________________________________________________ MAP [disknr opt] = Display graphical map of partitions on a disk Purpose: Give an easy to interpret visual image of the disk layout Parameters: disknr optional number of disk to display, default is all '.' is current disk only opt optional options, '+' is more verbose, '-' is less Options: -? or ? Show usage information for MAP command -M Display a partitionable Media map too -d Display for current disk only -d:disknr Display for specified disknr only -F Force use of First EXT-container (implies -r) -g Show disk geometry too (implies -r) -i Industry std letter assignment (implies -r) -L[:0|1|2] Show preferred: none (0), LVM (1), Windows (2) -m Identify MBR, and show I13 limit (implies -g) -r Refresh partition tables from disk (reread) Output: Some lines of drawing-characters and text representing the disk with its partitions. The partitions are sized according to their real size. Freespace is also shown the same way. The color of the areas indicate the filesystem-type. Each area contains the most relevant textual info as well. Example output: ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ºÉÍÍ»ÉÍÍÍÍ»ÉÍÍÍ»ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͺ ³³ ³ ºº ºº ºº ºÚÄÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄÄ¿ÚÄÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄÄ¿º ³³ ³mºº1 ºº2 ºº3 º³4 ³³5 ³³6 ³³7 ³³8 ³³9 ³³10 ³³11 ³³12 ³º13 ³³ ³bºº ºº ººP: º³L: ³³M: ³³K: ³³D: ³³N: ³³E: ³³H: ³³V: ³³ ³º ³³ ³rººBMººNTFSººHPFº³HPFS³³HPF³³HPF³³HPFS³³HPFS³³FAT³³HPFS³³JFS³³NTFS³ºFreeSpace³³ ³ ºº ºº ºº ºÀÄÄÄÄÙÀÄÄÄÙÀÄÄÄÙÀÄÄÄÄÙÀÄÄÄÄÙÀÄÄÄÙÀÄÄÄÄÙÀÄÄÄÙÀÄÄÄÄÙº ³³ ³ ºÈÍͼÈÍÍÍͼÈÍÍͼÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͺ ³³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Remarks: Loosely modelled after the Partition-Magic display _______________________________________________________________________________ MEM lsn [pos] = Store sector number LSN in the sector list at [pos] Purpose: Add an LSN to the LSN memory list for later use Parameters: lsn optional LSN to add to the list, special values are: X, U, D, T for Xtra, Up, Down and This pos optional list index to store this sector number size optional number of list entries to fill with lsn Options: -c[:n] Clear or truncate the list to [n] lsn entries Output: none Remarks: The LSN memory can be listed using "list" [-f] _______________________________________________________________________________ MENU [pd] = Activate the menu, opening default or selected pulldown Purpose: Activate the menu-system, with the specified pulldown opened Parameters: letter optional First letter of the menu pulldown f = File e = Edit m = Mode=xxx a = Actions d = Display h = Help Output: none _______________________________________________________________________________ MENU2HTML [pd] = Generate HTML/PHP documentation for specified pull-down menu Purpose: Create up-to-date descriptions with help-texts and links to seperately created screen-shots for the specified pulldown. Parameters: letter optional First letter of the menu pulldown f = File e = Edit m = Mode=xxx a = Actions d = Display h = Help Options -f:filename : Filename for generated HTML or PHP -p:program : Prefix for PHP code, default 'dfsmenu' -m:leadtext : Chapter lead-text or number\n", c0); Output: none Remarks: The default filename will be constructed from the pulldown and prefix, as an example: dfsmenu-file.php Reference tags for each documented item will be generated to allow easy references to a specific item on a website. The tags are based on the menu-item/help id, shown in the help popup window when a menu-item is highlighted in DFSee Example reference for menu item 3110: .../dfsmenu-file.php#id03110 For the PHP version, screenshots will automatically be embedded if the corresponding .GIF files exist in the txmshots and txmshots/thumbs subdirectories. For the example above that could be: ../txmshots/id03110-1.gif ../txmshots/id03110-2.gif etc (upto -19.gif) and ../txmshots/thumbs/id03110.gif _______________________________________________________________________________ MODE [c,r] [-w-] = Set columns and rows for display, -w- is non-windowed Purpose: Change display size, and switch between windowed - classic Parameters: c optional Number of columns (screen width) 10 .. 102 r optional Number of rows (screen length) 1 .. 102 Options -w Use windowed mode (this is the default) -w- Use non-windowed, classic mode Output: none Remarks: The column and row may be specified as "col,row" as well The maximum column and row values might be limited more than specified here, depending on Operating System capabilities. Most often rows * columns must be 8192 or less. _______________________________________________________________________________ MOVE -b|-e | -f = Move towards Begin or End, or move/copy to Freespace area Purpose: Move partition towards begin/end of the disk within freespace or Move/Copy the partition to another selected freespace area Usage: MOVE -b[:offset] | -e[:offset [-f:fsp-id [-c [-l:x]]] [-a | -A-]-] Parameters: none Options: -P : Prompt for offset value to be used, in Mib or Cylinders -b : Move to exact begin of freespace area BEFORE partition -b:mcs-nr : Move towards begin freespace, offset from current pos. -e : Move to exact end of freespace area AFTER the partition -e:* : Move to exact end of freespace area specified with -f -e -f:[id] : Move to exact begin of freespace area selected with -f -e:mcs-nr : Move towards end fsp, offset from current (or start -f) -f:fsp-id : Move/Copy to fsp-area on same/other disk (implies -e) -c : Copy, not Move, do NOT delete original. (requires -f) -l:letter : Set preferred driveletter for new volume (requires -c) -a : Align resulting partition start to a cylinder boundary -A- : Do NOT align KiB and MiB values to track/cyl multiples -C- : Do NOT copy the contents of the partition, just Ptable The mcs-number format is [0x]nnnn[,g|m|k|c|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders or Sectors. Default is decimal MiB. Output: Calculated begin and end position of the CURRENT partition before and after the MOVE (old and new position). Then, after a final confirmation has been presented, the progress information for the involved DELETE, CLONE and CR commands will be shown. Examples: move -b:100 ;Move partition 100 MiB towards begin disk move -b ;Move partition all the way to begin fsp move -e ;Move partition all the way to end of fsp move -f:3 ;Move partition to begin of fsp-area 3 move -e:0 -a ;Move towards end, forcing Cyl. alignment move -e:10,k -a- ;Move 10 KiB towards the end, NO alignment move -f:2 -e:1,c ;Move to fsp-area 2, 1 cylinder from start move -f:5 -c ;Copy to fsp-area 5, keeping original too. move -f:7 -c -l:y ;Copy to fsp 7, use LVM-letter Q: on copy. Remarks: Moving a partition within a freespace area (-b or -e) allows the current and new location of the partition to overlap. This means it is OK to move a partition over a short distance like a single cylinder to make room for something else. In all cases you will have to let the operating system that wants to USE the moved/copied partition rediscover them. The safest way to do that is a BOOT of that operating system. When moving or copying a partition that is SEEN by the OS that is running DFSee, AVOID accessing the partition after the MOVE! Most MOVE operations are implemented using the commands: CLONE ;copy partition data to new location DELETE ;delete partition from Part-tables CR ;recreate partition in new location There will only be a very short period between the DELETE an the CR recreate, so data loss is unlikely. However, a MOVE to begin freespace (-b) with OVERLAP uses: DELETE ;delete partition from Part-tables CLONE ;copy partition data to new location CR ;recreate partition in new location This implies that there is NO partition definition in the partition tables while the data copying is taking place! Aborting the long running 'CLONE' with the key, or a power failure will therefore result in the partition being DELETED, and its data most likely lost. You will get an additional CONFIRMATION to warn you about this when appropriate. LVM information on MOVE operations is FULLY preserved and adjusted to the new physical location. Also any COPY of a single partition LVM-volume (move -c) will have complete and unique LVM-information, with names and IDs derived from the old ones and made unique using the new freespace-ID. WARNING: MOVE/COPY on a multiple partition LVM-volume is NOT SUPPORTED! Doing this will result in an inaccessible volume that will only be recoverable using LVM and DFSee if you know exactly what you are doing! After a MOVE, the partitions are intact but marked as 'available'. For recovery see below. After a COPY, the volumes/partitions will be cross linked, which is quite hard to recover from. The MOVE/COPY menu-items in the Actions menu will be disabled when such a partition is selected. This limitation may be removed in future versions of DFSee ... If you HAVE MOVED one or more partitions from such a volume the recovery for it would be roughly: 1) Recreate the volume using LVM.EXE and "from existing" Make sure you use the partitions in the original order. 2) In DFSee, select the FIRST partition (erased bootsector) and issue a "fs jfs" plus a "fixboot" command. 