Developer Jan van Wijk releases Display File Systems version 2.69, file-system display & analysis utility. The archive (DFSEE269.ZIP, 401K) was uploaded today August 14, 1998 on Pete Norloff's BBS.

Introduction, purpose of the program
------------------------------------
by the Author

The DFSee program is a disk and filesystem browser with an emphasis on the
HPFS and FAT filesystems, disk partitioning and a little bit NTFS.
It will support different file-systems sometime in the future.

The program has been built while studying the HPFS filesystem.
It's main purpose is getting to understand the file-system as it resides
on the disk itself, in the data-structures laid down in disk-sectors.
Over time, additional logic was implemented to allow analysis of all
sorts of disk problems on HPFS volumes.
The tool has been used a few times over the past years to analyse some
real-life disk problems in a large systems-integration project.
Also it has proven very usefull in teaching others the internals of HPFS
Most of my knowledge of the file-system is based on the excellent lectures
"HPFS Internals" at the 1994, 95 and 96 ColoradOS/2 conferences by
Doug Azzarito and on peeking arround on a lot of HPFS volumes using DFS.

Further improvements will probably be in more advanced recovery commands
and other filesystems like NTFS and EXT2 and in porting to other platforms.

The standard distribution, DFSEExxx.ZIP contains executables for OS/2 Warp
(32-bit), 16-bit DOS and Windows-NT.
 

Availability
 

1) My Homepage: http://www.fsys.demon.nl (Follow shareware, dfsee)

2) HOBBES (WWW): ftp://hobbes.nmsu.edu/pub/os2/util/diskutil/DFSEExxx.ZIP
or shadow: ftp://ftp.cdrom.com/pub/os2/util/diskutil/DFSEExxx.ZIP

3) IBM internal: REQUEST DFSEE FROM 78867930 at EHONE

On special request a 16-bit OS/2, and tracing/debug versions are available.

Status of the program

This version of the program is free for anyone to use, it was written
in my own time using my own equipment. However, I would very much
appreciate any feedback by e-mail or a simple postcard to:

ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
³ Jan van Wijk ³
³ Blekerstraat 83 ³
³ 1315 AC Almere ³
³ Netherlands ³
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

Further development depends on my own needs and feedback I receive from
other users, al work has to be done on spare time...

Suggestions and other comments regarding DFSee and filesystems are welcome.

You can reach me through the Internet: dfsee@fsys.demon.nl (preferred)
or: jan.van.wijk@cmg.nl

Change History

1.00 27-11-94 DHPFS initial version, hex dump super+spare blocks
1.39 20-07-95 32-bit port; Sector Lookup table; bug-fixes
1.52 13-09-95 new '/' cmd shortcut; First released version! <== BBS
1.56 26-09-95 RUN cmd runs REXX dhpfs macro's
1.62 13-10-95 Added Free-space and inconsistency reporting
1.64 16-10-95 Cleanup for delivery on ColoradOS/2 CDROM
1.70 20-12-96 Update ColoradOS/2, DASD limits; REQUESTABLE (OS2FISYS forum)
1.84 14-01-97 DFS first distributed version to include partitioning info
1.87 19-01-97 Fixed MBR/EBR walk; multiple cmds using #, BM-labels in part
1.91 21-01-97 New fixroot, fixcp and saveto commands for recovery actions
2.00 03-02-97 Removable media (NEWDASD); (part) D: cmd; invisible primary
2.06 16-03-97 Updated ACL support on HPFS386; Scan badsectors
2.12 06-04-97 Added logical volume support using "DASD" type access
2.20 19-05-97 Win NT beta version; Search speedup; prio command; cleanup
2.24 10-06-97 Added Img and Sim commands; date/time on dirblocks;
2.25 15-06-97 Added Wrim command; Improved lock implementation (nested)
2.28 21-06-97 Added autobase command for HPFS (find HPFS partition start)
2.30 06-07-97 Improved 'find' syntax and functionality; Undelete support
2.31 13-07-97 Fixed case-insensitive find, '+' option; fix dirmap % error
2.32 20-07-97 Reporting & ALBLK fixes to saveto; new "ca" cmd CheckAlloc
2.35 18-08-97 Path info in Fnode display and "list" output; MEM cmd
2.37 24-08-97 Path display on find Fnode; Wildcard select on list +f
2.40 06-09-97 import/export of LSN lists; getbs/fixbs badsector mgmt
2.41 12-10-97 Multiple file UNDELETE with delfind/delshow/delsave cmds
2.42 18-10-97 Support for EA's in "saveto" and delsave cmds
2.43 28-10-97 Support for undelete of directories including EA's
2.47 11-11-97 Updated SLT error display; new check cmd (chkdsk); +/- cmd
2.49 16-11-97 No limit on nr of bad-sectors; sort cmd; sep cmd
2.50 24-11-97 HPFS checksum management; cs, edit and write cmd
2.51 30-11-97 More... help; fix checksum super; fix freespace reporting
2.52 07-12-97 check spare/super; BPB display; Specific FAT & NTFS commands
2.54 28-12-97 More FAT commands; generic More ...; fix DELFIND bug
2.55 25-01-98 DOS version; diskgeo cmd; More write capabilities; bugfixes
2.56 05-02-98 Fixed trap on HPFS major version > 2; VFAT long filenames
2.57 15-02-98 Name DFSee; VFAT Details; FAT Os2Ea display; "find" cleanup
2.58 22-02-98 Fixed More... bugs; Fixed FAT EA & label bug; show EA details
2.60 08-03-98 Single snlist; recover/saveto; dirfind, wipe; color in DFSNT
2.61 29-03-98 saveto xxx.DIR orphan naming; DispHex update; displ NTFS-MFT
2.62 30-03-98 Fixed missing 'wipe' documentation; More MFT-record display
2.63 19-04-98 Fixed DFSDOS WRIM and IM commands (file I/O); Fix "FS xxxx"
2.64 04-05-98 Small bug-fixes + support for named-pipe to LPT on sim/wrim
2.65 10-05-98 Fixed 'f* * xxx' bug + new % speed-up option; FAT32 support
2.67 04-06-98 Added optional LZW-compression on SIM and WRIM commands
2.68 07-06-98 Fixed memory-leak and hang on LZW (WRIM)
2.69 24-07-98 Fixed trap on big-sectors (CD); Removed extra LAN messages

Terminology used

Sector 512 bytes of data (although other sizes exist!)
This is the smallest amount of data manipulated by the
disk subsystems and is also the basic allocation-unit
for the HPFS file-system

CHS Cylinder Head Sector (addressing)
This is the classical way of addressing physical sectors
on a disk. It is used in the PC's BIOS, in partition tables
and in low-level disk-IO API's (IOCTL, INT-13).
In most implementations the addressing ranges are limitted
causing all sorts of problems with large disks/partitions.
Example: maximum cylinder=1024 limit for BIOS/INT-13

PSN Physical Sector Number
This is the zero-based, unsigned-LONG, number for a
sector on a physical disk. Addressing on a disk using
PSN's id often refered to as Relative Block Addressing
(RBA) or Logical Block Addressing (LBA)

LSN Logical Sector Number
This is the zero-based, unsigned-LONG, number for a
sector on a logical partition. The partition can be seen
as a linear sequence of sectors.

