DFSee version 17.0 2022-10-25 (c) 1994-2022: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Global program switches = Commandline switches for DFSee startup Generic command options = Options that work on (almost) all commands Summary of commands = One line per command, summary listing Command reference = Reference of general DFS commands _______________________________________________________________________________ #010 G L O B A L P R O G R A M S E T T I N G S: _______________________________________________________________________________ The DFSee program has quite a few global settings that control the behaviour of various parts of the program. They all have default values that can be overruled by specifying one or more 'switches' as specified below. The switch character for dfsee switches is '-' or '/'. All single letter switches are case-sensitive. Long switchnames like 'query' that do not have single letter abbreviations are not case-sensitive. When using "expanded" versions of single-letter switches, e.g. '-related', instead of '-r', they are still case sensitive. [global-dfsee-switches] [DFSee multi-command] Switch character for dfsee switches is '-' or '/'. All single letter switches are case-sensitive, long switchnames like 'query' are not. Note: At the moment (DFSee 16.3) you can NOT use any DFSee script variable like $_exedir or $_version as part of a switch value TX library / user-interface specific switches: ============================================== -123[t][s][l][r][dxx] = trace level 123, [t]stamp; [s]creen, No [l]ogging [r]e-open, [d]elay program xx ms per trace line -7 = use 7-bit ASCII only (no 'graphic' or drawing characters) -7- = use 8-bit ASCII incl graphic/drawing characters (default) -$ = do variable/expression substitution in commands (default) -$- = no variable/expression substitution (see 'SET var off') -a = switch off usage of ANSI escape characters for color -color:value = output colors, 0..7 add any: 0=std 1=invert 2=bright 4=blue -C:[2|88|256] = Force number of colors in palette to 1, 2, 8, 16, 88 or 256 -dir:path = Default data directory for File Open/Save and related cmds -E:[c|i|q] = default error strategy Confirm, Ignore or Quit the command -f = Use a border frame on output-window and desktop (default) -f- = Suppress border frames where possible, allowing more lines -F = Do auto-Fail critical errors, no popup (default, DOS only) -F- = No auto-Fail critical errors, use Retry pop-up (DOS only) -insert- = start with keyboard INSERT mode OFF, using OVERWRITE mode -keyb:cc = foreign keyboard support using 'key\cc.kl' file (DOS only) -l:logfile = start logging immediately to 7bit ascii file 'logfile.log' (supporting ~1..9 date/time substitution, see cmd 'log -?')", -l = present file-save dialog at startup, start logging to file -l- = do NOT present dialog at startup to start logging (default) -logauto = automatically number logfiles that are started from a dialog -logdate = automatically postfix logfilename with a 'YYYYMMDD' date -menu = startup with the menu active, default menu selected (default) -menu- = do not start the menu at startup, start on the commandline -menu:letter = startup with menu dropdown indicated by 'letter' activated -M:[0 .. 5] = menu-style: 0=AutoDrop, none of the values added up (default) 1=no-submenu-open-on-right-arrow, open next menu 2=No-auto-drop on open, or on move to next menu 4=Delayed-drop-on-F10-open when auto-drop is ON -mouse Explicit on OS/2: force mouse cursor in full-screen session -mouse = DFSee specific mouse-handling, click, drag and mark (default) -mouse- = No DFSee specific mouse-handling, disable mouse completely (may allow the OS environment to use native mouse operations) -O:s|q|n|v|m = default output verbosity Silent, Quiet, Normal, Verbose, Max -refresh = Refresh whole screen at every update of the statusline -reset = resets screen/terminal on exit (UNIX: reset, others: CLS) -scheme:name = window scheme: grey|m3d|nobl|cmdr|half|full|white|black|dfsee -screen:WCxR = explicit size as Cols x Rows, like W80x25 or W120x39 (Unix) -sigint- = Use Ctrl-C for the 'Copy to Clipboard' function (default) (abort running operations with the key instead) -sigint = Let Ctrl-C exit the program immediately (aka emergency exit) -sysmouse:n = Manage OS/2 'Mouse Actions' and 'DragText->Mouse Marking' menus 0 = Disable std OS/2 + Dragtext items until program exit (default) 1 = Disable only std OS/2 item, leaving DragText fully operational 2 = Leave std OS/2 and DragText menu items under user control -style:value = line style, 0..3: 0=std-double 1=3d 2=halfblock 3=fullblock -W = Force scrollbar/window-resize check, even on Win10 (WIN only) -W- = NO scrollbar/window-resize check done at startup (WIN only) DFSee program specific switches: ================================ -? = help on DFSee commandline switches (this text) -A:nr = number of sector read attempts, default 1 (no retries) -align:#sect = partition alignment on CR, default 0=auto-Cyl/MiB, 1=MiB -b = batch option, automatic 'batch on' command at startup -b- = interactive option, 'batch off' command at startup (default) -B = Show the version/copyright banner on DFSee startup (default) -B- = Suppress the version/copyright banner on DFSee startup -c:[1|2] = CHS dummy style: 1=PQmagic, 2=MS, default 0=IBM/DFSee -d = Add the physical disks to devicemap at startup (default) -d- = do NOT add any physical disks to the devicemap at startup -d:[max] = Add at most 'max' physical disks to devicemap at startup -D:letter = linux device letter, default SCSI/SATA, use 'h' for IDE -echo = Echo each command to output-window and logfile (default) -echo- = Suppress command echo before each command being executed -expert = Set UI menus and dialogs to EXPERT mode on startup -expert- = Set UI menus and dialogs to BASIC mode on startup (default) -floppy = Include floppies A: and B: in volume lists (menus/dialogs) -g = Display specific information to STDOUT only (Engine mode) -G[:1..20] = Progress percentage to STDOUT only (> 10 is single line) -G:0 = Display progress BAR to STDOUT, no percentage, no texts -geocalc = Calculate disk geometry from the MBR/LVM contents (default) -geocalc- = Do NOT calculate disk geometry from contents, use OS geo -gptauto = Interpret GPT info when present show GPT tables (default) -gptauto- = Do NOT interpret GPT info, but show protective MBR instead -h:[0|1|2|3] = PTE use hex SN+Size fields (1), CHS fields (2) or both (3) -H- = Set default input radix for SECTOR and TYPE values to DECIMAL -H:mask = Set HEX input radix for selected classes (see dfscmds.txt) -i = ignore lock-errors, no pop-up warnings (default, OS/2 only) -i- = do not ignore lock-errors, with extra pop-up, (OS/2 only) -L = use large-file for > 2 GiB file support (default, OS/2 only) -L- = do not use large-file for > 2 GiB file support (OS/2 only) -m[:autoshow] = use 'map' or user defined cmd for 'autoshow' in FDISK mode -p:[0|1|2] = warning level, 0 = minimal (default), 2 = maximum (pedantic) -P = Use prompting and input dialog windows where needed (default) -P- = Don't use prompting and input dialog windows (aka batch mode) -profile- = Do NOT execute DFSee standard profile script 'profile.dfs' -profile:name = Use specific profile, name or full path, including extension -Q = quit DFSee automatically after last command has been executed -Q- = do NOT quit automatically after last command (default) -q = quiet option, automatic 'screen off' command at startup -query = execute a query command with logfile, quit automatically -r:regfile = registration filename with optional path and extension -R = start in Read-only operation, no write back to disk/volumes -S = shell mode, do not allow quit from DFSee (use as OS shell) -s:separator = specify a command separator character, default is '#' -synclvm = Try to synchronize the LVM Engine on driveletter changes -simulate:nnn = simulate a BAD-SECTOR error on every modulo 'nnn' PSN read -skipfs:name = skip filesystems of type 'name' when matching driveletters -t = include timestamp line with date/time infor before each command -t- = do not include timestamping lines beore each command (default) -V = Refresh the volumes list when starting a file-dialog (default) -V- = Do NOT refresh volume list for each file-dialog, to save time -w = Use windowing user-interface, with menus and dialogs (default) -w- = Use a command-line drive user-interface, no menus or dialogs For help use the '?' and '??' commands, use the key or read DFSCMDS.TXT Additional customizing, by running of some initial commands, can be done by creating an ASCII file called 'profile.dfs' in the same directory as the DFSee executable (or somewhere in the PATH). For an example, see the TEMPLATE file 'proftemp.dfs' in the distribution. You can customize that, and rename it to 'profile.dfs' to be used with DFSee. It can also be included in your own DFSee CDROM (See readme.txt with ISO) The default number base (radix) for parameter and input values is DECIMAL, but can be overruled using the '0x' prefix to force them to HEXadecimal. (values that contain any of the 'A' to 'F' digits are considered HEX too) Also, you can change the default to be HEX for all SECTOR-number and partition-TYPE values by using the startup-switch '-H'. You can set specific value 'classes' to default to HEX using '-H:mask' or the set command 'set radix mask-value' where the mask value is the addition of any of the following: 1 = standard / rest 2 = postfixed ,s values (sectors, like 123,s) 4 = postfixed, other units (like 456,m) 8 = DFSee sector values like start and end location 16 = DFSee size values like a wipe, clone or image size 32 = DFSee partition type values Note: Before version 9.11 the default radix 'mask' in DFSee was 42 = 0x2a, meaning all sector and type releated values would default to being HEX. _______________________________________________________________________________ #020 G E N E R I C C O M M A N D O P T I O N S: _______________________________________________________________________________ Many DFSee commands accept options, as a '-' sign plus a letter or name string and an optional value that are specific to the command. There are a few options however that are implemented on a generic level and work for ALL commands: -? = Give usage on this specific command (first and only option) -B = Batch mode ON, so no confirmations asked (use with care!) -B- = Batch mode OFF regular confirmations asked (default) -D = Display DELETED files in FAT/EFAT directory views -D- = Ignore DELETED files in FAT/EFAT (like DIR command, default) -E:[c|i|q] = error strategy : Confirm, Ignore or Quit (confirm is default) -echo = Display the 'DFSxxx executing: ...' echo line (default) -echo- = suppress the 'DFSxxx executing: ...' echo for this command -l = Create new sectorlist when displaying (DIR) data (default) -l- = Do NOT create new list when displaying (directory) data -O:s|q|n|v|m = Set output verbosity Silent, Quiet, Normal, Verbose, Maximum -P = Use prompting and input dialog windows where needed (default) -P- = Don't use prompting and input dialog windows (aka batch mode) -Q or -Q:3 = Quiet screen mode, turn screen off while executing command -Q:2 or -Q:3 = Quiet log mode, turn logfile off while executing command -trace = Explicitly switch tracing ON for this command, level 100 -trace- = Explicitly switch tracing OFF for this command -X = Set next sector to the MFT/Fnode/Inode/Fat data (default) -X- = Do NOT set next sector to the MFT/Fnode/Inode/Fat file data _______________________________________________________________________________ #030 S U M M A R Y O F C O M M A N D S: _______________________________________________________________________________ The user interface has a choice of using the menu-system (default) or the command line with a command entry-field plus history buffer so previous commands can be recalled. Output will be displayed to the screen in a large output buffer that can be scrolled up and down using plus arrow keys. You can switch between the menu and command line using the key. Output can also be copied to a file for later analysis. When using the menusystem, you don't need to know the actual command syntax, although