3) From the OS2 command line, issue a "CHKDSK x: /f" where x: is the driveletter of the JFS volume. Displayed driveletters after a COPY (move -c) for an LVM system might be incorrect for the new partition since the bootsectors are exactly the same. This will clear up if you change the LABEL of that partition (using the operating systems 'label' command). The alignment options -a and -A- should not be needed in normal cases, where the partitions are aligned already. They are required only if you want to: - move over a non-aligned distance in KiB/MiB (-A-) - move a non-aligned partition to an aligned position (-a ) _______________________________________________________________________________ PART [pid|d:|.] = Show partitions, or select one using pid or drive-letter Purpose: Select a disk partition for analysis or show a list of them Parameters: pid optional Absolute partition ID (PID) for the partition to select, as shown by a 'part' overview pid,r optional Relative partition ID, for specified or current disk, "1,r" is the first partition on that disk Note: ',r' is to be taken LITTERAL! To specify a specific disk use an aditional '-d:nr' option. d: optional Drive-letter for a partition (part C:) . optional Reselect the current partition if any, otherwise auto use the 'auto' PID as set by a CR or CLOSE command Options: -? or ? Show usage information for PART command -a Show allocation map for each or selected part -b[:blocksize] Table with decimal start/end/size (Linux, blocks) -c Perform a filesystem-check on each partition -C[:'str'] Compact space or 'str' separated partition list -d Display or select for current disk only -d:disknr Display or select for specified disknr only -e To add info on extended partitions to table -e:1 Info on 1st extended partition only (container) -F Force use of First EXT-container -f- Do NOT display any freespace lines -fs:'fsname' Set mode to filesystem 'fsname' on selected partition -g Show disk geometry too (implies -r) -i Industry std letter assignment (implies -r) -L[:0|1|2] Show preferred: none (0), LVM (1), Windows (2) -m Identify MBR, and show I13 limit (implies -g) -n To get a table with all numerical information -p- Do NOT display the actual partition lines -q Quiet, display minimal partition details -R Select the partition in Read-only mode -r Re-read partition tables from disk (refresh) -s To get a (comma) separated list of partitions -s[:'str'] Verbose comma or 'str' separated partition list requires 218 character wide display to show all -S Use double-Spaced lines with -s or -C formats -t or -t- Display partition table, or do NOT display it -u Add UUID 16-character string when supported by FS -v To get a multiple line verbose list (incl LVM) -V Verbose, including some partition contents -w or -w- Include ALL warnings or do NOT display any -w:selection Filter warnings using selection letters -w:0xMMMMMMMM Filter warnings using Hex mask (see below) -x[:'fs1 fs2'] Request the extra (resize) information 'fs' restricts to FS like 'NTFS FAT32' only in the 'part -s' and 'part -xml' formats. -xml Partition info in XML format to a file or STDOUT -label:XXX XML identifying string, default 'dfs' or 'ecs' -file:[name] XML name, default XXXdisks.rdf, -file- is STDOUT Output: Either the list of partitions in the specified format, or the verbose partition display for the selected partition. Remarks: The return code (rc) will be zero for a valid partition id or the number of partitions otherwise (useful in REXX scripts). To select a relative partition on a specified disk, use the 'pid,r' syntax combined with a '-d:disk-nr' option, example: part 3,r -d:2 ;select 3rd partition on disk 2 The 'Vol' column might show discrepancies between the actual driveletter as currently seen/used by the operating system, and some other administration like LVM-info or the Windows DosDevice mapping. This indicated by the ':' being replaced by the lowercase PREFERRED driveletter. Some examples: >C: ;active C:, actual same as preferred LVM/Windows D: ;D: drive, actual same as preferred LVM/Windows Eh ;E: drive as actual, H: as preferred LVM/Windows -e ;NO drive as actual, E: as preferred LVM/Windows E- ;bootsector same as actual E:, but NO LVM letter or a preferred windows driveletter 'Eh' as shown by DFSee would show as "H->E:" by LVM.EXE The -L option controls what 'preferred' driveletters are used -L:0 (or -L-) Means NO preferred driveletters (actuals only) -L:1 Means to check LVM-preferred driveletters -L:2 Means to check Windows DosDevice letters (-L:2 only available in DFSWIN.EXE) For DFSWIN.EXE, the default is "-L:2" otherwise it is "-L:1" The maximum number of partitions handled by DFSee is 1000, on a maximum of 24 different physical disks. Some useful filter values to be used with the "-w:" option are: a or 0x0000ec00 Show cylinder alignment warnings b or 0x00070000 Show IBM BootManager related warnings c or 0x000000f0 Show CHS related warnings only f or 0x00000008 Show not formatted warnings only i or 0x00000006 Show INT13 limit related warnings only m or 0x0000003f Show all minor warnings M or 0xffffffc0 Show all Major warnings s or 0x03f00000 Show size overlap related warnings x or 0x04000000 Show extended-container type 0x0f warnings * or 0xffffffff Show ALL warnings Hex values can be combined (added) for more complex selections An LVM type volume with multiple partitions (disk spanning, JFS) will be selected correctly, every partition belonging to the set will be searched until the one with a valid bootsector has been found. (only THAT partition will be usable from DFSee) To show the table with ALL info completely visible, the screen size should have a certain minimum width (columns): PART 114 columns when showing LVM-style labels PART -s 218 columns standard CSV formatted output PART -s -x 253 columns extended CSV formatted output Examples: An example of the list output in table form (default) is: DFSee OS/2 8.09 : Executing: part -r -m Number of disks : 4 P-Geo Disk 1 Cyl : 16383 H: 16 S:63 Bps:512 Size : 0x0950F8B0 = 76319.1 MiB L-Geo Disk 1 Cyl : 10337 H:240 S:63 Bps:512 Size : 0x0950E110 = 76316.1 MiB BIOS Int13 limit : 1024 cylinders, limiting to Size : 7560.0 MiB MBR crc c51e1623 : 0x7ea9d168 = IBM OS/2 LVM, 14.105 May 2006 .. (disk 2 and 3 are like 4 :-) P-Geo Disk 4 Cyl : 0 H: 0 S:0 Bps:512 Size : 0x00000000 = 0.0 KiB L-Geo Disk 4 Cyl : 512 H: 12 S:32 Bps:512 Size : 0x00030000 = 96.0 MiB Error, disk 4 PD4 : reading the MBR info in the 1st sector failed! DUMMY, disk 4 seems reserved with no media present (USB/PCCARD etc) ÚÄÄÄÂÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÂÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄ¿ ³ID ³Dr³Type, description³ux³Format³Related ³VolumeLabel³LVM Volume, Partit³Size MiB³ ÃÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ ³01*³ ³Prim 07 Inst-FSys³ 1³NTFS ³Win NT ³WinXpPro ³WinXP, IBM-preload³ 12344.0³ ³02>³ ³Prim 0a IBM-BMGR ³ 2³BMGR ³LVM ³I13X-aware ³, [ BOOT MANAGER ]³ 7.3³ ³03*³D:³Log 07 Inst-FSys³ 5³HPFS ³IBM 4.50³ECS12 ³eCS12, Clean insta³ 1114.7³ ³04 ³E:³Log 06 FAT16 ³ 6³FAT16 ³MSDOS5.0³DEVELOP ³Develop, FAT - 20³ 2045.0³ ³05 ³F:³Log 07 Inst-FSys³ 7³NTFS ³Win NT ³Fotos ³Fotos, XPdata ³ 19195.2³ ³06*³G:³Log 07 Inst-FSys³ 8³HPFS ³IBM 4.50³ECS1024X768³eCS768, Cisco350 W³ 1114.7³ ³07 ³H:³Log 07 Inst-FSys³ 9³HPFS ³IBM 4.50³HDRIVE-T42 ³Data, OS2-big ³ 12351.4³ ³08 ³V:³Log 35 Warp-LVM ³10³JFS ³IBM 4.50³Virtuals ³VPC, Virtual space³ 10107.0³ ³09*³M:³Log 07 Inst-FSys³11³HPFS ³IBM 4.50³ECS12R ³eCS12r, 2200 WiFi ³ 1114.7³ ³10*³-o³Log 07 Inst-FSys³12³JFS ³IBM 4.50³CENTRINO ³Centrino, Intel220³ 1114.7³ ³11 ³L:³Log 0c FAT32-Ext³13³FAT32 ³DFSee7.x³LONGNAMEFS ³LFN-exchange, f32-³ 4444.4³ ³12 ³ ³Log 07 Inst-FSys³14³NTFS ³Win NT ³New Volume ³NTFStest, Expand-h³ 5101.4³ ³13 ³U:³Log 35 Warp-LVM ³15³JFS ³IBM 4.50³WSE-DEMOJFS³Demo-JFS, wse2006-³ 3004.7³ ³14 ³ ³FreeSpace Pri/Log³ ³-- -- ³-- -- --³- - - - - -³ ³ 3255.8³ ÀÄÄÄÁÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÁÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÙ Number of disks = The number of disks reported by the system Ph-Geo disk n ... = Physical geometry for disk 'n' (using extended-INT13, BIOS) LogGeo disk n ... = Geometry for the same disk 'n', as reported by the OS BIOS Int13 limit = Size of the disk that can be used with regular int13 (BIOS) MBR code ........ = Identifying checksum plus description for the MBR-code Id nn=d: WARNING = Any informal, strange or alarming conditions on partition Where: ID = The selection-id used by DFSee for this partition Postfix: '>' for active partition, any disk '!' active partition, bad bootsector '*' for partitions bootable by BMGR '-' bootable by BMGR, bad bootsector 'r' Removable device, can be ejected 'R' Removable AND Active or Bootable Dr D: = Actual drive letter, capital including a colon, indicates partition is accessible as volume D: -d = Drive 'D:' in LVM (preferred), but NOT mounted Fd = Drive 'D:' in LVM (preferred), but mounted as F: will be displayed in LVM itself as: 'D: ==> F:' D2 D3 = Second or 3rd partition of a multiple LVM volume Type, description = Type info and hex value of the type, type info: Prim = Primary (active, accessible) Hide = Hidden (primary or special) Log = Logical volume in an extended partition Lhid = Logical volume, currently hidden ux = The device number as used by Unix/Linux with /dev/.d. Format = The filesystem format string as found in the bootrecord for the partition or special values: "none" if not formatted at all (no AA55 signature) "unknown" if signature present but unrecognized Creator = The OEM identification string from the bootrec of "unknown" if no valid bootrecord is found For IBM BMGR it can be either FDISK or LVM VolumeLabel = The volume label as found in the bootrecord, or the BootManager version indicator for IBM BMGR: "I13X-aware" means BMGR supprts boot > cyl 1023 "MaxCyl:1023" means BMGR can NOT boot > cyl 1023 BM-Name = The name for this partition as registered in the OS/2 BootManager data area LVM Volume, Part = The full LVM volume and partition names (replaces BM-name when LVM info present on disk) Size MiB = The gross size of the partition in Mibibytes In the table, just above the actual partitions, the Linux device name, disk number and descriptive (LVM or DFSee created) name for the disk will be shown. An example of the list output in decimal block form is: DFSee OS/2 8.09 : Executing: part -b ÚÄÄÄÂÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÂÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄ¿ ³ID ³Dr³Type, description³ux³ Fmt ³ Cylinders ³BeginSect³EndSector³ Sectors³Size MiB³ ÃÄÄÄÅÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ ³01*³ ³Prim 07 Inst-FSys³ 1³NTFS ³ 0 - 1671³ 63³ 25280639³25280577³ 12344.0³ ³02>³ ³Prim 0a IBM-BMGR ³ 2³BMGR ³1672 - 1672³ 25280640³ 25295759³ 15120³ 7.3³ ³03*³D:³Log 07 Inst-FSys³ 5³HPFS ³1673 - 1823³ 25295823³ 27578879³ 2283057³ 1114.7³ ³04 ³E:³Log 06 FAT16 ³ 6³FAT16³1824 - 2100³ 27578943³ 31767119³ 4188177³ 2045.0³ ³05 ³F:³Log 07 Inst-FSys³ 7³NTFS ³2101 - 4700³ 31767183³ 71079119³39311937³ 19195.2³ ³06*³G:³Log 07 Inst-FSys³ 8³HPFS ³4701 - 4851³ 71079183³ 73362239³ 2283057³ 1114.7³ ³07 ³H:³Log 07 Inst-FSys³ 9³HPFS ³4852 - 6524³ 73362303³ 98657999³25295697³ 12351.4³ ³08 ³V:³Log 35 Warp-LVM ³10³JFS ³6525 - 7893³ 98658063³119357279³20699217³ 10107.0³ ³09*³M:³Log 07 Inst-FSys³11³HPFS ³7894 - 8044³119357343³121640399³ 2283057³ 1114.7³ ³10*³-o³Log 07 Inst-FSys³12³JFS ³8045 - 8195³121640463³123923519³ 2283057³ 1114.7³ ³11 ³L:³Log 0c FAT32-Ext³13³FAT32³8196 - 8797³123923583³133025759³ 9102177³ 4444.4³ ³12 ³ ³Log 07 Inst-FSys³14³NTFS ³8798 - 9488³133025823³143473679³10447857³ 5101.4³ ³13 ³U:³Log 35 Warp-LVM ³15³JFS ³9489 - 9895³143473743³149627519³ 6153777³ 3004.7³ ³14 ³ ³FreeSpace Pri/Log³ ³ ³9896 -10336³149627520³156295439³ 6667920³ 3255.8³ ÀÄÄÄÁÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÁÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÙ The decimal start/end/size information shown is in BLOCKS with a default blocksize of 1 sector. Different sizes can be specified on the -b option. For example to display using a 1Kb blocksize use: 'part -b:2' An example of a list fragment for verbose form (HPFS) is: DFS partition Id : 08 disk nr : 1 = FixedDisk Diskgeo = Cyl:14946 H:255 S:63 P-table for this : 017FE09E = EBR:5, entry:0 Previous P-table: EBR:4, entry:1 System Indicator : 07 = Inst-FSys Linux-devicename: /dev/hda9 FileSyst. format : HPFS Partition type : Logical Visible Bootrec-OEM-name: IBM 4.50 Partition Label : OS2DATA Boot capability : Not bootable by BIOS and MBR-code or OS/2 boot manager Bootsec checksum : B8FE2D50 Bootsect. offset : 0000003F = 63 Dec Cylinder size : 3ec1 = 7.84 MiB P-table in EBR : -000003f = i13: 00 81 1e = Cyl: 1566 H: 0 S: 1 = 017fe09e 1st part sector : 00000000 = i13: 01 81 1e = Cyl: 1566 H: 1 S: 1 = 017fe0dd Last part sector : 0181d666 = i13: fe 3f 43 = Cyl: 3139 H:254 S:63 = 0301b743 Partition size : 0181D667 = 12346.8 MiB = 1573.996 cylinders Cluster size : 00000001 = 0.5 KiB in 1 sector(s) of 512 bytes LVM Ph disk name : Maxtor 114.5 GiB Drive letter: H LVM partition : OS2-big Volume name : Data OS reported free : H: Free 5714.2 MiB of 12346.8 MiB, on filesystem: HPFS Pid08=H: minor-W : Starts after cyl 1023, problem for older BIOSs/DOS (Int13) Bootsec. checksum : B8FE2D50 --------------------------- end of PART command ----------------------------- _______________________________________________________________________________ PSN xx = Analyse & display sector using PSN xx Purpose: Display sector using Physical Sector Number addressing Parameters: xx = physical sector number, decimal or 0x prefixed hex Output: Sector display, format selected based on sector contents Remarks: Output that scrolls off the screen can be repeated using the 't' command. (display 'this' sector) _______________________________________________________________________________ PRITEMS x [name] = Set number of items/passes for the progress indicators Purpose: Allow multiple items to be individually tracked with a progress indicator like: "13% pass 1 of 3" Parameters: x optional Total number of items/passes to be done name optional Name to presented (partition, pass etc) Output: none Remarks: This command is intended to be used from automated scripts and other built-in commands, to allow a 0 .. 100% progress to be shown for each item, while still informing the user of the total progress. Items could be passes in multi-pass operations (SECUREWIPE) or partitions being imaged to a file or whatever ... _______________________________________________________________________________ PT [*|pid|drive] = Display partition table for current or specified pid/drive Purpose: Quickly show the partition table of a partition, and possibly navigate to related LVM information and the bootsector Parameters: pid optional partition id to show table for drive optional driveletter for the partition * optional show info for ALL partitions Options: -r Display related bootsector and LVM info too -d restrict 'all partitions' to current disk only -d:disknr restrict 'all partitions' to disknr Output: Display of the partition table entries in the sector (max 4) Remarks: In the Mode=FDISK, the 'pid' parameter is NOT optional When a partition table is displayed, it is quite easy to navigate to some related information using single letter commands 'd' (or , 'x' and 'u'. The corresponding PSN values are displayed in the status line of DFSee. An overview of this navigation is shown below: ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³Partition table³ÄÄÄxÄÄ>³LVM information³ÄÄÄuÄÄ>³LVM signature³ ÚÄijsector for pid ³<ÄÄxÄÄijsector (DLAT) ³<ÄÄdÄÄijsector ³ ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ³ ^ ³ ^ ³ ³ ³ ³ ³ ³ ³ ³ d u u x d u ³ ³ ³ ³ ³ ³ ³ ÚÄÄÄÄÄ ³ ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ³ ÀÄ>³Next ³ ÀÄ>³Boot sector for³<ÄÙ ³ ³Ptable ÀÄÄÄÄÄÄijthe partition ³<ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ÀÄÄÄÄÄÄ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ _______________________________________________________________________________ PTE [pid|xx [e]] = Show & edit partition table at sector [xx] or part [pid] Purpose: Interactive smart editing of partition tables (PTEdit) Parameters: pid optional partition id to edit table for xx optional sector number with partition table e optional entrynumber 1..4 to get 1st focus Options: -f Force adding 0x55AA signature if not present -s- Turn smart field updating off, startup default is on", -d:disknr disk to edit partition tables on, default current -p:part partition to edit table for, number or letter -i:img image filename containing the partition table (should be a disk image to be useful :-) Output: Single line per partition table sector updated (or not). All other output is in the interactive edit dialog window. Examples: pte -part:5 ;PTEdit on table for partition 05 pte -p:H ;PTEdit on table for drive H: pte -d:2 ;PTEdit on disk 2, MBR table Or, directly from the Operating System command line: DFSDOS pte -p:5 ;PTEdit on table for partition 05 DFSOS2 pte -part:H ;PTEdit on table for drive H: DFSOS2 pte -disk:2 ;PTEdit on disk 2, MBR table Remarks: Can only be used in WINDOWED mode (default, or set with -w) Activated with default values by using the function key There is extensive help-information for each separate field in the edit-dialog, as always activated with the key. A second while in that help, will show the generic help for the PTEdit dialog as a whole. Changes to a partition table are written back after an extra confirmation dialog after pressing any of the following keys: Write back changes, end PTEdit interactive session Write back changes, continue on NEXT partition table Write back changes, continue on PREV partition table Cancel any changes, end PTEdit interactive session With 'smart field update' active, it is very easy to keep all fields in a partition table entry consistent. Updating the linear sector values (LBA) will also update the CHS fields and vice versa. The PTEdit dialog is extrememly useful for interactive update of the 'active' flag, the system type and the size (and ending CHS) for a partition as well as updating the starting sector (and CHS) for primary partition. To change the starting sector (and CHS) for a logical partition, it is better to use the DELETE and CREATE commands because it requires relocation of the partition table and not just updating its values. While the dialog is up, commands that are started using a function key can still be executed. (F4 .. F9 are useful) The output in the "text output window" can still be scrolled using + arrow keys or + PgDn/PgUp. _______________________________________________________________________________ q = Quit DFSee OS2: 5.55 06-11-2003 (c) 1994-2003; Jan van Wijk Purpose: Exit DFS program Remarks: Opened physical disk and logfile will be closed on exit Asynchronous running threads will be aborted. _______________________________________________________________________________ QUERY [item] [n] = Query specified item value for disk/partition/freesp [n] Purpose: Extract exactly one numeric value from the table with disk and partition info. Display it and return in exit-code (RC) Parameters: item optional specifier for the information-item to query. '?' or -? will give usage information. 