SLT Sector/Cluster Lookup Table
An array of information about sectors or groups of sectors,
containing the type of the sector(s) and the LSN of a
directly related sector (usualy an Fnode).
It is currently implemented for HPFS only.

Cluster A (small) group of adjecent sectors that are handled by the
operating system as one allocation-unit.
It is used on FAT filesystems to allow large partitions at
the cost of more wasted "slack" space, and on NTFS to balance
performance, slack-space etc.
HPFS does not use sector-clustering (or a cluster-size of 1!)

DFS will try to account for clustering where needed, for
example in size calculations and where sector/cluster pointers
are used in the file-system internal structures.
 
 

Partition An area on a physical disk that holds a single logical
file-system like FAT, HPFS, Boot-manager, NTFS etc.
There is an index to find partitions in the form of a
set of partition-tables in the MBR/EBR chain.

MBR Master Boot Record
The first sector on the physical disk, located at PSN 0 =
Cylinder 0, Head 0, Sector 1
It contains the initial boot code called from the BIOS and
the main partition table that holds the primary partitions
and the start of the chain of extended boot records (EBR).

EBR Extended Boot Record
It contains no boot code but only a partition table that
holds the location of a single logical partitions.
It usualy is located on the cylinder just before the actual
logical partition itself, at Head 0, Sector 1.
Each EBR will also point to the next EBR if more logical
partitions exist on the same disk.

Volume A logical volume as seen by the active operating system,
with a logical drive-letter associated to it.
It can be either a hard-disk partition with a filesystem
recognized and mounted by the operating system, or some
other storage-medium like floppy disk or CD-Rom.
Note: Network drives or other "virtual" file-systems can also
be refered to as volumes. However, DFSee will not be able
to access them because such devices usualy cannot be
accessed using "open volume" (DASD) methods.

Shortname The leading part of a filename, as contained in an HPFS fnode
and usefull for undelete. The maximum length is 15 characters

LsnInfo A value combining an LSN and a (small) informational value in
a single 32-bit number. It can be kept in the sector-list and
the sector lookup table, most operations will recognize and
handle it correctly.
On example of usage is the directory-sector LSN plus the index
of a directory-entry for (V)FAT directories.
LsnInfo 78000345 combines LSN 00000345 with index 7 and a
single bit to mark it as an LsnInfo value (flag 0x08000000)

Sector list A list of sector numbers (LSN) or LsnInfo combination-values
that can be manipulated as a whole with several commands like
export, import, getbs, fixbs, dirfind, delfind, delsave etc.
 

Summary of commands

DFSee takes commands from the keyboard and displays the results to the screen,
scrolling text upward. It can also be copied to a file for later analysis.

The commands are single words or (hexadecimal) numbers.
Most commands have one or more parameters of wich some are optional.

DFSee keeps track of the current- and some other usefull SN's so they
can be referenced faster, without having to type them in. They are:

Name Cmd Description
---- --- -----------
up 'u' up in hierarchy
down Enter down in hierarchy
this 't' this (current)
xtra 'x' Extra, alternative

You can display and analyse either a physical disk, a partition or a volume.
A physical disk can be opened using the 'disk' command.

A logical-partition or volume needs to be opened first with the 'part' or
'vol' commands respectively. The following prompt will show some status info.
After opening an HPFS partition, using 'Enter' a few times will take you
to the superblock, root-directory, possible sub-directories upto some file.

Multiple commands can be chained if separated with a special character,
the default is '#' but this can be changed with the 'sep' command.
 

An overview of the available commands is given below, it can also be
referenced from within the program using the '?' command.

xx = Analyse & display sector, SN xx using logical sector-number
.NNN = Display numbered FS-entity marked .NNN from the sector list
<Enter>, u, x = Show next with <Enter>, up with 'u' or extra LSN with 'x'
? [*] = Show list of generic commands with short description
?? [*] = Show active filesystem name, commands and help info
??? = Show all recognized sector-types for current filesystem
base [sn [sl]] = Set base limits start and end values, defining partition
cd [path] = Change current directory an current drive
cs [sn] = Calculate 32-bit checksum for current sector; HPFS aware
check [dr/nr] = Report all detected file-system errors using SLT info
chs c h s = Analyse & display sector, using CHS (cylinder head sector)
recover d [w;p] = Recover files from the sector-list (delfind), to dir [d],
and with optional wildcard [w] and minimum percentage [p]
dirfind [l][dir] = Put [l] levels of directory-contents in the sector-list
disk [disknr][r] = Select a physical disk and show the MBR, [r]eset forced geo
diskgeo [c h s] = Force specified geometry on opened physical disk
export [fn] = Export LSN's in the sector list, to file [fn]
find path-spec = Find and show file/directory specified by path-spec,
relative to current dir, or root if starting with '\'
fs fsys-name = Force analysis mode for filesystem 'fsys-name'
f[op] [t] [str]] = Find [options] sectors of [t]ypes containing [str]
options are : * = repeat; - = backward; $ = Ign-case; @[pos] = position
help [*] = Show list of generic commands with short description
a,A xx [size] = ASCII-dump (half)sector, SN xx, s sectors or bytes
h,H xx [size] = Hex-dump (half)sector, SN xx, s sectors or bytes
id [xx] = Identify current or specified sector, using the SLT
im img = Open a file with a FS-image (.img) for display & analysis
import [fn] = Import LSN's to the sector list, from file [fn]
list [opt][wild] = Display LSN's in the sector list, using options/wildcard
lock = Lock physical disk or logical partition to avoid conflicts
log [file] = Log (append) to 'file' (.log); (No file => stop logging)
mem [c|lsn] [#] = Store LSN in MEMory list at loc #, or limit mem list-size
more [?|*|lines] = Set number of screen-lines, including More ... function
part [dr/nr][No] = Show partitions, or select one using nr or drive-letter
prio [lvl] = Set relative priority of the DFS main thread
psn xx = Analyse & display sector, SN xx using physical sector-nr
saveto [dir][l] = Save filedata for current file to a new file in [dir]
scan [wr [NoId]] = Scan bad-sectors; use read/Write verify; No automatic id
screen [on|off] = Switch output to the screen on or off
setansi [on|off] = Set use of ANSI escape-sequences (colors) on or off
sim img [f s z] = Save to FS-image, from LSN [f], size [s]; z = LZW compress
slt [type i ln] = Display SLT for sectors of 'type' at index i, ln lines
sort [-][unique] = Sort LSN list; [-] = descending [unique] removes duplicates
t [sector-type] = Display 'this' sector as Hex or specified sector-type
u [sector-type] = Display 'up' sector as Hex or specified sector-type
x [sector-type] = Display 'xtra' sector as Hex or specified sector-type
unlock = Unlock physical disk or logical partition
vol [drive][No] = Show all volumes, or select one using drive-letter
walk [disknr][r] = Select a physical disk and walk the MBR/EBR chain
wipe pat [f s] = Wipe disk/vol/part area with pattern at LSN [f], size [s]
wrim img [f s] = Write FS-image to disk-sectors start at LSN [f], size [s]
run macro = Run a DFS macro in a REXX file
copyoutput [stem]= Copy output from last-command to REXX stem-var
q = Quit DFSee OS2-32; 2.69 24-07-98 (c) 1994-98; Jan van Wijk

EXTERNALS Any command not recognized as a valid DFS internal command
will be passed to the default command-processor (COMSPEC).
Usefull commands: CHKDSK, CD, DIR, ...
Note: FDISK, SETBOOT etc will not work if a physical disk
is currently opened by DFS itself.