most menu-selections will be translated to a corresponding command before being executed. DFSee commands are single words or (hexadecimal) numbers. Most commands have one or more parameters of which some are optional. DFSee keeps track of the current SN and some other useful SNs so they can be referenced faster, without having to type them in. They are: Name Cmd Description ---- --- ----------- up 'u [st]' up in hierarchy, as specified sector type down 'd [st]' down in hierarchy, as specified sector type down down in hierarchy this 't [st]' this (current), as specified sector type xtra 'x [st]' Extra or alternative, as specified sector type forward '+[num]' the next sector, or 'num' decimal sectors forward backward '-[num]' previous sector, or 'num' decimal sectors backward Also see 'gf'/'gb' commands, with mcs parameters, use the '>' and '<' keys as '+1' resp '-1' shortcuts The [st] values are the single character sector types as displayed using the '???' command, or the 'Help -> Available sector types' menu. Variable substitution --------------------- In addition to this, the DFSee TX scripting engine also keeps a lot of internal values available in variables, that can be used in commands as well, usually by typing the variable name, as in: log $_exedir\..\log\mylogfile Or, when special characters cause syntax errors, by enclosing it as an expression: log $exedir\log-for-{{$_version}} The embedding in double brackets prevents the '-' characters to be interpreted as MINUS. Note that inside such double brackets you can use complete expressions including arithmetic and calling DFSee script functions. See DFSCRIPT.TXT. General DFSee command hints --------------------------- You can display and analyse either a physical disk, a partition, a volume or an imagefile. A physical disk can be opened using the 'disk' command. A disk-partition or volume needs to be opened first with the 'part' or 'vol' commands respectively. The following prompt will show some status info. After opening an HPFS partition, using 'Enter' a few times will take you to the superblock, root directory, possible sub-directories up to some file. Multiple commands can be chained if separated with a special character, the default is '#' but this can be changed with the 'sep' command. An overview of the available commands is given below, it can also be referenced from within the program using the 'help' command. HINT: When using DFSee to create a logfile, DO NOT USE ">" REDIRECTION, use the DFSee "log filename" command or the "-l" program switch instead. This will prevent littering the logfile with ANSI control codes. _______________________________________________________________________________ A list of selection commands (output of the 'help' command) _______________________________________________________________________________ DFSee basic selection commands, use '??' for other generic commands For help on the command line switches (to the EXE) use 'DFSxxx.EXE -?' Batch mode can be forced with the '-B' option on the cmd as in 'FDISK -B' Any command not recognized will be passed to the Operating System The DISK, FDISK, PART and VOL commands can select a specific mode which makes more specific commands available, use '?' and '???' for details mcs-number = Analyse & display sector, SN using mcs-number sector LSN ? or /? = Show current FS (mode), specific commands and help info ?? = Show list of all generic commands with short description ??? = Show all recognized sector types for current filesystem (listed for generic ones and most filesystems further down) , u, x = Show next with , up with 'u' or extra LSN with 'x' _______________________________________________________________________________ A list of generally available commands (output of the '??' command) _______________________________________________________________________________ .NNN = Display numbered FS-entity marked .NNN from Sectorlist A|a SSN [size] = ASCII-dump (half)sector, at SSN, 'size' sectors or bytes ABOUT [options] = Show version and registration information for DFSee/TPlib AL [sn] [sz] [o] = Display/Write allocation status for sector/cl/block range ALLOC [options] = Display allocation map in various size, show RESIZE limits BASE [options] = Show (and set) base start and end values in several ways BATCH [on |off] = Set batch mode, no confirmation or locking-error reporting BPS SectorSize = Force sector size to specified value (decimal, bytes) BROWSE [path |.] = Browse contents of one directory, using the Sectorlist BSFIND [type][w] = Find MBR/EBR/boot/LVM-sectors, on Cyl/MiB/Both/ALL sectors CC [#lin [strt]] = Clipboard Copy, copy lines from output window to clipboard CP = Clipboard Paste, copy clipboard text to the output window CV [select][opt] = Copy selected value to the clipboard as a (Hex) string CSLIST [-s][-m] = Put Cylinder/MiB aligned special Sectors into sector-list CD [path] = Change current directory and current drive CWD [drive] = Show current working directory, for specified driveletter CL = Translate and display 'this' LSN as a cluster nr CL clust [cmd] = Translate cluster number to hex LSN, then execute 'cmd' CL2S clust = Translate cluster number to hex LSN, display LSN value CHECK [dr/nr] = Report all detected filesystem errors using SLT info CHS c h s = Analyse & display sector, using CHS (cylinder head sector) CLONE [options] = Copy sectors from other (disk/part/vol) to current store CMD [command] = Force execution of command by Operating System, not DFSee COMP [options] = Compare sectors from other (disk/part/vol) to current store CONFIRM [-y] msg = Show a notification, or a confirmation message [-y] CS [sn] [-v:cs] = Calculate 32-bit checksum for sector, optional verification DELSHOW [sel] = Show delfind list, with selection wildcard and threshold DFSCHECK[part|*] = Run dfsXXXX FS analysis for one or all partitions => DFS*.P* DFSDISK [disk|*] = Run DFSDISK (lost!) partition analysis for disks => dfsdiski.* DFSFAST [disk|*] = Run DFSFAST existing partition analysis on disks => dfsfast?.