2 or 3 chars (uppercased) are significant When no item is specified, a compact table with partition info is shown ('part -C -m') n optional Partition id or disk-number for this query Usage: QUERY info-specifier [disk, partition or freespace-nr; or 0 for highest] Note: All values are ROUNDED DOWN to fit a 16-bit integer value! Without parameters, a compact partition list is shown (like 'part -C -m') PArts = # partitions FRee = free exists DIsks = # disks present PValid = P# valid = 0 FValid = F# valid = 0 DValid = Disk-nr valid = 0 PLet = Drive-letter FLog = log possible DLog = # logical partitions PPrim = is a primary FPrim = pri possible DPrim = # primary partitions PType = part type FType = freesp type DTotal = # partitions on disk PCyls = # cylinders FCyls = # cylinders DCyls = # cylinders on disk PHeads = # heads FHeads = # heads DHeads = # heads PSects = # sectors FSects = # sectors DSects = # sectors/track PKiB = P-size in KiB FKiB = freesp in KiB DKiB = Cylinder size in KiB PMiB = P-size in MiB FMiB = freesp in MiB DMiB = Disk size in MiB PGiB = P-size in GiB FGiB = freesp in GiB DGiB = Disk size in GiB PDisk = Disk-number FDisk = Disk-number DFree = # freespace areas PFirst = First cyl. FFirst = First cyl. DFMiB = freespace disk in MiB PEnd = Last cyl. FEnd = Last cyl. DFGiB = freespace disk in GiB P-clus = sect/cluster FId = freesp id DBmgr = IBM BootMgr present PName = LVM present Lvm = LVM present DNames = #parts with LVM info POk = Status 0=clean, 1=unknown 2=dirty DX = #parts without LVM PInfo = 1st FS-letter P0mft = MFT fragments PBtini = Win BOOT.INI OK = 0 MKiB Minimum GKiB Grabable UKiB XKiB Maximum EKiB Maximum MMiB = size of GMiB = freed on UMiB = Used XMiB = freespace EMiB = expand MGiB filesys GGiB resizing UGiB size XGiB (defrag) EGiB size Cyls = # of cylinders, current geometry Version = DFSee major version nr Heads = # of heads, current geometry VMinor = DFSee minor version nr Sects = # of sectors, current geometry RValid = Registration valid = 0 Output: Two lines with the command, the resulting value in HEX and decimal, and the used partition/freespace and/or disk-number. The DFS return code (exit RC) is set to the queried value. For some commands, extra output will show selecting the partition in question, to get FS-specific information For QUERY with a numeric or no parameter at all, the output will be that of "part -C -m" followed by the query parameters. Remarks: When given as the first (or only) command on DFSee invocation, and with any parameter, this command will automatically QUIT on completion, making batch file syntax more readable. This command is VERY useful in batch/command files to base program flow on certain disk/partition characteristics Example: batch file to test if a partition is a primary one: dfsdos query Primary 2 if errorlevel 1 goto PRIMARY :LOGICAL echo Partition 2 is a logical partition goto end :PRIMARY echo Partition 2 is a primary partition :END The 'compact' list is intended for email/newsgroup postings Some examples of useful partition queries are: query ;compact list all partitions query -v ;verbose list all partitions query -m- -d:2 ;just disk 2 query -C- -m- ;the standard 'framed' table query -t- -m- -w ;list warnings only query 3 ;show partition 3 query -disk:2 1,r ;show 1st partition on disk 2 _______________________________________________________________________________ RECOVER path sel = Recover files from sector list to a path, using selection Purpose: Undelete multiple files using (a selection from) a list Parameters: path optional Path to save the file copy, default is last path used, initial value is "." which is the current working directory sel optional File selection parameters, in the form: wildcard%threshold (sometimes shown as [w%t] in usage) wildcard = wildcard selection for display/recover threshold = +nn = Minimum allocation OK percentage or -nn = Maximum allocation OK percentage default: *%100 ==> only recover 100% ones Options: -8.3 Force 8.3 names on output, as required on most FAT16 -u Force unique names using hex sector number prefix -E:i Ignore errors, continue execution when RC is not 0 -E:q Quit on any errors, exit (default when in batch mode) -E:c Confirm with user on errors (default when interactive) -O:q Quiet mode, just report on errors -O:v Verbose mode, include progress indicator 'dots' -O:m Maximum verbose mode, include 'skipping' messages Output: All files are recovered one by one using the "saveto" command automatically on each selected LSN from the list. Note: Operations using the sector list on FAT/FAT32 like SAVETO are limitted to 64 GiB partitions by design! Progress is reported with output like the "ca" command, depending on the specified output verbosity (-O:) Error messages will be given as appropriate. The default error strategy (-E:) is 'quit' for batch mode and 'confirm' otherwise, unless overruled by the global switch -E: on DFSee startup Remarks: See "saveto" and "delshow" command LSN list is the find-result list as shown with "delshow" It can be edited using "export" or "log" + "delshow" and imported again using "import", to make specific selections Only the file contents is recovered, date&time and attributes are lost. If no directory is specified it will default to the last one used for saveto. This directory should be on ANOTHER drive! If a path for the deleted file can be resolved, it will be included in the saved copy whenever possible. If the directories do not exist they will be created. This means a whole directory tree can be undeleted in one operation, while retaining the structure. For HPFS filesystems, the names used will be significant in the first 15 characters only, the rest of the name will be replaced by hyphens ('-'). This is needed because the FNODE only stores the first 15 characters of the name. When the destination does NOT support long filenames (FAT) all names will be converted to an 8.3 compatible format. If a combined filename+path would exceed the allowed length for the destination directory (and operating system) the path and filename will be truncated or abbreviated to get it within limits. Although this will NOT guarantee that the whole recovered directory tree has consistent naming it DOES guarantee unique filenames and paths. _______________________________________________________________________________ TxPrint("\n Usage: %s [options] command\n\n" " command = String with multiple commands (% separators)\n" " -r:nr = Repetition count, FOREVER when not specified\n" " -E:i = Ignore, do not quit on command errors\n" " -v = Verbose, announce each itteration\n" " -v- = No command echo, no promptline\n", c0); TxPrint("\n Command string can use substitution for:\n" " $0 = itteration count 1..n\n\n" " Abort repeating using the key ...\n"); REPEAT [command] = Repeat a (multi) command string, counted or forever ... Usage: REPEAT [-r:n] [-v | -v-] command Purpose: Repeat a command forever, or for a specified number of times usually for (stress) testing purposes Parameters command A complete DFSee command-string including parameters and options for the command. It can be a multi-command as well, with more than one command seperated by '%' Options -r:nr = Repetition count, FOREVER when not specified -E:i = Ignore, do not quit on command errors -v = Verbose, announce each itteration -v- = No command echo, no promptline Example repeat -r:5 say Hello number $0 %sleep $0 This will use the 'say' command to display 5 'Hello' lines with the current number displayed, each followed by DFSee 'sleeping' for that same number of seconds. repeat -r:999 log scan-$0 %scan -w This will repeat a full-read/write scan for bad sectors on the currently selected object, logging to a specific file for each itteration. Stops after 999 itterations or when the key is used ... Output: Regular output for the command(s), with the addition of the current itteration being displayed, when speified with -v Remarks: The key will abort the repetition The command string can use substitution of the '$0' symbol to identify the current itteration step, value 1 .. n Multiple commands must be separated with '%' instead of the regular '#' character. Otherwise the rest of the commands will not be part of the repetition and only be executed once after the repetition ends. _______________________________________________________________________________ RESIZE [options] = Resize FS to new size, including partition table update TRUNC Usage: RESIZE size | -size:new | -s | -free:size | -f | -m Purpose: Make a filesystem in a partition on a disk smaller, usually to allow creation of another partition. Typical use: create freespace to install a new Operating System WARNING: Resizing a filesystem is one of the most dangerous operations, with many reasons why it might not work correctly. Do NOT resize a filesystem unless you have a tested BACKUP of the data, or the data is easily replaced by other means. Parameters size optional Specifies remaining filesystem/partition size Without a specified size, the user will be prompted for the desired new size. Options -s:new New remaining size as mcs-number -s Split partition in half -f:size Size to free-up as mcs-number -f Free-up half the available size -m Maximum size, resize FS to partition size -F Force resize even if smaller than indicated minimum size. Can be useful if allocation information is not correct. -c:[0|1|2] CHS style: 1=PQMagic, 2=MS, default 0=IBM/DFSee To override the global style being used. Output: Progress, calculated new sizes and partition end position, plus a confirmation message when not working in batch mode. Finally a success or failure message. Examples: resize -f:1000 ;Create a freespace of 1000 MiB resize -f:1,c ;Create a freespace of 1 cylinder (BMGR) resize -s:5000 ;Keep 5000 MiB in the current partition, ;making the rest available as freespace resize -max ;Make FS equal to the partition size, ;useful to expand HPFS/NTFS filesystems ;after making the partition itself larger Remarks: The resulting freespace will always be AFTER the remaining partition, the start of that partition will stay in the same location on the disk. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. The RESIZE command is implemented as a generic command, but requires a filesystem dependent part to be implemented. Currently that is only available for FAT, FAT32, HPFS and NTFS Following a RESIZE operation, a 'CHKDSK /f' may be performed on the filesystem, from an operating system that supports it. In most cases, that CHKDSK will be performed automatically. For HPFS this CHKDSK is mandatory, since it finishes the resize by updating the allocation bitmaps to represent the new size. For NTFS it is optional. The filesystem is left in a perfect clean state, with all bitmaps and other size information set to represent the new size. For FAT(32) the implementation is quite safe because only the partition bootsector and the partition table entry are modified. Interruption (like power failure) might result in a truncated filesystem in a large (unmodified) partition, but never in a corrupted or otherwise damaged filesystem. The new size for a FAT partition can be any size larger than indicated by the 'alloc' command, and smaller than the current size. It will be rounded to cylinder boundaries automatically. When the desired new size is not possible because the last used cluster is located too close to the end, you might want to run a DEFRAGMENT on it with another utility, or the built-in tools found in several Windows Operating Systems. The smallest size possible at any time is shown at the end of the 'alloc' display which is displayed when opening the partition from the menu. _______________________________________________________________________________ RESTORE file = Restore an imagefile to the currently selected object Purpose: Write sectors back from an image to opened partition or volume Parameters: file Filename for the image, default extension is '.img' When the 'img' parameter ends in a '\' for a directory, or there is no parameter at all, a list of available imagefiles is displayed, plus a usage text. When prefixed with [lpt.exe], the data is actually read from named pipe \pipe\xxx.img from LPT.EXE which will be started in a separate session automatically This allows retrieving the image from a different PC that is attached using a parallel (laplink) cable. f First sector number to be written, or: . or 'this' = current sector 'this' .NNN = value from sector list default: 0 s Size to write, in sectors, or: . or 'this' = up to current sector 'this' $ or 'all' or 'end = up to end of current volume/disk .NNN = up to value from sector list default: $ Note: Parameters 'f' and 's' are intended for backward compatibility mainly, using the options '-F' and '-s' respectively is recommended. Options: -F:n First sector as mcs-number, default 0 -s:n Size to be restored as mcs-number, default ALL -L Exclude LVM signature area from image (LVM/JFS) -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. -b:sectors Number of sectors to buffer, the default is to use the current number of sectors per track (18 for diskettes, usually 63 for harddisks) The maximum is automatically limited to the available buffer memory. -test Test only, no actual writing to the current object -c Compare image data against data in current object, stops at first difference found (implies -t test) -v Verify of imagefile integrity, displays details on every handled block of data (63 sectors) like length, compression and CRC-32 when available. -S Calculate size to restore from the imagefile itself overruling the current size of the object. For RAW imagefiles (IMG) this is from the filesize, and for compressed (IMZ) it is taken from the header. -D[:disk] Use option dialog to restore to a disk -I[:"image"] Use option dialog to restore to an imagefile -P[:pid] Use option dialog to restore to a partition -V[:vol] Use option dialog to restore to a volume Note: When a volume corresponds to a partition, using the -P option is STRONGLY recommended! -! Force option dialog to be used, even when sufficient parameters are specified. In this case, only the image file name will be passed to the dialog, other options are ignored and need to be set in the dialog itself. Output: progress information Remarks: You MUST select the disk/partition to write TO (destination) BEFORE using the RESTORE command itself (or the menu item). On the RESTORE command itself, or with the menu-item, you will select the imagefile to be restored FROM (source). You CAN NOT restore an image to freespace, partitions are not created automatically, you MUST do that manually. Compressed image-files created by IMAGE will be recognized and automatically decompressed on the fly. Note: When using compression, the number of sectors used for buffering MUST be the same as used with the IMAGE command, and must be less than or equal to the number of sectors per track or the RESTORE wil fail! The -S option is useful when expanding an IMZ file to a RAW image, but is also useful to enhance progress-reporting when restoring a small IMZ file to a large object. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. Smart imaging is automatically supported as well, files that have been created using this option on the 'IMAGE' command do not have any data for empty sectors/clusters, and will cause these areas to be skipped on the writing, saving a lot of time. For Windows-NT with NTFS and OS/2 versions with a kernel 4.50 or newer with JFS, the files CAN exceed 2GiB (large file support). If the image consists of multiple files (.002/.003 etc) these will all be automatically written, when a file is not found (removable media) the user will be prompted to insert the next medium containing that file ... To verify the integrity of a .IMZ compressed image, without actually restoring it, use the "-t -v" options together. The WRIM command is an alias for RESTORE (deprecated) _______________________________________________________________________________ RUN [script] [p] = Run a DFSee script, with optional parameters and options Purpose: Execute a NATIVE (or REXX) DFSee script with multiple commands Parameters: script optional The name of the script file. If no extension is given a '.DFS' extension will be appended. When there are any spaces in the name, it should be enclosed in quotes! p optional Arguments to be passed as parameters. Up to 9 arguments can be specified and can be used anywhere in the script as '$1' to '$9' while $0 is the script filename (no extension) Arguments can be enclosed in single or double- quotes to allow spaces or special characters Options: -P Prompt for the script filename and/or parameters. This will present dialogs where the script to run and any arguments to use can be specified. When parameters are specified with the -P option, the first one (script) MUST be one of: - A wildcard (with * or ?) to select a script from the current directory. - A relative or absolute path to find the script in -v verbose, show details about running the script -p- no prompting or command echo by the command handler -p:1 echo command by handler, but no prompting afterwards -p:2 no echo by handler, but prompting afterwards -p:3 echo before, and prompt after executing (default) -E:i ignore errors, continue execution when RC is not 0 -E:q quit on any errors, exit (default when in batch mode) -E:c confirm by user on errors (default when interactive) -s single step, confirm each line before executing it -q quit DFSee after executing the script Examples: run ;Present filedialog for scripts in current dir run hello ;Run a script called hello.dfs in current dir run -P do* ;Present dialog for 'do*.dfs' in current dir run -P a:\ ;Present dialog for scripts on the A:\ drive Output: SCRIPT progress when running in verbose mode, confirmation dialogs on errors, and regular output from executed commands Remarks: Whenever a filedialog is presented to select a script, there will be an additional prompt box to specify any arguments to be passed to the selected script. All lines in the script that do NOT start with a ';' in the first column, are sent to the command handler inside DFSee to be executed as a command. These commands can be multiple commands as usual (using '#' separators) and can also contain additional comment at the end of the command using ';' as a start-comment symbol. When using the -E:confirm or E:quit types of error handling, every return code from a command that is not 0 will cause either the confirmation dialog, or terminate the script. The return code (RC) for the whole script will be that of the last command that is executed in the script itself. Native scripts can RUN other scripts (nesting) but are limited to about 10 levels of nesting. OS2 REXX: In the OS2 version of DFSee scripts can also be written using the REXX language and the built-in DFSee REXX support. For a description see the DFSCRIPT.TXT documentation file. For an example REXX-script see DFSINFO.CMD _______________________________________________________________________________ S2CL lsn = Translate LSN to cluster number and display that Purpose: Display hexadecimal cluster number for specified sector (LSN) Parameters: lsn optional Sector number 0 .. max-sector Output: Sector number (LSN) and corresponding cluster number Remarks: none _______________________________________________________________________________ SAVETO [d][l][n] = Save filedata for current file to new file, optional rename Purpose: Recover a file based on its directory entry and FAT/FNODE/MFT, by a sector by-sector copy of its data to a new file. Parameters: d optional Path to save the file copy, default a:\ l optional LSN representing the file to recover HPFS: LSN of the file FNODE NTFS: LSN of the MFT-record FAT: Combined LSN of directory+entry nr n optional New name for the file (rename on copy) Options: -8.3 Force 8.3 names on output -u Force unique names using hex prefix -O:q Quiet mode, just report on errors -O:v Verbose mode, include progress indicator 'dots' -O:m Maximum verbose mode, include 'skipping' messages Output: Progress is reported with one RED or GREEN dot for each sector a '¯' character for each allocation-extent and somtimes a 'ä' for even higher-level allocation