Command reference, general DFS commands
---------------------------------------

disk [nr] = Select specified physical disk for physical addressing

Purpose: Select a physical disk

Parameters: nr optional Physical disk number, default is 1

Output: Disk Geometry and default display of sector 0 (usualy MBR)

The returncode (rc) will be zero for a valid disk number
or equal to the number of disks otherwise.
This can be usefull from REXX scripts.
 

walk [nr] = Walk the MBR/EBR chain of partition-tables for specified disk

Purpose: Show all partitioning information for the specified disk

Parameters: nr optional Physical disk number, default is 1

Output: Disk Geometry, MBR and all linked EBR's in partition format
 

lock [ign] = Lock physical disk, to allow writing to it

Purpose: Lock a physical disk

Parameters: ign optional Ignore lock failure, do not prompt
interactively for write permission

Output: none
 

unlock = Unlock physical disk, after writing to it

Purpose: Unlock a physical disk

Parameters: none

Output: none
 

part [i][ns] = Select specified partition, or show the list of partitions

Purpose: Select a disk partition for analysis

Parameters: i optional Number specifying the partition as shown
by the 'disks' or 'part' commands
or d: Drive-letter for a partition (part C:)
or + To get a verbose list
or ! To force a new scan of physical disks
If no parameter is specified the list of
partitions will be displayed.
or !! Force new scan, and use alternative method
of drive-letter assignment (industry std).

ns optional Do not start SLT thread automaticaly (HPFS)
When specified, the SLT will be build later
when the 'SLT' cmd is issued to display it.

Output: Either the list of partitions or the default display for the
first sector of the partition (usualy a boot-sector).

Remarks: The command "d:" where d is any existing drive-letter will
be interpreted as a "part d:" command. This means that the
C: partition can be opened just by typing "C:"

The returncode (rc) will be zero for a valid partition id or
the number of partitions otherwise (usefull in REXX scripts).

An example of the list ouput in table form (default) is:

Number of disks : 1
Geometry for disk : 1 Cyl: 155 H:255 S:63 Disksize : 0025FEDB = 1216 Mb
ÚÄÄÂÄÄÂÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄ¿
³id³PD³Name³Type, description³Format ³Creator ³Label Info ³BM-Name ³ Size Mb ³
ÃÄÄÅÄÄÅÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄ´
³01³ 1³-- ³Prim 0a Boot Mgr ³BMGR ³fdisk ³«WARP40 » ³ ³ 7.8 ³
³02³ 1³C: ³Prim 07 Inst. FS ³HPFS ³OS2 20.0³OS2 ³WARP40 ³ 400.1 ³
³03³ 1³D: ³Log 07 Inst. FS ³HPFS ³OS2 20.0³OS2 ³STARTUP ³ 7.8 ³
³04³ 1³E: ³Log 07 Inst. FS ³HPFS ³OS2 20.0³OS2 ³ ³ 172.5 ³
³05³ 1³F: ³Log 07 Inst. FS ³HPFS ³OS2 20.0³ ³ ³ 7.8 ³
³06³ 1³G: ³Log 07 Inst. FS ³HPFS ³OS2 20.0³HPFS_7MB ³ ³ 7.8 ³
³07³ 1³H: ³Log 07 Inst. FS ³HPFS ³OS2 20.0³BIG_HPFS ³ ³ 611.8 ³
ÀÄÄÁÄÄÁÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÙ

Number of physical disks = The number of disks reported by the system
Opened phys disk ... = opened disk with Cylinder, Head, Sector and Size
Part nn WARNING: ... = Any informal, strange or alarming conditions

Where: id = The selection-id used by DFS for this partition
PD = Physical drive number; 1..max
Name = Drive letter, capital (or lowercase for hidden)
or name of the partition (Linux)
Type, description = Type-info and hex value of the type, type-info:
Prim = Primary (active, accessible)
Hide = Hidden (primary or special)
Log = Logical volume in an extended partition
Format = The filesystem format string found in the
bootrecord for this partition or --none--
Creator = The OEM identification string from the bootrec
of "fdisk" if no valid bootrecord is found
Label Info = The volumelabel as found in the bootrecord, or
the «BM-label» of the current Bootmgr selection
BM-Name = The name for this partition as registered in
the OS/2 boot-manager information area's
Size Mb = The gross size of the partition in megabytes

An example of a list fragment for verbose form is:

DFS partition Id : 2
Physical disk nr : 1 (Fixed), Partition-table 0 (MBR), entry: 1
System Indicator : 07
Type description : Inst. FS
FileSyst. format : HPFS
Partition type : Primary
Part. visibility : Visible
Creator OEM-name : OS2 20.0
Partition Label : OS2
Boot capability : Bootable by OS/2 boot-manager as: WARP40
Bootsec checksum : FBD8824F
Partition start : Cyl: 1 Hd: 0 Sec: 1
Partition end : Cyl: 51 Hd: 254 Sec: 63
Bootsect. offset : 00003EC1 = 16065 Dec
Partition size : 000C8073 = 400 Mb
Cluster size : 00000001 = 512 b , in 1 sector(s) of 512 bytes
Bootsector PSN : 00003EC1
Free space drive : C: 146.0 Mb of 400.1 Mb on file-system: HPFS
 

vol [letter] = Select specified logical volume, or show the list of volumes

Purpose: Work with logical volumes including floppies and CD-rom

Parameters: Drive-letter for the volume

Output: Either the list of volumes or the default display for the
first sector of the volume (usualy a boot-sector).

Remarks: Network or other "virtual" file-systems are not supported.
 

diskgeo [c h s] = Force specified geometry on opened physical disk

Purpose: Show current or force different geometry to be used for
interpreting and analysing the current physical disk

Parameters: none Display the geometry currently in use, including
possible overrides by previous 'diskgeo' commands

c h s Overrule current geometry by the values specified
for cylinders, heads and sectors.