* DIRFIND [l][dir] = Put [l] levels of filenames from [dir] in the Sectorlist DISK [disk-nr] = Select a physical disk and show the MBR, [-r] = reset geo DISPLAY = Show current display size in rows and columns EDIT [-a -h -u] = String replacement edit, using Ascii, Hex or Unicode string EDIT [options] = Start HEX sector-editor on current or specified location EDIT filename = Start HEX sector-editor on specified file (binary edit) EXPAND [options] = EXPAND FS to a new LARGER size, incl. Part-table update EXPORT [fn][opt] = Export Sectorlist, to LSN file and optional data file FDISK [FdiskCmd] = Activate the FDISK fs (mode) and optionally execute cmd FI [SSN] = File information on specified symbolic-SN, default 'this' FIND options [s] = Find sectors based on options, and optional string [s] FINDPATH path = Find and show file/directory specified by path-spec FINDSPACE = Show filefind/delfind find-SPACE (DIR/MFT/FNODES/INODES) FIXBOOT [opts] = Fix a filesystem bootsector, FAT(32), HPFS, NTFS, JFS FIXPBR [options] = Fix HiddenSectors and Geometry bootsector to match p-table FS fsys-name = Force analysis mode for filesystem 'fsys-name' GB [distance] = Go backwards 'distance'; an mcs-number, default is 1 sector GF [distance] = Go forward 'distance'; an mcs-number, default is 1 sector GEO ?|c h s f b = Set/Display specified geometry on opened object, ?=adjust GREP [phrase] = Search the text output window, present results in a list HELP phrase |s|i = Search in HELP information (aka GREP) or list sections/items H|h SSN [size] = Hex-dump (half)sector, at SSN, 'size' sectors or bytes ID [ SSN | -L ] = Identify 'this', specified SSN or LAST sector, using SLT IM [file] [opt] = Open a file with FS-image (.img/.imz) for display & analysis IMAGE file [opt] = Save an object to imagefile(s) using specified options IMZ [imz] [opt] = Start BROWSE session on selected IMZ compressed image file IMZ2RAW imz raw = Create uncompressed (RAW) image from an IMZ compressed one IMZINFO imz = Display information from an (IMZ compressed) imagefile IMPORT [fn] = Import LSNs to the Sectorlist, from file [fn] LABEL [label] = Display/edit 11-char volume label in bootsector / alt-loc LIST [opt] [str] = Display LSNs in the Sectorlist, using options/string LISTSET sn [sz] = Add 'sz' sectornumbers starting from 'sn' to the Sectorlist LOADHELP fn [ds] = Load additiona help section from file, with description LOCK = Lock physical disk or logical partition to avoid conflicts LOG [file | .] = Start, stop or resume logging, (appending) to a file MAP [disknr opt] = Display graphical map of partitions on a disk MEDIA [options] = Display partitionable media (DFSee disk list), optional Update MENU [pd-letter] = Activate the menu, opening default or selected pulldown MENU2HTML [pd] = Generate HTML/PHP documentation for specified pull-down menu MODE [c,r] [-w-] = Set columns and rows for display, -w- is non-windowed MOVE -b|-e | -f = Move towards Begin or End, or move/copy to Freespace area PART [pid|drive] = Show partitions, or select one using nr or drive-letter PATCHKEY = Replace keyvalue in current sector by actual registration key PRITEMS x [name] = Set number of items/passes for the progress indicators PSN xx = Analyse & display sector xx, using physical sector number PT [*|pid|drive] = Display partition table for all, current or specified part PTE [xx | pid] = Show & edit partition table at sector [xx] or part [pid] QUERY item [n] = Query specified item value for disk/partition/freesp [n] RAW2IMZ raw imz = Create a compressed imagefile (IMZ) from a RAW image file REPEAT [command] = Repeat a (multi) command string, counted or forever ... RECOVER path sel = Recover files from Sectorlist to a path, using selection RESIZE [options] = RESIZE FS to a new SMALLER size, incl. Part-table update RESTORE file = Restore an imagefile to the currently selected object RUN [script] [p] = Run a DFSee script, with optional parameters and options S2CL lsn = Translate hex LSN to hex cluster number and display that SAVETO [d][l][n] = Save filedata for current file to new file, optional rename SCAN [sn [opt]] = Scan bad sectors starting at sn; use read/Write verify SCL clsize = Force cluster size to specified value (decimal, sectors) SCRFILE [fn] [l] = Save screen buffer to file [fn], last [l] lines SEARCH [phrase] = Search the text output window, highlight the search-result SERIAL [serial] = Set new Volume serial Number in the bootsector for a FS SET [prop value] = Set DFSee property to a value, 'SET' lists all properties SHIFTL [options] = Shift data inside sectors towards beginning (aka LEFT) SHIFTR [options] = Shift data inside sectors towards the end (aka RIGHT) SLEEP [seconds] = Sleep for specified number of seconds, default is 1 SLT [p [s]][opt] = Display Sector Lookup Table at index 'p', showing 's' lines SLT2LIST [opts] = Add (selected) sectors from the SLT to the Sectorlist SORT [-d] [-u] = Sort Sectorlist; [-d] = descending [-u] = no duplicates SPEED [-w] = Determine sector read or read/write speed for current object STORE [letter] = Select store to be the current store; or display stores SYNCLVM vol [dr] = Sync LVM engine to use [dr] letter for volume, or HIDE it t [sector type] = Display 'this' sector as Hex or specified sector type TRACE [lvl-opts] = Set trace level/options for DFSee functional tracing TRANS [-type] xx = Translate and display value 'xx' as Lsn, I13, CHS and PSN TXDIR fn [o] [a] = List files for wildcard selection 'fn' and several options UICC [fg] = UI color cube display, display an 88 or 256 color palette UICTEST = UI test, display Colors, Character-set, drawing-Characters UIKEYS [-u] = UI key/mouse test, (RAW) key-values and mouse coordinates u [sector type] = Display 'up' sector as Hex or specified sector type UNLOCK = Unlock physical disk or logical partition VDI [vdi] [opt] = Open VirtualBox Base/Snapshot diskimage for BROWSE/Analysis VER [-update] = Display a single line of version/builddate information VOL [drive] = Show all volumes, or select one using drive-letter WIPE [pat] [f s] = Wipe disk/vol/part area with pattern at LSN [f], size [s] WIPEFREE [part] = Wipe freespace in a filesystem to all zeroes (wipe -f) WIPELST [sel][p] = Wipe [sel]ected sectors in list with specified [p]attern WIPESECURE [-f] = Wipe disk/vol/part area in a SECURE way (DoD spec, slow!) WRITE [ . | sn ] = Write sector back to current or specified sector number x [sector type] = Display 'xtra' sector as Hex or specified sector type q = Quit DFSee OS2: 8.01 04-04-2006 (c) 1994-2006: Jan van Wijk _______________________________________________________________________________ #040 C O M M A N D R E F E R E N C E: _______________________________________________________________________________ SSN = Analyse & display sector, SSN is a Symbolic Sector Number, an mcs-number (see DFSTERMS.TXT) or one of the predefined: . = current sector d = down sector, depending on context (next, Ctrl-N) t = current sector (this, Ctrl-T) u = up sector, depending on context x = extra sector, depending on context Purpose: Display a sector in the most useful format Parameters: none Output: Sector display, format selected based on sector contents Remarks: The SN is specified as an mcs-number and can take many forms First digit needs to be 0..9 or a..f to avoid misinterpretation Prefixing the SN with '0' will avoid any conflicts. Examples: 3ec1 ;sector at 3ec1 (hex) 10 ;sector at 10 (hex) 0t10 ;sector at 10 decimal 150,c ;sector at cylinder 150 (decimal) 8,g ;sector at 8 GiB from start _______________________________________________________________________________ #050 Display item from Sectorlist .NNN [id] = Display numbered FS-entity marked .NNN from Sectorlist Purpose: Display one of the entries from the list last shown It can be applied on Directory as well as Allocation-lists The number (NNN) to use is displayed to the left of the list This is a decimal number with 1 to 5 digits. Parameters: NNN The zero-based decimal entry number to show id optional Identifier for LSN list (see list command) Output: Sector display, format selected based on sector contents _______________________________________________________________________________ #060 Show sector types ??? = Show all recognized sector types for current filesystem Purpose: Find out which sector types are known and supported in this mode Parameters: none Output: A list with generic sector types, followed by mode specific ones. DFSee generic sector types 'I' = File data 'H' = Unidentified data 'U' = DFSee compress 32 'h' = Hex format data 't' = Text format data 'T' = DFSee compress 16 'l' = LVM DLAT info sec 'L' = LVM BBR signature 'V' = LVM BBR V-deleted 'p' = LVM BBR drivelink 'P' = LVM BBR drv-table 'q' = LVM BBR badblocks 'Q' = LVM BBR bad-table 'C' = LUKS Crypt Header 'v' = CoreStorageHeader 'r' = Master Boot Rec 'e' = Extended Boot Rec 'b' = Fsys boot sector 'n' = Non-std Boot Rec '7' = FAT32 2nd BootSec '9' = FAT32 3rd BootSec 'G' = GPT header sector 'g' = GPT array sectors 'A' = MAC DDM, APM hdr 'a' = MAC DPM, part map '0' = ZERO 0x00 cleared '5' = Marked BADsec xFE '6' = FDISK xF6 cleared 'R' = Fsys reserved sec '+' = any known type '*' = any sector '~' = No contents shown '@' = Free space 'X' = Bad sector area '.' = End of Part/Disk! AUX specific sector types 'v' = VRAID phys device 'w' = VRAID devicetype1 'W' = VRAID devicetype2 EXT specific sector types 's' = EXT superblock 'S' = EXT boot+superblk 'd' = Directory block 'f' = File Inode 'D' = Directory Inode 'E' = Ext-Attrib block 'B' = BACKUP Superblock 'K' = Group Descr-Table 'c' = BACKUP GD-Table 'k' = GDT Reserved area 'M' = BlockAlloc Bitmap 'm' = InodeAlloc Bitmap 'i' = Inode Table '1' = BlockIndirectLvl1 '2' = BlockIndirectLvl2 '3' = BlockIndirectLvl3 'A' = AllocExtent Index 'a' = AllocExtent Leaf 'j' = Journaling File 'z' = ResizeInformation FAT specific sector types '1' = First FAT area '2' = Second FAT area '3' = Start 12-Bits FAT '4' = Start 16-Bits FAT '8' = Start 32-Bits FAT '\' = Root directory 'd' = Subdir, non-ROOT 's' = Subdir from ROOT 'D' = Directory data 'E' = EA data, attached 'A' = EA data. sf index HFS specific sector types 's' = HFS+ superblock 'B' = Boot(loader) file 'M' = Allocation Bitmap 'E' = Extents B-tree 'A' = Attributes B-tree 'C' = Catalog B-tree HPFS specific sector types 'E' = EA data 'A' = ACL data 'B' = HPFS Micro-FSD 's' = HPFS superblock 'p' = HPFS spareblock 'U' = Hotfix table 'u' = Hotfix data 'S' = Spare dirblocks 'x' = Bad Sectorlist 'f' = File Fnode 'D' = Directory Fnode 'y' = Deleted Dir Fnode 'z' = Deleted FileFnode 'a' = Allocation block 'Z' = Deleted All-block 'd' = Directory block 'P' = Dir-band (free) 'Q' = Dir-band bitmap 'c' = Codepage info 'C' = Codepage data 'i' = HPFS386 User-id 'm' = Bitmap Tables 'M' = Bitmap data JFS specific sector types 's' = JFS superblock 'f' = File Inode 'D' = Directory Inode 'y' = Deleted Dir Inode 'z' = Deleted FileInode 'g' = Aggregate Inode 'u' = Unused/BAD Inode 'a' = Data Btree+ Page 'd' = Dir Btree+ Page 'E' = EA data 'A' = ACL data 'G' = Pri Agg Inode Map 'm' = Sec Agg Inode Map 'i' = Sec Aggreg. Inode 'v' = Agg Inode map IAG 'w' = Fs1 Inode map IAG 'F' = Fileset Inode Map 'x' = Fileset Inode Ext 'S' = Pri Agg Inode Ext 'o' = Sec Agg Inode Ext 'M' = Block Alloc. Map 'C' = FSCK working area 'J' = Inline Log area 'B' = Micro-FS bootcode 'c' = Last-block slack NTFS specific sector types 's' = NTLDR, 1st sector 'f' = MFT regular File 'D' = MFT regular Dir 'm' = MFT 2ndary File 'M' = MFT 2ndary Dir 'y' = MFT deleted Dir 'z' = MFT deleted File 'd' = DIR filename INDX 'i' = SII security INDX 'S' = SDH security INDX 'j' = LOG restart Area 'J' = LOG record Page 'Z' = MFT Ghost record 'Y' = MFT empty record 'c' = Past last cluster REISER specific sector types 's' = RSR superblock XFS specific sector types 's' = XFS superblock SWAP specific sector types 's' = SWAP superblock _______________________________________________________________________________ #070 Enter Enter = down in hierarchy (Enter = down) Purpose: Display the next, most likely wanted, sector Parameters: none Output: Sector display, format selected based on sector contents _______________________________________________________________________________ #080 A|a x [size [S]] = ASCII dump sector, SN x, size