sets. (HPFS alloc sectors) Remarks: Only the file contents is recovered, date&time and attributes are lost. If no directory is specified it will default to the last one used for saveto. This directory should be on ANOTHER drive! When the destination does NOT support long filenames (FAT) all names will be converted to an 8.3 compatible format. Note: Operations using the sector list on FAT/FAT32 like SAVETO are limitted to 64 GiB partitions by design! _______________________________________________________________________________ SCL clsize = Force cluster size to specified value (decimal, sectors) Purpose: Force a specific number of sectors per cluster Parameters: clsize mandatory Number of sectors per cluster (decimal) Output: none Remarks: Should be automatically correct, special purpose usage only _______________________________________________________________________________ SERIAL [serial] = Set new Volume serial Number in the bootsector for a FS Purpose: Set a volume serial number for filesystems that support it Parameters: serial optional New volume serial number Options -! Force input dialog for a new value Output: Progress information Remarks: The volume serial number is a field in the bootsector, used by many but not all filesystems to uniquely identify this volume. It can be in in different places in the bootsector, depending on the filesystem being used. DFSee recognizes, and can update the serialnumber for FAT12, FAT16, FAT32, NTFS, HPFS and JFS. Originally intended to identify removeable media like diskettes it is still being used by some operating systems and disk tools and should normally be UNIQUE for the whole system. Duplicates may occur when CLONING partitions, or when using IMAGING to save and restore partition contents. unless these cpies of partitions are intended for backup purposes only, it is advised to make the copies unique by changing the volume serial number using the 'serial' command or the corresponding menu item in the 'Mode=xx' menu. Duplicate serialnumbers may cause DFSee to display incorrect driveletters for the original and the copy of it. DFSee will display BOTH assigned driveletters in case of doubt, and issue a verbose warning with the PART display as well. _______________________________________________________________________________ SHIFTL [options] = Shift data inside sectors towards beginning (aka LEFT) Purpose: Move bytes WITHIN a sector towards the beginning (shift left) Options -l:bytes Number of bytes to shift, 1 .. 511 default 2 -s:size Size of area to shift, as mcs-number default 1 -F:sector First sector of area to shift, default 0 Output: Progress information Remarks: The first '-l' bytes in the first sector will be lost, and the last '-l' bytes in the LAST sector handled will remain there as duplicates of the bytes shifted left. They would need manual correction using 'edit' when important. _______________________________________________________________________________ SHIFTR [options] = Shift data inside sectors towards the end (aka RIGHT) Purpose: Move bytes WITHIN a sector towards the end (shift right) Options -l:bytes Number of bytes to shift, 1 .. 511 default 2 -s:size Size of area to shift, as mcs-number default 1 -F:sector First sector of area to shift, default 0 Output: Progress information Remarks: The last '-l' bytes in the last sector will be lost, and the first '-l' bytes in the FIRST sector handled will remain there as duplicates of the bytes shifted right. They would need manual correction using 'edit' when important. _______________________________________________________________________________ SHOW [s] = Hex-dump current sector (or half-sector), s sectors/bytes Purpose: Display current (last read, edited) sector in hex-dump format Parameters: s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default size is 512 bytes for 'SHOW' and half that, 256 bytes for 'show' Output: Hex-dump of the sector, see the 'h' and 'H' commands Remarks: The main difference with 'h' and 'H' are that the current contents of the sector buffer (possibly changed by an 'edit') are shown. 'h' and 'H' will first read a sector from disk. _______________________________________________________________________________ SCAN [-w] = Scan bad sectors; use Read or Read/Inverse/Write/Verify Purpose: Identify bad sectors on a physical disk or logical volume Parameters: none Options -a- NO automatic identification display for bad sectors based on existing SLT data (CHECK) -b:sectors Number of sectors to buffer, the default is 18 for diskettes, and 63 for harddisks The maximum is automatically limited to the available buffer memory. -b or -b:1 Precise mode, 1 sector at a time, this is up to 20 times slower than optimal, but reports bad sectors exactly per sector. Note: DFSee will automatically retry a buffer that had any bad-sectors one sector at a time, so the DFSee sector-list will contain INDIVIDUAL bad sectors already, there is usually no need to scan a whole disk or partition with -b:1 -skipbads:n Skip 'n' sectors on each bad-sector area detected to speed up checking a whole disk, sacrificing precision. Default value 2048 sectors = 1 MiB -w Use the read/write/verify/write sequence, just as with the 'w' parameter Output: Progress indication based on sector numbers, and one line for each bad sector found, plus an SLT display of a related sector if automatic SLT display is enabled. Remarks: For REXX, the dfs_sn.0 stem variable will hold the number of bad sectors found and dfs_sn.1 through dfs_sn.n the actual bad sector numbers (can be shown with the 'list' command) Without the write option, only a single 'read' will be done for each sector, this can be executed on a running system with open files on the disk/volume to be checked. With the write option a "read/write inverse/read/write normal" sequence is done for each sector with content checking. The contents of each sector will stay the same, so the function can be safely executed on formatted disks with live data. This sequence takes at least 4 times more time to complete and also, for safety, the disk will be locked. This means that the write option can only be used when the complete physical disk is not being used. _______________________________________________________________________________ SET var [value] = Set/show a DFSee system variable value Purpose: Set a DFSee system variable to a specific value and/or show the actual value of a variable Parameters: var [value] Name and optional value for a variable - SEParator Separator character for multi-commands - VARiable and expression substitution in commands - PEDantic mode ON or OFF, extra warnings & details - GEOcalc mode ON or OFF, contents-based disk geometry (switch OFF to see the 'real' disk size) - LVMSYNC mode ON or OFF, OS/2 dynamic sync of LVM info (OS/2 version only, may cause spurios traps) - SCREEN Screen output, default ON on Screen output on off Off, output to LOG or REXX only invert Inverted colors (toggle value) bright Bright foreground (toggle value) - ANSI Ansi color and cursor movement, default ON on ANSI support ON off Off, black & white output - TYPE Type-ahead, default for DOS: Off, others: ON on Type-ahead enabled off Type-ahead disabled - RADIX Default mcs-number Radix mask, default 0 = DEC H all classes set to HEX\n" 0 all classes set to DECimal\n" mask classes with bit SET will be HEX all others are DECimal\n\n" Classes defined for DFSee, and defaults: 1 = Standard class (DEC) 2 = mcs-numbers ,s unit specified (DEC) 4 = mcs-numbers any other units (DEC) 8 = DFSee sector number, no unit (DEC) 16 = DFSee size values, no unit (DEC) 32 = DFSee partition type, no unit (DEC) For the RADIX value, just add the numbers. - PRIO Process priority (non-DOS OS only) m = Min lowest priority l = Low lower priority s = Std standard priority h = High higher priority x = maX highest priority q = Query just show current setting Remarks: Setting the lowest priority (Min) might cause DFSee to stop processing (CPU-starvation) if there are other high priority tasks running in the system. _______________________________________________________________________________ SLT [p [s]][opt] = Display Sector Lookup Table at index 'p', showing 's' lines Purpose: Display (selection of) the Sector Lookup Table Parameters: p optional Position, start index in the SLT to display, '+n' and '-n' show next/previous screen full where n is the optional pagesize 'a' = display the entire SLT (can be huge!) 'e' = one page until the end of the table s optional Number of entries to display, default will result in one screen full; '*' = rest of SLT Options: -a[:lsn] Display SLT for sector-numbers around 'lsn' with a default of the current sector 'this'. -m[:mask] Error filtering mask, default all errors Hexadecimal value, each set bit will include a specific error value for a filesystem. -r Refresh SLT even when one already exists -t:type Display specified area types only (??? cmd) -v or -v- Set verbose, error-text and path+filename -1 or -1- Output on a single line (with verbose -v) -d- Do not set 'last used' -v and -1 values -x Stop building SLT in background, discard SLT -M Force creation of 'magic' recovery names to (unmounted) JFS filesystems. (JFS only) -P Prompt mode, option dialog for parameters Output: One or two lines for each entry in the SLT, containing: LSN Start LSN for a range of sectors size Number of sectors in the range ref Other sector referring to this range (fnode) type Type of the sectors in the range error 6-digit Hexadecimal error value, some are generic, some are specific to a filesystem. The filesystem specific ones are also listed with the 'CHECK' command in each DFS[fs].txt, DFSHPFS.txt for HPFS for example. 