Output: The resulting geometry for the physical disk currently open

Remarks: You can keep the current value for one of the items by
specifying zero (0) or nothing for the override

Example: 'diskgeo 0 255' will set the number of heads to 255
 

check [dr/nr] = Report all detected file-system errors using SLT info

Purpose: Check file-system integrity using SLT info (chkdsk function)

Parameters: drive-letter or partition-nr to check, default opened partition

Output: Verbose list of all SLT entries that have an error flagged
This will include path+filename when available and textual
explanation of the error(s)

Remarks: The reported arrors are the same as listed with the SLT command
'check' is an alias for "SLT * 0 * +fffd"
The SLT will be rebuild on each invocation of the "check" cmd.
 

im img = Open a file with a FS-image (.img) for analysis

Purpose: Work with a saved binary image

Parameters: img Filename for the image, default extention is '.img'

Output: The default display for the first sector of the image

Remarks: File-system type is derived from first (boot) sector
 

sim img [f s z] = Save to FS-image, from LSN [f], size [s]; z = LZW compress

Purpose: Save specified sectors as a binary image for use with 'IM'

Parameters: img Filename for the image, default extention is '.img'

When prefixed with [lpt.exe], the data is actualy
written to named pipe \pipe\xxx.img to LPT.EXE wich
will be started in a separate session automatically
This allows saving the image on a different PC that
is attached using a parallel (laplink) cable.

f Start LSN for save, default is 0
s Size of the saved image in sectors, default is 256
'$' can be used to save all sectors of the disk/volume

z Option to enable LZW compression on the image-file

Output: none

Remarks: When '.' is specified for s, sector 'f' upto 'this' is saved
When '.' is specified for f, the start-sector is 'this'
When '.' is specified for both, only the 'this' sector is saved

wrim img [f s] = Write FS-image to disk-sectors start at LSN [f], size [s]

Purpose: Write sectors back from an image to opened partition or volume

Parameters: img Filename for the image, default extention is '.img'

When prefixed with [lpt.exe], the data is actualy
read from named pipe \pipe\xxx.img from LPT.EXE wich
will be started in a separate session automatically
This allows retrieving the image from a different PC
that is attached using a parallel (laplink) cable.

f Start LSN for write, default is 0
s Size of the written sector area, default size of image

Output: none

Remarks: '.' can be specified for the f and s parameters, see 'sim' cmd

LZW compressed image-files created by SIM will be recognized
and automatically un-compressed on the fly.

wipe pat [f [s]] = Wipe disk/vol/part area with pattern at LSN [f], size [s]

Purpose: This will wipe an entire volume or disk, or a specified part
of it, using the specified pattern.

Parameters: pat The pattern to use for wiping, it can be any lenth
from a single byte upto 256 bytes.
default: DfsWiped

It can be specified as a mix of ASCII and HEX.
The starting mode is ASCII, switching to
HEX and back is done with the ' character.
Note that there can be NO SPACES in this definition,
if you need spaces, use the hex '20' value instead.

f First sector-number to be wiped, hexadecimal
. = current sector 'this'
default: 0

s Size to wipe, in sectors, hexadecimal
. = upto current sector 'this'
$ = upto end of current volume/disk
default: $

Output: Progress indicator with one dot for each wiped megabyte

Remarks: A disk, partition or volume needs to be opened first.
You can easily call DFS (or DFSDOS) from the commandline
specifying a 'wipe' for the entire volume or disk.

Example: wipe '00' 0 1
set bootsector to zeroes, clearing boot-code and, when the
current object is a complete disk, the partition-table

wipe
wipe entire vol/disk/partition with the default pattern

dfsdos part d n#wipe#q
From the dos commandline, select partition D: and wipe
it completely using the default pattern

dfsdos disk 1#wipe 'ff'#q
From the dos commandline, select physical disk 1 and wipe
it completely using hexadecimal pattern 0xff

dfs disk 2#wipe DFS'20'was'20'here 0 1#q
From the OS/2 commandline, select physical disk 2 and wipe
the master-boot record with the string "DFS was here"
Note the use of '20' to get the parameter completely
specified without using the space-character.
 

fs fs-name [No] = Force analysis using specified file-system knowledge

Purpose: Use specific FS knowledge if the default is not correct

Parameters: fs-name File-system name, like FAT or HPFS
No Do not try to build SLT automatically

Output: none

Remarks: Only HPFS is realy supported at the moment, and depending on
disk or image contents DFS might behave strangely or even trap
 

export [id][fn] = Export LSN's in sector list [id], to file [fn]

Purpose: Save an LSN-list in a file for modification or later use

Parameters: id optional Id for the list, f, b, d or m
see "list" cmd; default is last list used
fn Destination filename, default is dfslistX.lsn

Output: none

Remarks: The file has one LSN per line, editable with a text-editor.
 

import [id][fn] = Import LSN's to sector list [id], from file [fn]

Purpose: Read an LSN-list from a file, exported and/or modified

Parameters: id optional Id for the list, f, b, d or m
see "list" cmd; default is the "find-result" list
fn Source filename, default is dfslistX.lsn

Output: none

Remarks: The file needs one LSN per line, editable with a text-editor.
It can be the result of an export, derived from a log-file
or created completely by hand.
The verbose format resulting from a "list f+" or "list f+f"
and the "delshow" is also valid. (use "log" cmd to capture)
This is often more convenient than bare LSN lists because
the verbose format contains info like path/filename.

dirfind [l][dir] = Put [l] levels of directory-contents in the sector-list

Purpose: Find non-deleted files in a directory and optionaly it's
subdirecties upto the number of levels specified.

Parameters: l optional number of directory levels to include
in the list, or 's' for all levels

dir optional directory specification, starting from
the root-directory

Output: Sector list in memory to be used in following operations

Remarks: List can be manipulated as usual, best viewed with "list +f"

Example: dirfind s \os2
This will put the whole \os2 tree in the sector-list
 

base [sn [sl]] = Set base limits start and end values, defining partition

Purpose: Force a different partition start sector-nr

Parameters: sn Sector-number to use as start for partition ==> LSN 0
sl Sector-number to use as end for partition (optional)

Output: none

Remarks: Can be used if start of partition / partition-tables are bad
Try to find the PSN for the first sector of the partition
and use the "base" cmd followed by an "FS xxxx" command
 

PSN xx = Analyse & display sector using PSN xx
 

Purpose: Display sector using Physical Sector Number addressing

Parameters: xx = 1 to 8 hexadecimals

Output: Sector display, format selected based on sector-contents

Remarks: The SN is specified in hexadecimal format, however the first
digit needs to be decimal to avoid misinterpretation.
Prefixing the SN with '0' will avoid any conflicts.

Output that scrolls of the screen can be repeated using
the 't' command. (display 'this' sector)
CHS c h s = Analyse & display sector using CHS specication
 

Purpose: Display sector using Cylinder, Head and Sector addressing

Parameters: c mandatory The zero-based decimal Cylinder number
Range 1 to disk-specific maximum and
usualy below 1024.

h mandatory The zero-based decimal Head number
Range 0 to disk-specific maximum but
never more than 255

s mandatory The one-based decimal Sector number
Range 1 to disk-specific maximum but
never more than 63

Output: Sector display, format selected based on sector-contents

Remarks: Output that scrolls of the screen can be repeated using
the 't' command. (display 'this' sector)
 

xx = Analyse & display sector, SN xx; xx = 1 to 8 hexadecimals
 

Purpose: Display a sector in the most usefull format

Parameters: none

Output: Sector display, format selected based on sector-contents

Remarks: The SN is specified in hexadecimal format, however the first
digit needs to be decimal to avoid misinterpretation.
Prefixing the SN with '0' will avoid any conflicts.