sect/bytes; force [S]ector Purpose: Display current or specified sector in ASCII (text) format Parameters: x optional LSN of sector to dump size optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 512 bytes for the 'H' command and 256 bytes for the 'h' command S optional Force size parameter to be sectors Output: Sector contents displayed as plain ASCII text _______________________________________________________________________________ #090 ABOUT command ABOUT = Show version and registration information for DFSee/TPlib Purpose: Show details about the DFSee program like version and copyright Options: -c- Do NOT show the registration info, just copyrights -P- Do NOT present the info in a pop-up window -r Refresh cached information (like kernel revision :-) Output: Version information for DFSee, library, used 3rd party stuff and the Operating System that is currently running. _______________________________________________________________________________ #095 AL command AL [sn] [sz] [o] = Display/Write allocation status for sector/cl/block range Purpose: Manually display, set or reset allocation bits in the bitmap Parameters: sn optional location, sector or cluster/block number default is the current sector sz optional size, either in sectors or clusters/blocks default is 1 Options -w:0|1 optional write allocation: 0=free, 1=allocated\n", default is no-write (display only) and -w value default is 1 (allocated) -c optional location and size are clusters/blocks Output: One line with allocation status per sector/cl/block for display, or a dotted line with a single dot per sector/cl/block done for a write operation. Remarks: This is a potentially dangerous operation! _______________________________________________________________________________ #100 ALLOC command ALLOC [details] = Display allocation map in various size, show RESIZE limits Purpose: Show usage and the distribution of data over the volume. Parameters: details optional Vary detail shown, and size of the map @ Lowest detail exactly 1 line ~ Lowest detail 2 to 4 lines - Low detail 8 to 16 lines + Medium detail 32 to 64 lines * High detail 128 to 256 lines $ Extreme detail, 512 to 1024 lines spc size per character as an mcs-number, in sectors, KiB, MiB, or GiB -l:lines Map with specified number of lines When not specified, the amount of detail is calculated to result in a map about 1 screen page in size when possible. Output: A single graphic for the entire object, either a filesystem like FAT, HPFS, NTFS or JFS, or a whole disk. Each character in the display will represent a certain amount of diskspace, filled in according to the degree of usage. Remarks: Depending on the current filesystem, specific areas might be represented in the display. For FAT: Bootsector, both FATs and the Root directory are shown in the first display line using colors. The size of FAT/Root is proportional to their real size and the percentage of used entries in the root directory is shown at the end of the line The largest cluster number used is also shown at the end, this is useful to determine the minimum size on a resize (or truncate) For a DISK: The MBR/EBR and boot-sectors will be represenyted by a 'B' Unallocated areas (freespace between partitions) by an 'f' _______________________________________________________________________________ #110 BASE command BASE [options] = Show (and set) base start and end values in several ways Usage: BASE . | * | SSN [sl] or: BASE -a:start-pos [-s:size] [-logical] or: BASE -p:pid | -t:pid | -f:fid [-logical] Purpose: Set the start (LSN 0) and end position (largest LSN) to view. Parameters: . set base to current sector, to end of disk * keep base the same, but specify a different sl value SSN starting sector number for area to view or a symbolic-sector number (see DFSTERMS.TXT) sl ending sector number for area to view Options: -a:pos area position as mcs-number (see DFSTERMS.TXT) -f:fid set start to begin of the freespace area specified -logical align start-position for a logical partition -p:pid set start to bootsector of specified partition id -s:size area size as mcs-number -t set start to partition Table for current partition -t:pid set start to partition Table for specified part id PID and FID as listed in Part-table left-column Output: Display of current physical start and end values (after set) Examples: base 3ec1 ;base at sector 0x3ec1, to end disk base -f:2 ;freespace area 2, for a primary base -f:5 -log ;freespace area 5, for a logical base -a:122,c -s:200 ;area at cylinder 122, size 200 MiB Remarks: Can be used if the start of partition/P-tables are bad or if you want to view a freespace area on a disk (lost partition) These BASE values will normally be set automatically when you select a partition with the 'part' command. _______________________________________________________________________________ #120 BPS command BPS SectorSize = Force sector size to specified value (decimal, bytes) Purpose: Force a specific number of bytes per sector Parameters: seCSize mandatory Number of bytes per sector (decimal) Valid are: 512, 1024, 2048 and 4096 Output: none Remarks: Should be automatically correct, special purpose usage only The BPS value can be specified with the 'GEO' command as well, by using the '-bps:n' option _______________________________________________________________________________ #130 BSFIND command BSFIND [type][w] = Find MBR/EBR/boot/LVM-sectors, on Cyl/MiB/Both/ALL sectors Purpose: Find MBR, EBR or filesystem bootsectors on a disk Parameters type optional type of sectors to search, default is '*' '*' means all the relevant types: 'brelLs' w optional Which sectors to search for the types: A(ll) search ALL sectors, not just cyl. (slowest) C(yl) search on cylinder boundaries only (fastest)n" M(iB) search on 1-MiB boundaries only B(oth) search on cylinder and 1-MiB boundaries Options -f:pos Set start position to search FROM as mcs-number Useful to start searching from xx GiB on a disk Output: A single line with position and type information Remarks: This command is intended to collect info for 'unfdisk' type of