0x000001 Linked to some structure, but not in allocation-map 0x000002 Allocated in allocation-map, but no known link 0x800000 The filesystem is DIRTY or MOUNTED (in use by OS), operations like resizing are NOT advisable now! Remarks: Sector ranges might overlap, the smallest matching range will hold the best identification for a specific sector. The start-index will default to the position of the sector last searched using the 'id' cmd. If needed the SLT will be built in a background thread. _______________________________________________________________________________ SLT2LIST [opts] = Add (selected) sectors from the SLT to the sectorlist Purpose: Allow analysis (export) of sectors related to filesystem errors Parameters: cl optional Number of sectors added per (error) area Options: -a Add to existing sector list -F:from Include range start sector, default 0 -s:size Size of the 'include' range, default ALL -m:mask Error filtering mask, default 0xfffffffe resulting in just 'lost clusters' added -m:0 Add EVERY SLT area to the sector list, not just the ones with reported errors. Output: none _______________________________________________________________________________ SORT [-d] [-u] = Sort sector list; [-d] = descending [-u] = no duplicates Purpose: Sort the list ascending/descending [, remove duplicates] Parameters: -d optional Sort descending, default is ascending -u optional Make list unique by removing all duplicates Output: none _______________________________________________________________________________ STORE [letter] = Select store to be the current store; or display stores Purpose: Display all stores with attached contents for open stores, or make the specified store-nr the default one Parameters: letter optional ID of the store to be made CURRENT A or B for user stores, S for system-store Options -R Set the selected store to Read-only mode -R- Set the selected store to ReadWrite mode Output: A list with all stores and their associated contents, or a single line indicating the just-selected default store. Remarks: At the moment the use of another store than the CURRENT is only used by a few of the DFSee commands like CLONE and COMP. A store can be representing: - A partitionable medium, usually in FDISK mode (cmd DISK/WALK) - A partition on a disk, with a mode like HPFS (cmd PART) - A volume opened directly, with a FS mode like HPFS (cmd VOL ) - An image file opened for analysis (cmd IM ) DFSee currently uses 3 stores: S or 0: The system store, used by DFSee internally A or 1: User first store (the CURRENT at startup) B or 2: User second store (alternate at startup) _______________________________________________________________________________ SYNCLVM vol [dr] = Sync LVM engine to use [dr] letter for volume, or HIDE it Purpose: Force external LVM engine to use/hide driveletter for volume Parameters: vol mandatory LVM volumename for the volume to be changed dr optional Driveletter to be assigned to the volume When not specified, volume will be HIDDEN Output: Single line of progress / result of the action Remarks: This command is available on the OS2 version of DFSee only, and needs the LVM Engine to be available, meaning LVM.DLL should be accessible and in the LIBPATH ... This command may be useful to hide a volume if you want to make changes to it like wiping or restoring an image. Keeping the volume visible, may cause problems with the filesystemdriver (IFS) that is attached to the volume due to caching issues. (propblems like traps are possible) When using FORMAT in DFSee, the volume is automatically HIDDEN during the format, and re-assigned afterwards. Warning: Using the LVM.DLL to synchronise LVM info dynamically is known to cause traps (in OS2LVM.DMD and LVM.DLL) on some systems. Removable media seem to suffer more from that than fixed ... _______________________________________________________________________________ t [sector type] = Display 'this' sector as Hex or specified sector type Purpose: Display current sector in any specified or default format Parameters: type optional Specifies display format as: a = ASCII h = HEX any = any valid sector type (use ??? cmd) none = default (based on sector contents) Output: Sector display in requested format Remarks: _______________________________________________________________________________ TRACE [lvl|fn] = Set trace level and destinations or DFSee functional trace Purpose: Set and check TRACE level, format and destinations Parameters: lvl optional level/dest. 0 = no trace 1 = trace to title bar other = detail level fn optional Trace filename with fixed lvl = 100 May include a path specification. Options: -d[:xx] add xx ms delay for each trace line, slowdown -f[:ff] retain ff numbered logfiles when cycling -m[:mm] cycle to next logfile after size mm Kb -r Close and reopen log on each line (slow) -r- Open log just once (this is the default) -s Trace to the scroll-buffer (screen) too -s- Switch off trace to screen -t Add timestamps and force thread-id display -t- Switch off timestamp and thread-id Filename with optional path for tracefile. This is the same file used as normal LOG. If logfile specified, level is set to 100 Output: The resulting trace-level and selected destinations Remarks: The file used by TRACE and LOG are the same file, so regular DFSee output will be mixed with the functional trace of the code generating that output. The (left) +/ key cycles levels 0 -> 1 -> 100 -> 0 TRACE is only available in the trace versions, these will be the default delivered executables starting with version 5.11 TRACE is intended for very complex situations and for analysis of DFSee problems (debugging). Trace can also be started directly at startup by using the '-123[t][s][r][l]' switch, or the equivalent DFSEETRACE environment variable with value '123[t][s][r][l]' Example: 'SET DFSEETRACE=101tr' this will start a trace to logfile DFS-101.log, with timestamps and close/reopen on each line and the trace level set to 101. _______________________________________________________________________________ TRANS [-type] xx = Translate and display value 'xx' as Lsn, I13, CHS and PSN Purpose: Translate value xx from [-type] to 4 possible representations Parameters: xx optional input value(s) to translate, default as LSN The default is the 'this' value (as lsn) Options: -l = LSN, logical sector number -i = INT, 3 hex-byte CHS, as in Part-table and INT13 interface -c = CHS, 3 decimal values; cyl, head, sector -p = PSN, physical sector as a hexadecimal number Output: One line with all 4 possible representations of the value 'xx' Remarks: The option, if any, specifies the format of the 'xx' parameter This function is useful to calculate values for partition table entries or CHS values. The same functionality is used in the 'list +g' command against each sector number in the list. _______________________________________________________________________________ TXDIR fn [o] [a] = List files for wildcard selection 'fn' and several options Purpose: Show a directory like list of files, using specified options Parameters: fn optional Path and filename specification, wildcard The default is the current directory. o optional Selection of object to show: SFDP S=subdirs, F=Files, D=Dirs, P=Parent .. a optional Selection by file-attributes +A archive-bit -A NO archive bit +R read-only -R NOT read-only +S system-bit -S NO system bit +H hidden -H NOT hidden Options: -b Display file base-name only, no path etc. Output: One line for every matching file or directory, either with date, time, size, attributes and the full path+filename for the file, or just the basename when '-b' is specified. Remarks: The 'o' and 'a' parameter may NOT contain any spaces, example: 'DP' = show directories only, including the parent '+A-R-S-H' = non-system/hidden/readonly files, archived bit set This command can be useful as a built-in DIR/ATTRIB command. Results are identical to the (TxWin) File-Open dialogs ... _______________________________________________________________________________ u [sector type] = Display 'up' sector as Hex or specified sector type Purpose: Display current sector in any specified or default format Parameters: type optional Specifies display format as: a = ASCII h = HEX any = any valid sector type (use ??? cmd) none = default (based on sector contents) Output: Sector display in requested format Remarks: _______________________________________________________________________________ UNLOCK = Unlock physical disk, after writing to it Purpose: Unlock a physical disk Parameters: none Output: none _______________________________________________________________________________ VOL [drv] = Show all volumes, or select one using drive-letter Purpose: Work with logical volumes including floppies and CDROM Parameters: drv optional Drive-letter for the volume to open Options -f- Exclude floppy-drives A: and B: -l- Exclude LAN drives (on OS/2) -c- Exclude CDROM type drives -R Select the volume in Read-only mode Output: Either the list of volumes or the default display for the first sector of the volume (usually a bootsector). Remarks: Network or other "virtual" filesystems are not supported for 'open' like 'vol X:', but they might be listed depending on the used selection options. The OS/2 version will include the network share name for LAN drives as well. For Windows-NT and OS/2 versions with a kernel 4.50 or newer, the volume CAN exceed 2GiB (large file support). When using the menu-system the key or the menu-selection to show the list of volumes will also cause the submenu with available volumes to be refreshed (Open volume ..) This might be useful after inserting/removing a removable medium like a diskette or CDROM while DFSee is active. _______________________________________________________________________________ WALK [disk-nr] = Select partionable medium (disk) and show partition