Logical addressing (LSN) is actualy used, however when a
physical disk is selected the offset for logical addressing
is set to 0. The result is that LSN's equal PSN's.

Output that scrolls of the screen can be repeated using
the 't' command. (display 'this' sector)
 
 

H,h [xx [s]] = Hex-dump sector or half-sector, LSN xx, s sectors/bytes

Purpose: Display current or specified sector in hex-dump format

Parameters: xx optional LSN of sector to dump

s optional size to dump: 1..63 specifies sectors
64..xxx specifies bytes
Default is 512 bytes for the 'H' command
and 256 bytes for the 'h' command

Output: Hex-dump of the sector
On every line 16 bytes of data will be displayed, each line
containing:
- the relative offset in the record (4 hex digits)
- 16 bytes in hexadecimal; separator after 8 bytes
- the same 16 bytes represented as ASCII

Remarks: The ASCII representation is filtered, non-printable
characters are represented with a PERIOD character
 
 

t a|h [s] = This LSN, display in Ascii or Hex; s sectors/bytes

Purpose: Display current sector in ASCII, EA, HEX or default format

Parameters: a|h optional Specifies display format as:
a = ASCII
h = HEX
none = default (based on sector-contents)

s optional size to dump: 1..63 specifies sectors
64..xxx specifies bytes

Output: Sector display in requested format

Remarks:
 

f[op] [t] [str]] = Find [options] sectors of [t]ypes containing [str]

Purpose: Perform a sector search starting from the current LSN
until a sector of the specified type and optionaly
containing a specified ASCII/HEX string is found.

Parameters: op optional Search options, default is '+'
* = automatic repeat (find all ...)
% = fast search; no sector-spanning!
+ = verbose output even when repeating
- = search towards lower sector numbers
! = force LSN/PSN display, no file-paths
$ = Use case-insensitive string compare
@[pos] = compare at one sector position [pos]
(with type dependant defaults)

Note: Use no spaces betwee 'f' and options!

t optional Types of sector wanted, default is any KNOWN
specify multiple types in a single string

DFS generic sector types
'*' = any sector
'r' = Master Boot Rec 'e' = Extended Boot Rec
'b' = Fsys boot sector 'R' = Fsys reserved sec
'!' = any known type 'u' = Unidentified data
'$' = Free space '.' = <Past-partition!>

For an up-to-date list, use the '???" command

str optional A string of bytes that have to be present
in the wanted sector.
When the '$' string option is not given, it
can be specified as a mix of ASCII and HEX.
The starting mode is ASCII, switching to
HEX and back is done with the ' character.
Leading whitespace is skipped, in HEX mode
spaces can be used to improve readability.

Example 1: last'0d0a'first

This will search for the word "last"
followed by a carriage-return line-feed
combination and the word first

Example 2: 'e9bd13 0d4023 49 42 4d 3a38 2e'

This will search for a byte sequence,
in this case the start of COMMAND.COM
 

Output: Sector display, format selected based on sector-contents,
or a single line with position and type info when repeating
 

Remarks: This command is also very usefull to find a specific fragment
of disassembled code anywhere on the disk, to resolve the
name of an EXE, DLL or device driver causing traps or hangs.

Backward search can be usefull on HPFS to find the preceding
fnode when looking at some random file-data.
Note: the 'id' command will do this more reliably but depends
on the sector-lookup-table to be filled.
 

edit pos str = Update the current sector at 'pos' to the value of 'str'

Purpose: Make (small) modifications to sector contents

Parameters pos mandatory Hexadecimal offset, start of edit-area
 

str mandatory A string to be placed at the specified
position in the current sector.
The syntax for this string is exactly the
same as for the find ('f") command.
So ASCII and binary specifications are
possible.

Output: Hex-dump BEFORE and AFTER for the changed sector area

Remarks: The edit command itself does NOT write the new contents
back to disk. Use the 'write' command to do that.
The 'show' command can be used to view the sector before
writing back or making more changes. It is simular to the
'H' and 'h' command, but it does not read from the disk,
it just displays the current sector buffer contents.
 

show [s] = Hex-dump current sector (or half-sector), s sectors/bytes

Purpose: Display current (last read, edited) sector in hex-dump format

Parameters: s optional size to dump: 1..63 specifies sectors
64..xxx specifies bytes
Default is 512 bytes for the 'SHOW' command
and 256 bytes for the 'show' command

Output: Hex-dump of the sector, see the 'h' and 'H' commands

Remarks: The main difference with 'h' and 'H' are that the current
contents of the sector-buffer (possibly changed by an 'edit')
are shown. 'h' and 'H' will first read a sector from disk.
 

write xx = Write back the sector-buffer using current or specified LSN

Purpose: Update a sector on the disk, possible after editing it

Parameters: xx mandatory sector-number specification (LSN)
'.' is the current sector ('This')

Output: none

Remarks: Only one sector (512 bytes) will be written.
Writing back changed data to the disk can cause BIG TROUBLE
when you don't know EXACTLY what you are doing.
Use it with extreme care (and maintain backups if possible :-)
 
 

list [id+op] [w] = Display LSN's in sector list [id], using options/wildcard

Purpose: Display one of the sector-number lists maintained by DFS

Parameters id optional Identifier for LSN list, valid values are:

d = Dir, result or dir-block display
b = Bad, result of 'scan' command
f = Find, result of 'f' command
m = Mem, result of 'mem' commands

op optional + = Use verbose output, one line per LSN
f = Incluse PATH info on Fnode LSN's on
verbose output (requires + too)

w optional Wildcard select-string, only valid with "+f"
multiple wildcards '*' and '?' can be used.
Very useful on a (large) list of deleted fnodes!

Output: List of sector numbers in compact or verbose format

Remarks: There should be NO space between [id] and the options!
The default list-identifier will be set to a specific list
each-time one of the lists is modified or listed.
List also available for REXX in the dfs_sn. stem variable
 

mem [c|lsn] [#] = Store LSN in MEMory list at loc #, or limit mem list-size

Purpose: Add an LSN to the LSN memory list for later use with .NNN

Parameters: c optional Clear command, limit list-size to # entries

lsn optional LSN to add to the list, special values are:
x, u, d, t for Xtra, Up, Down and This

# optional memory location to store lsn, or limit

Output: none

Remarks: The LSN memory can be listed using "list" [+f]
 

sort [+|-][u] = Sort the LSN list using specified options

Purpose: Sort the list ascending/descending, remove duplicates

Parameters: +|- optional Sort ascending (+) or descending (-)
default is ascending

u optional Make list unique by removing all duplicates

Output: none
 
 

.NNN [id] = Display numbered FS-entity marked .NNN from a sector list

Purpose: Display one of the entries from the list last shown
It can be applied on Directory- as well as Allocation-lists
The number (NNN) to use is displayed to the left of the list

Parameters: NNN The zero-based decimal entry number to show

id optional Identifier for LSN list (see list command)

Output: Sector display, format selected based on sector-contents
 

Enter = down in hierachy (Enter = down)

Purpose: Display the next, most likely wanted, sector

Parameters: none

Output: Sector display, format selected based on sector-contents
 

u = up in hierachy

Purpose: Display the sector that is higher in the hierarchy (parent)