recovery in the fastest way possible. When the 'a' option is not specified, it only inspects sector 1 on head 0 and 1 on each cylinder. This makes it DEPENDENT on the geometry currently being used on the disk. It is also very FAST! You could try using different geometries with the 'diskgeo' command if the actual geometry is uncertain. When another mode than "Mode=FDISK" is active, filesystem dependent structure may be included in the search if they have the 's' search-id. This is usually the case for any filesystem that has explicit superblocks like HPFS and JFS. Some FDISK specific structures may not be found in these modes However, MBR, EBR and Bootsectors are always included. Afterwards, a useful detailed list can be made with 'list -s' and 'list -b'. This is automated in DFSDISK.CMD/DFSDISK.BAT and the 'Actions -> DFSDISK, find partitions' menu item. Examples: bsfind ;search any sector on cylinder boundaries bsfind * all ;search any sector in any sector (SLOW!) bsfind b all ;search bootsectors in any sector (SLOW!) bsfind b ;search bootsectors on cyl. boundaries bsfind -f:22,g ;search bootsectors, start at 22 GiB _______________________________________________________________________________ #135 BROWSE command BROWSE [path |.] = Browse contents of one directory, using the Sectorlist Purpose: Browse (directory) contents in a filemanager-like dialog offering easy navigation through a directory tree, and execution of display or file-recovery operation on one or more files in the list. Parameters path optional Full path, from ROOT, for a directory to be read into the Sectorlist for browsing . optional Start browsing with the CURRENT Sectorlist, either to resume browsing after temporarily exiting the browser, or to browse through the results of a FILEFIND or DELFIND search. (to recover deleted files for example) Options -P = Force prompt dialog to specify starting path and optional initial filtering criteria -R = Start in recovery mode, show recoverability percentage -f:[string] = File selection filter string, in the form: w%t%m%M%S%d = '%' separated string with selection criteria: w = wildcard : wildcard selection on full path and filename string t = percentage : minimum file-allocation-OK percentage m = minsize : minimum filesize as MCS number like 1,s M = maxsize : maximum filesize as MCS number like 999,k S = filter type : D=Directories F=Files B=Browse-mode N=Normal (all) d = modifydate : Restrict to files modified AFTER date or #days-ago Default filter : '*%0%0%*%B%*' => any percentage/size/date, Browse mode -o:'options' = Options string, used with '~' for NTFS only -8.3 = Add '~' to opts (Prefer 8.3 names on NTFS filesystem) -debug = Show Inode, Parent and path+filename on Name-cache build Implemented for Unix-like FS (currently EXTn and JFS) -reset = Reset/rebuild Name-cache with Parent and path+filename Implemented for Unix-like FS (currently EXTn and JFS) -tree = Build Name-cache from root-directory tree (non damaged!) instead of a complete walk of all Inodes being found Implemented for Unix-like FS (currently EXTn and JFS) Output: Progress/status information when changing directories within the browse dialog, or when executing operations like (hex)Edit, or recover one or more files Remarks: More (and up-to-date) information on how to operate the browser dialog, including marking, sorting and various operations, can be obtained from the HELP window ( key). When starting a browse-dialog with the CURRENT sector-list, the list contents should be compatible with files/directories (aka 'list -f'). Examples: browse -P ;prompt for path, then browse (used from menu) browse \doc -f:*.txt ;start browsing with all *.txt file in \doc browse . ;start or resume browsing using CURRENT list _______________________________________________________________________________ #140 CC command CC [#lin [last]] = Clipboard Copy, copy lines from output window to clipboard Purpose: Copy text-lines from the output window to the (system) clipboard Parameters #lin Number of lines to copy last Last line to copy, counting from LAST output line Remarks The number of lines to be copied to the clipboard is limited to the number of lines actually present in the output window You can also copy text into the clipboard using the Alt+C or Ctrl-INSERT keys from DFSee entryfields, (menu) list items or the output-window (when it has focus, using the TAB key) Note: Ctrl-C is NOT used for the clipboard, but EXITS DFSee! You can enable Ctrl-C for the clipboard (for WINDOWS only) by specifying the '-sigint-' switch at startup For DOS, the clipboard is LOCAL, available within DFSee only while for other platforms it is the GLOBAL system clipboard Note that for Linux, you need to have the 'xclip' utility installed for clipboard copy and paste to work _______________________________________________________________________________ #140 CP command CP = Clipboard Paste, copy clipboard text to the output window Purpose: Copy text-lines from the clipboard to end of the output window Parameters none Remarks You can also paste text into the output window using the Alt+V or Ctrl-V keys whenever the output-window has focus (TAB key) And of course you can paste text into entryfields with the Alt-V or Ctrl-V keys as well. For DOS, the clipboard is LOCAL, available within DFSee only while for other platforms it is the GLOBAL system clipboard Note that for Linux, you need to have the 'xclip' utility installed for clipboard copy and paste to work _______________________________________________________________________________ #140 CV command CV [select][opt] = Copy selected value to the clipboard as a (Hex) string Purpose: Copy one from a few selected values to the clipboard as a string Parameters value One of a few selected values: b = Base PSN of first sector of current object s = Size Size of the current object in sectors d = Down LSN of next sector to be displayed t = This LSN of the CURRENT sector (default) u = Up LSN of the 'upward' related sector x = Xtra LSN of an otherwise related sector Options -d Copy as a decimal formatted string, not Hex Remarks The