tables Purpose: Select a physical or virtual disk, list MBR/EBR sectors Parameters: disk-nr optional disk nr, default is current if open or 1 Options: -r reset previously forced geometry -R open the disk in Read-only mode Output: Disk Geometry and default display of every partition table sector (MBR/EBR). This will 'walk' the chain of EBR sectors. _______________________________________________________________________________ WIPE [pat] [f s] = Wipe disk/vol/part area with pattern at LSN [f], size [s] Purpose: This will wipe an entire volume or disk, or a specified part of it, using the specified pattern. Parameters: pat The pattern to use for wiping, it can be any length from a single byte up to 256 bytes. default when no parameters given: All zeroes To use a pattern of zeroes, use a special value: wipe z ;wipe whole object with ZERO wipe z 0 10 ;wipe first 10 sectors, ZERO To use a RANDOM pattern, repeated for every sector wipe r ;wipe whole object with RANDOM wipe r 0 10 ;wipe first 10 sectors, RANDOM A more complex pattern can be specified as a mix of ASCII, UNICODE and HEX. The starting mode is ASCII, switching to HEX and back is done with the ' character, to UNICODE and back with the " character. Note on quoting: The outermost set of quotes, which can be either single or double-quotes, will be stripped off by the parameter parsing logic before it is passed to the 'wipe' command. You CAN use that same quote character again in the parameter using the 'escape' character '\' Example: "The \" is a double-quote" f First sector number to be wiped, or: . or 'this' = current sector 'this' .NNN = value from sector list default: 0 s Size to wipe, in sectors, or: . or 'this' = up to current sector 'this' $ or 'all' or 'end = up to end of current volume/disk .NNN = up to value from sector list default: $ Options: -f Wipe ONLY freespace with a filesystem, meaning all sectors/clusters that are NOT marked as being used for a file or are otherwise 'in use'. -a:'asc' ASCII wipe-pattern value, string -h:'hex' HEX wipe-pattern value, sequence of hex pairs -u:'uni' UNICODE wipe-pattern value, string -m:'mix' Mixed ASCII/HEX/UNICODE wipe-pattern -P Prompt, allowing editing of the specified value with one of the -a, -h, -u or -m options -F:n First sector as mcs-number, default 0 -s:n Size to be wiped, as mcs-number, default ALL -t Test only, no real wipe will be performed -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. -V Verify each sector wiped by reading it back, this can slow the process down considerably! Output: Progress indicator with one dot for each wiped area resulting in about one screen full of dotted lines for the full partition or disk being wiped. Remarks: A disk, partition or volume needs to be opened first. You can easily call DFS (or DFSDOS) from the command line specifying a 'wipe' for the entire volume or disk. Specifying the 'pat' parameter is mutually exclusive with using any of the '-a', '-h' or '-u' options. The 'f' parameter is mutually exclusive with the -F option and the 's' parameter with the -s option. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. Example: wipe "'00'" 0 1 or: wipe z 0 1 or: wipe -size:1 Will set sector 0 to zeroes, clearing boot code and, when the current object is a complete disk, the partition table wipe z . 2 Wipe 2 sectors with zeroes, starting from the current sector wipe z 0 . Wipe all sectors from 0 up to the current sector with zeroes wipe -m:"test'0d0a'line2" -Prompt -size:0x100 Wipe 0x100 sectors starting at sector 0 with the mixed string specified, but allow editing of that string first wipe wipe entire vol/disk/partition with default pattern of zeroes dfsdos part d#wipe#q From the DOS command line, select partition D: and wipe it completely using the default pattern dfsdos disk 1#wipe "'ff'"#q or: dfsdos disk 1#wipe -h:"ff"#q From the DOS command line, select physical disk 1 and wipe it completely using hexadecimal pattern 0xff dfs disk 2#wipe "DFS was here" 0 1#q or: dfs disk 2#wipe -a:"DFS was here" -s:1#q From the OS/2 command line, select physical disk 2 and wipe the master-boot record with the string "DFS was here" _______________________________________________________________________________ WIPEFREE [part] = Wipe freespace in a filesystem to all zeroes (wipe -f) Purpose: Wipe all freespace inside the filesystem to ZERO Parameters: part optional partition, number or letter Options: -p:part Partition, number or letter -v:vol Volume, driveletter -i:img Image filename -test No wipe, just show 'what if' ... -O:v Verbose, extra progress info -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. Remarks: Only one of -p, -v or -i can be specified at one time Use 'wipe -f' directly for more options Wiping FREESPACE is NOT recoverable, the data or garbage that is there will be permanently lost. This will make later UNDELETE or other data recovery impossible. When in doubt make a backup first The filesystem should be CLEAN, so run a chkdsk before using this. Also, it is NOT SAFE to wipe freespace in a filesystem that is in use meaning there are open files (your system/boot partition for example) Try to run the wipe while booted from another disk or diskette Freespace wipe can be useful to improve security. Unused space will not contain sensible information anymore Using the default pattern of all ZEROES will optimize the filesystem for compression environments, for example when used within VirtualPC as a compressed filesystem. Note: 'zerofree' is an alias, for backward compatibility only Example: wipefree -p:03 ;wipe freespace in part 3 to zero _______________________________________________________________________________ WIPELST [sel][p] = Wipe [sel]ected sectors in list with [p]attern Purpose: Wipe sectors in the (delete) list with a pattern This makes deleted files INVISIBLE for future undelete commands Parameters: sel optional File selection parameters, in the form: wildcard%threshold (sometimes shown as [w%t] in usage) wildcard = wildcard selection for display/recover threshold = +nn = Minimum allocation OK percentage or -nn = Maximum allocation OK percentage default: *%-100 ==> all except 100% ones p optional The pattern to use for wiping, it can be any length up to 256 bytes default: All zeroes Options: -a:'asc' ASCII wipe-pattern value, string -h:'hex' HEX wipe-pattern value, sequence of hex pairs -u:'uni' UNICODE wipe-pattern value, string -m:'mix' Mixed ASCII/HEX/UNICODE wipe-pattern Output: Progress is reported with one line per file (file-info list), or a single dot per sector when selection overruled with '!' Remarks: '!' as first parameter will overrule the normal file-display and validation, and wipe EACH SECTOR in the list. Wiping file-list sectors (from delfind), is intended to clean the disk from obsolete file-info (Fnodes), making 'delfind' return less deleted files the next time. The files wiped CAN NEVER BE UNDELETED ANYMORE! See also "wipe" and "delshow" command Wiping sectors from the list using '!' can also be useful for rewriting bad sectors that have been found using the SCAN command. In some cases this makes them readable again. Specifying the 'p' parameter is mutually exclusive with using any of the '-a', '-h' or '-u' options. When these options are specified their value is used as default in a prompt dialog. _______________________________________________________________________________ WIPESECURE [-f] = Wipe disk/vol/part area in a SECURE way (DoD spec, slow!) Purpose: Wipe ALL (or freespace) sectors multiple times, with verify, as specified by the US military DoD 5220.22 and NIST SP800-88 specifications making recovery of data impossible Parameters: none Options: -f Freespace area wipe only, this allows a periodic wipe of freespace to avoid any undelete or data recovery of deleted files without affecting the normal file-data in the filesystem. Output: Progress is reported from 0..100% for each of the three passes Remarks: This operation can be VERY SLOW due to the multiple passes. If you want to secure wipe a complete large ATA disk (> 15Gb) it will most likely have an internal 'Secure Erase' command. Currently that is NOT used by DFSee, but there is a free DOS based utility available from the University of California. It is upto a hundred times faster and also erases any normally inaccessible areas like HPA and bad-sector recplacement sectors. You can download this from: http://cmrr.ucsd.edu/hughes/SecureErase.html _______________________________________________________________________________ WRITE [ . | sn ] = Write sector back to current or specified sector number Purpose: Update a sector on the disk, possible after editing it Parameters: sn optional sector number specification (LSN) '.' or 'this' is the current sector Options: -a:sn sector number to write the data to, if no value is specified, you will be prompted for one Output: none Remarks: Only one sector (512 bytes) will be written. Writing back changed data to the disk can cause BIG TROUBLE when you don't know EXACTLY what you are doing. Use it with extreme care (and maintain backups if possible :-) The WRITE command is executed automatically by the EDIT command, unless you use the '-w-' option on EDIT. _______________________________________________________________________________ x [sector type] = Display 'xtra' sector as Hex or specified sector type Purpose: Display current sector in any specified or default format Parameters: type optional Specifies display format as: a = ASCII h = HEX any = any valid sector type (use ??? cmd) none = default (based on sector contents) Output: Sector display in requested format Remarks: _______________________________________________________________________________ ----------------------------[ www.dfsee.com ]-------------------------------