Parameters: none

Output: Sector display, format selected based on sector-contents
 

x = Extra LSN

Purpose: Display the sector marked as eXtra

Parameters: none

Output: Sector display, format selected based on sector-contents
 
 

SLT [t i s m] = Show SLT for 'type', at index i, size s, error-mask m

Purpose: Display (selection of) the Sector Lookup Table

Parameters: t optional Sector-types to include in the displayed
list. Default is all types ('*')
Types are same as specified for 'f' cmd

i optional Start index in the SLT to display,
'+' and '-' show next/previous screenfull
'a' will show entire SLT

s optional Number of entries to display, default will
result in one screenfull; '*' = rest of SLT

m optional Error filtering mask, * = all errors
4-digit Hexadecimal value, each set bit
will include a specific error value.
When prefixed with a '+' sign, the ouput
will be verbose (error-text & path+filename)

Output: One line for each entry in the SLT, containing:
LSN Start LSN for a range of sectors
size Number of sectors in the range
ref Other sector refering to this range (fnode)
type Type of the sectors in the range
error 4-digit Hexadecimal error value:

0x00000001 Linked to some structure, but not in bitmap
0x00000002 Allocated in bitmap, but no known link
0x00000004 HPFS shortname does not match DIR name
0x00000008 Fnode is a directory but DirFlag is not set
0x00000010 Fnode datalength greater than Dir-entry size
0x00000020 Fnode datalength smaller than Dir-entry size
0x00000040 Fnode datalength greater than allocated size
0x00000080 Fnode datalength smaller than allocated size
0x00000100 Checksum value is incorrect
0x00001000 LSN does not point to valid dirblock
0x00002000 LSN does not point to valid Fnode
0x00004000 LSN does not point to valid Allocation sector
0x00008000 LSN is too large for this volume

Remarks: Sector ranges might overlap, the smallest matching range will
hold the best identification for a specific sector.
The start-index will default to the position of the sector
last searched using the 'i' cmd.
If needed the SLT will be built in a background thread.
 

id [xx] = Identify, using sector lookup table

Purpose: Display the type for a specific sector and one major reference

Parameters: xx optional LSN of sector to identify, default is
the current sector

Output: One line specifying corresponding SLT entry, followed by
a line specifying the type of the sector itself and a
sector display of the 'ref' sector, in a format based
on sector-contents

Remarks: This function is extremely usefull to relate file-data sectors
from fragmented files to the Fnode for the file.
It will tell you exactly to wich file a certain sector belongs.

log [file] = Log (append) to 'file' (.log); (No file => stop logging)

Purpose: Close current LOG, open new and capture DFS output in it

Parameters: File specification
If no parameter is specified, logging is stopped.

Output: Concatenated output of DFS commands given after the
'log' command, upto next 'log' or 'q' command.
ANSI control characters for colors and cursor-positioning
are not written to the logfile.

Remarks: There is no check on available space on the destination
drive, file may end up empty if disk(ette) is full.
The same logfile specification can be used more than once,
output will be concatenated.
On each 'log' command the current logfile will be closed.
 

trace [lvl] = Set trace level for DFS internal functions

Purpose: Investigate unexpected behaviour and debug DFS

Parameters: lvl optional Trace level; 0 = no trace

Output: The resulting trace-level, after this the output will be
normal output mixed with extra trace information showing
API return-codes and DFS internal variables

Remarks: Only available in the special DFSTRACE.EXE version
 

prio [lvl] = Set relative priority of the DFS main thread

Purpose: Increase (search) speed with +, or decrease system impact

Parameters: lvl optional Prority level; + and ++ = high(est),
- and -- = low(est)

Output: The resulting prio-level

Remarks: When running on low(est) priority in the background, DFS
will almost come to a halt.

q = Quit DFSee OS2-32; 2.69 24-07-98 (c) 1994-98; Jan van Wijk

Purpose: Exit DFS program

Remarks: Opened physical disk and logfile will be closed on exit
Asynchronious running threads will be aborted.
 

cd [path] = Change current Directory

Purpose: Change both the current directory and the current drive

Parameters: path optional Absolute or relative path specification

Output: The resulting current drive and directory

Remarks: '.' and '..' can be used in the relative path specification

run mf [arg] = Run a REXX macro from DFS

Purpose: Execute a REXX script using the 'DFS' environment

Parameters: mf mandatory Macro file specification

arg optional Arguments to the REXX macro

Output: Any output from the REXX macro including (OS/2) commands
executed from the macro.

Remarks: DFS commands can be issued from within the macro, this
is the default environment (Address DFS).
Commands for CMD.EXE must be addressed using 'Address Cmd'

The following REXX variables will be available after
each executed DFS command from a macro:

rc The returncode from the DFS command

dfs_disknr Physical disk number currently open
dfs_partid Partition-id for selection with "part"
dfs_drive The opened drive letter, including a colon.
dfs_afsys The attached filesystem, like "HPFS" or "FAT"
dfs_sect The last retrieved sector(s), binary buffer
dfs_type Type of last retrieved sector, this is a string
starting with the type-character (see 'F' cmd)
followed by a textual description.

dfs_this SN of the last retrieved sector
dfs_down SN of most likely sector to retrieve now
dfs_up SN of sector up in hierarchy
dfs_next SN of next in sequence
dfs_prev SN of previous in sequence
dfs_down SN of up in hierarchy

dfs_number The number of disks or partitions resolved,
from the commands "disk 0" and "part 0" or
"part" respectively.

dfs_sn.0 Number of sector-numbers in the SN stem variable
dfs_sn.n nth sector-number in the SN stem variable, coming
from DFS output for directories and allocation.
They correspond to the '.NNN' command

Note: SN's are in an 8-digit Hexadecimal format
 

REXX is dynamically loaded, when the run-command is exectuted
It requires REXX.DLL and REXXAPI.DLL in the libpath.
 

copyoutput [stem-name] Copy output from last-command to REXX stem-var

Purpose: Allow output to be captured and processed from REXX

Parameters: stem optional name of stem variable, ending in a '.'
default: "dfs_output."

Output: none

Remarks: The <stem>.0 will hold the number of lines
<stem>.1 through <stem>.n the actual cmd-output
 

scan [wr [NoId]] = Scan bad-sectors; use read/Write verify; No automatic id

Purpose: Identify bad sectors on a physical disk or logical volume

Parameters: write optional 'w' to use full read/write/verify sequence

NoId optional 'n' to disable automatic SLT lookup

Output: Progress indication based on sector-numbers, and one line for
each bad-sector found, plus an SLT display of a related sector
like the fnode, if automatic SLT display is enabled.

Remarks: For REXX, the dfs_sn.0 stem variable will hold the number of
bad-sectors found and dfs_sn.1 through dfs_sn.n the actual
bad sector numbers (can be shown with the 'list' command)

Without the write option, only a single 'read' will be done
for each sector, this can be executed on a running system
with open files on the disk/volume to be checked.

With the write option a "read/write-inverse/read/write-normal"
sequence is done for each sector with contents checking.
The contents of each sector will stay the same, so the function
can be safely executed on formatted disks with live data.
This sequence takes at least 4 times more time to complete
and also, for safety, the disk will be locked. This means that
the write option can only be used when the complete physical
disk is not being used.

Remarks: Also available for REXX in the dfs_sn. stem variable
 

screen [arg] = Switch output to the screen on or off

Purpose: Allow output to logfile only

Parameters: arg optional 'on' or 'off' to switch mode

Output: none

Remarks: The returncode (rc from REXX) will indicate the setting for
screen output: 0 indicates screen switched on
1 indicates screen switched off
 

sep separ = Specify a different separator character for multiple commands

Purpose: Allow use of the current separator-character in commands,
while still allowing multiple commands to be specified in
a single commandline.

Parameters: separ mandatory One character being the new separator

Output: none

Remarks: If part of a multi-command itself, the 'sep; command needs
to be terminated with the current (old) separator.
The rest of the multi-command uses the new value.

Example: dfs sep ~#log inifiles~part d~fos2.###~q
 

Command reference, FAT specific commands
----------------------------------------

Active filesystem : FAT, specific commands are:

\path-spec = find and show file/directory relative to root (see find)
alloc [+|-] = Display allocation map for FAT, more [+] or less [-] detail
cl = Translate and display 'this' LSN as a cluster nr
cl clust [cmd] = Translate specified cluster-nr to LSN, display using 'cmd'
fatselect [fat] = Select fat to be used (cached), fat = 1 or 2; default is 1
fatshow [*|nr] = Display contents of the FAT from memory, [nr] entries
space [clust] = Show allocation for specified cluster or current LSN 'this'

For an up-to-date list of commands, use the '??' command

FAT specific sector types
'1' = First FAT area '2' = Second FAT area
'3' = Start 12-Bits FAT '4' = Start 16-Bits FAT
'8' = Start 32-Bits FAT
'\' = Root directory
'd' = Sub directory 'D' = Directory data
'I' = File data
'X' = Bad sector-area
 

alloc [+|-] = Display allocation map for FAT, more [+] or less [-] detail

Purpose: Show usage and the distribution of data over the volume.

Parameters: + or - optional Show more or less detail by changing the
the number of Kb represented by each char

Output: A single bitmap-graphic for the entire volume

Remarks: Boot-sector, both FAT's and the Root-directory are represented
in the first display=line using colors. The size of FAT/Root
is proportional to their real size and the percentage of used
entries in the root-directory is shown at the end of the line
 

cl = Translate and display 'this' LSN as a cluster nr

Purpose: Find out what cluster-nr corresponds to current LSN

Parameters: none

Output: The cluster number, or an error message when invalid
 
 

cl clust [cmd] = Translate specified cluster-nr to LSN, display using 'cmd'

Purpose: Display data using a cluster-nr instead of an LSN

Parameters: clust mandatory The cluster-nr of interest

cmd optional DFS generic command to execute with clust
as its first and only parameter (like 'H')

Output: The output for the cmd, when no explicit cmd is specified this
will be the DFS default for the corresponding LSN, usualy a
display of that sector(s) in an appropriate format.

fatread [fat] = Read fat from disk into memory, fat = 1 or 2; default is 1

Purpose: Update the in-memory FAT from the disk-FAT

Parameters: fat optional Number of the disk-FAT, either 1 or 2

Output: none

Remarks: FAT12, FAT16 and FAT32 formats are supported
 

fatwrite [fat] = Write-back fat memory to disk, fat = 1 or 2; default is 1

Purpose: Update the on-disk FAT with the possibly changed in-memory FAT

Parameters: fat optional Number of the disk-FAT, either 1 or 2

Output: Message indicating success or failure

Remarks: This is a potentialy dangerous operation, also usualy both
FATs on the disk need to be in-sync. So 2 writes are needed.
 

fatshow = Display contents of the FAT from memory

Purpose: List all FAT-entries separately for analysis

Parameters: none

Output: A list of FAT-entries with 8 values in each line, <free>
<bad> and <eof> values are shown as such.
 

saveto [dir][l] = Save filedata for (current) dir+entry LSN to a file

Purpose: Recover a file based on it's directory entry and the FAT, by
a low-level sector-by-sector copy of its data to a new file.

Parameters: dir optional Path to save the file copy, default a:\

l optional LSN (dir+entry) of the file to recover

rename optional new name for destination file

Output: Progress is reported with one RED or GREEN dot for each sector

Remarks: Only the file contents is recovered, date&time and attributes
are lost.
If no directory is specified it will default to the last one
used for saveto. This directory should be on ANOTHER drive!
 

space [clust] = Show allocation for specified cluster or current LSN 'this'

Purpose: Show size and fragmentation of allocated space for a cluster

Parameters: clust optional Cluster number

Output: A list of allocation-chunks with LSN's and sizes

Remarks: none
 
 

Command reference, NTFS specific commands
-----------------------------------------

Active filesystem : NTFS, specific commands are:

mft [mft-recnr] = Calculate LSN for MFT record-nr and perform default display
 
 
 

Command reference, HPFS specific commands
-----------------------------------------

Active filesystem : HPFS, specific commands are:

\path-spec = find and show file/directory relative to root (see find)
alloc [+] = Show data-band allocation bitmaps, compact or [+] verbose
albit a [lsn s] = Set/reset allocation bit in bitmap for lsn-range
autobase [t][l] = find the start of an HPFS partition by searching sectors
of types [t], default 'spad'; [l] is last valid sector
bitmap [xx,s,D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format
ca [lsn][opt] = Check Allocation integrity for (current) fnode lsn
check [drive] = Check filesystem integrity for drive-letter (CHKDSK)
cs = Calculate HPFS checksum for current sector
delfind [short] = Find deleted files, with name starting with [short]
delshow [w;p] = Show delfind list, optional wildcard, minimum percentage
dirmap = Show directory band allocation and usage map
findroot [n] = find the Root directory without using the superblock
starting the search at LSN [n]
fixbs [clear] = Update bad-sector table with LSN's from DFS badsec-list
fixcp = Update superblock with found LSN for codepage info
fixcs = Calculate checksums and write super- and spare-block
fixroot = Update superblock with found LSN for root-directory
getbs = Read HPFS bad-sector table into DFS badsec-list
path [n] = Show all path-components for current fnode, upto root

For an up-to-date list of commands, use the '??' command

HPFS specific sector types

'I' = File data 'E' = EA data
'A' = ACL data 'B' = Boot area
's' = HPFS superblock 'p' = HPFS spareblock
'H' = Hotfix table 'h' = Hotfix data
'x' = Bad sector-list 'X' = Bad sector
'S' = Spare dirblocks
'D' = Directory Fnode 'y' = Deleted Dir Fnode
'f' = File Fnode 'z' = Deleted FileFnode
'a' = Allocation block 'Z' = Deleted All-block
'd' = Directory block 'P' = Dir-band (free)
'Q' = Dir-band bitmap 'c' = Codepage info
't' = Codepage data 'i' = HPFS386 User-id
'm' = Bitmap Tables 'M' = Bitmap data

For an up-to-date list, use the '???" command
 

autobase [t][l] = find the start of an HPFS partition by searching sectors

Purpose: Force a different partition start sector-nr for HPFS partition

Parameters: t One or more sector-types to use in the search
default is "spad", Super, Spare, Alloc and Dirblock
f for fnode can also be used but is less reliable
sl Sector-number to use as end for partition (optional)

Output: Search progress and finel result when HPFS partition found

Remarks: Can be used if start of partition / partition-tables are bad
Use the "fs hpfs" command first!
 

alloc [+] = Show data-band allocation bitmaps, compact or [+] verbose

Purpose: Show usage and the distribution of data over the volume.

Parameters: none

Output: A single bitmap-graphic for the entire volume or for each
allocation-band when verbose format is selected

Remarks: System-reserved and Directory-band are indicated with 'S'
and 'R' respectively. Other area's are filled in according
to the degree of usage (allocation)
 

dirmap = Show directory band allocation and usage map

Purpose: Show usage of the pre-allocated directory-band

Parameters: none

Output: A single bitmap-graphic showing the allocation of the
pre-allocated directory band.

Remarks: If 100% is allocated more directory information will be
allocated elsewhere on the volume.

bitmap [xx s D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format

Purpose: Show a bitmape located at specified LSN, alloc or DIR format

Parameters: xx mandatory LSN of a bitmap sector

s optional size to dump: 1..63 specifies sectors
64..xxx specifies bytes
Default is 4 sectors (default bitmap size)

D optional Directory-format flag

Output: One bitmap-graphic for the specified bitmap LSN.

Remarks: Specifying an LSN that is not a bitmap-LSN will result in
a garbage bitmap display.
 

albit a lsn s = Set/reset allocation bit in bitmap for lsn-range

Purpose: Manualy set or reset allocation bits in the bitmap

Parameters: a mandatory 's', 'a' or '1' will set to "allocated",
others will set to "free" state.

lsn optional Start LSN for the range, default is 'this'

s optional size for the LSN-range, default is 1

Output: none

Remarks: This is a potentialy dangerous operation.
 

\path-spec = find and show file/directory specified by path-spec

Purpose: Locate the fnode for a known file- or directory

Parameters: path-spec full path specification with no intervening
space after the '\' command character

or absolute- or relative path specification
with an intervening space. If the path
does not start with a '\' it is relative
to the current directory (see CD cmd).

Output: Searchlist starting at the ROOT directory upto the requested
file or directory. It is either followed by an error message
if the path-spec was not found or by the display of the
corresponding fnode information.

Remarks: The search algorithm depends on the ROOT fnode being known.
When the superblock is corrupt this fnode can be resolved
using the 'findroot' command.
 
 

path [n] = Show all path-components for current fnode, upto root

Purpose: Show the directory-branch that contains current file/dir

Parameters: n optional Start LSN for the search

Output: One line for each found 'parent' directory, upto the root

Remarks:
 

ca [lsn][opt] = Check Allocation for (current) fnode lsn

Purpose: Check allocation integrity for current fnode

Parameters: lsn optional LSN of the fnode
opt optional Options: v = Verbose, show progress

Output: õ Start of an allocation-sector (heavily fragmented)
» Start of one file-extent (fragmented file)
· One sector, green small dot is allocation OK
þ One sector, red big dot is allocation error

Also a summary is given with the number of (failed) sectors

Remarks: Fnode maybe for a regular file (sectors must be ALLOCATED)
or for a deleted file (sectors must be FREE)
 

findroot [n] = find the Root directory without using the superblock

Purpose: Find the fnode for the ROOT directory, even if parts of
the volume, including the superblock, are damaged.

Parameters: n optional Start LSN for the search

Output: Search-list starting at the first fnode encountered upto
the fnode for the ROOT directory when found.

Remarks: Specifying a startlsn might be needed if reading at the
start of the volume results in device errors, or if some
fnodes in the sequence are corrupted.
 

fixroot = Write the root-LSN found with the 'findroot' command back

Purpose: Fix bad Root-LSN pointer, after CHKDSK bugs or other corruption

Parameters: none

Output: none

Remarks: It is better to lock the physical disk before writing to it
 

fixcp = Write the CodePage-LSN found with the '0#f c' command back

Purpose: Fix bad CodePage-LSN pointer

Parameters: none

Output: none

Remarks: It is better to lock the physical disk before writing to it
 

fixbs [clear] = Update bad-sector table with LSN's from DFS badsec-list

Purpose: Replace the internal HPFS bad-sector list with the DFS
bad-sector list, or clear the liste completely.

Parameters: clear optional Make internal and DFS bad-sector list empty

Output: none

Remarks: The list can be the result of the "scan", "getbs", "mem" or
"import" cmd, allowing modification off-line with an editor.
The OS/2 chkdsk command will give erronous results on
"reserved for system use" until the next reboot.
It is better to lock the physical disk before writing to it
See 'lock' and 'unlock' commands

getbs = Read HPFS bad-sector table into DFS badsec-list

Purpose: Replace the DFS bad-sector list with the internal HPFS one

Parameters: none

Output: none

Remarks: none
 

cs = Calculate HPFS style checksum on last-read sector

Purpose: Show / check checksum on HPFS sector (super/spare)

Parameters: none

Output: Checksum value

Remarks: Only meaningfull for superblock (10) and spareblock (11)
These checksums are also stored by HPFS in the spareblock.

fixcs = Calcualte checksums and write super- and spare-block

Purpose: (re)calculate the checksum for superblock and spareblock
and write them both back to the disk

Parameters: none

Output: none

Remarks: none
 

saveto [dir][l] = Save filedata connected to (current) fnode to a file

Purpose: Recover a file if the fnode can still be found, by making
a low-level sector-by-sector copy of its data to a new file.
(basic functionality to be used for undelete operations)

Parameters: dir optional Path to save the file copy, default a:\

l optional LSN of the fnode of the file to recover
default is the current LSN (This)

rename optional new name for destination file, allowing
long-filenames to fit 8.3 names (floppy)

Output: Progress is reported with output like the "ca" command,
error messages will be given as appropriate

Remarks: Only the file contents is recovered, date&time and attributes
are lost. (EA's will be recovered as of version 2.42)
If no directory is specified it will default to the last
directory given, or "A:" when it is the first time
If the directory does not exist it will be created

Make sure that this is on a DIFFERENT drive, otherwise it
might overwrite the data you are recovering or still need
to recover later.
 

delfind [short] = Find deleted files, with name starting with [short]

Purpose: Find deleted files, with name starting at current LSN

Parameters: short optional shortname, first part of filename

Output: Find-result list (as "f* z") on screen and in memory

Remarks: List can be manipulated as usual, best viewed with "delshow"
 

delshow [w;p] = Show delfind list, optional wildcard, minimum percentage

Purpose: Display a list of deleted Fnodes

Parameters: w optional wildcard selection for display

p optional Minimum allocation-OK percentage

Output: LSN list in fnode format (as "list f+f *;1" command)

Remarks: Default wildcard is '*', default percentage is 1
Wildcar