copied string could be used as a parameter value in a new command (use Alt-V on the command line after copying) For DOS, the clipboard is LOCAL, available within DFSee only while for other platforms it is the GLOBAL system clipboard Note that for Linux, you need to have the 'xclip' utility installed for clipboard copy and paste to work _______________________________________________________________________________ #150 CSLIST command CSLIST [-m][-s] = Put Cylinder/MiB aligned special Sectors into sector-list Purpose: Put all cylinder-aligned, or Cyl+1-MiB aligned sectors in list Parameters none Options -m Include sectors aligned to 1-MiB boundaries -s Include potential superblock locations for cylinder _______________________________________________________________________________ #155 CD command CD [path] = Change current Directory Purpose: Change both the current directory and the current drive Parameters: path optional Absolute or relative path specification Output: The resulting current drive and directory Remarks: '.' and '..' can be used in the relative path specification _______________________________________________________________________________ #157 CWD command CWD [drive] = Show current working directory, for specified driveletter Purpose: Display the current working directory, for specified drive Parameters: drive optional Driveletter for the drive to examine Output: The resulting current directory for the specified drive _______________________________________________________________________________ #160 CL command CL = Translate and display 'this' LSN as a cluster nr Purpose: Display cluster value for the CURRENT sector 'this' Parameters: none Output: cluster value Remarks: none _______________________________________________________________________________ Remarks: Instead of CL you can also use the alias BL for 'block CL clust [cmd] = Translate hex cluster number to hex LSN, then execute 'cmd' Purpose: Display sector for specified cluster in default or cmd format Parameters: clust mandatory Cluster value 2 .. max-cluster cmd optional Command to use for displaying the sector Output: Default display of the sector/cluster, or the output of 'cmd Example: cl 0x12345 id ;identify cluster 0x12345 using SLT Remarks: Instead of CL you can also use the alias BL for 'block _______________________________________________________________________________ #180 CL2S command CL2S clust = Translate cluster number to hex LSN, display LSN value Purpose: Display hexadecimal sector number for specified cluster number Parameters: clust mandatory cluster value 2 .. max-cluster Output: cluster and corresponding sector number (LSN) Remarks: none _______________________________________________________________________________ #190 CHECK command CHECK [dr/nr] = Report all detected filesystem errors using SLT info Purpose: Check filesystem integrity using SLT info (chkdsk function) Parameters: drive-letter or partition nr to check, default opened partition Options: -M optional Force creation of 'magic' recovery names to (unmounted) JFS filesystems. (JFS only) -r optional Force refresh of SLT information Output: Verbose list of all SLT entries that have an error flagged. This will include path+filename when available and textual explanation of the error(s) Errors reported by the 'CHECK' command for a specific filesystem are listed in the dfs[FS].txt files (i.e. DFSHPFS.TXT for HPFS) Generic error-codes with their description are: 0x000001 Linked to some structure, but not in allocation-map 0x000002 Allocated in allocation-map, but no known link 0x800000 The filesystem is DIRTY or MOUNTED (in use by OS), operations like resizing are NOT advisable now! The overall returncode for the command will be set to the number of errors found, to be used in further processing like scripting or perhaps a GUI frontend. Remarks: The reported errors are the same as listed with the SLT command. 'check' is an alias for "SLT 0 * -m -1- -d-" _______________________________________________________________________________ #200 CHS command CHS c h s = Analyse & display sector using CHS specification Purpose: Display sector using Cylinder, Head and Sector addressing Parameters: c mandatory The zero-based decimal Cylinder number Range 0 to disk-specific maximum and usually below 1024. h mandatory The zero-based decimal Head number Range 0 to disk-specific maximum but never more than 255 s mandatory The one-based decimal Sector number Range 1 to disk-specific maximum but never more than 63 Output: Sector display, format selected based on sector contents Remarks: Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) _______________________________________________________________________________ #210 CLONE command CLONE [options] = Copy sectors from other (disk/part/vol) to current store Purpose: Make an exact copy of (part) of another store to the current one, the stores representing disks, partitions or volumes. Parameters: at optional start sector 'to' store, default is 0 size optional size to clone in sectors Options: -a:mcs start sector 'to' store, default is 0 decimal MiB -b:sectors Number of sectors to buffer, the default is to use the current number of sectors per track (18 for diskettes, usually 63 for harddisks) The maximum is automatically limited to available buffer memory, and reduced to 1 on hitting bad sectors -d[:disk] disk number to clone FROM, 1 .. max -D[:disk] TO disk, disk number to clone TO, 1 .. max -E:i ignore errors, continue cloning on read errors -E:q quit on any read errors, exit (batch default) -E:c confirm by user on read errors (normal default) -f:mcs start sector 'from' store, default is 0 MiB -L exclude LVM signature area, clone FS-area only -M Do not write fixed 0xFE pattern on bad sectors in the source, but keep the possibly correct contents at the destination sector (merging). This option is set by default when the CLONE is initiated from the DFSee main menu. -name Update (LVM) diskname by postfixing '-YYMMDD' date -name:"-str" Update (LVM) diskname using specified postfix string -name:"str" Update the complete (LVM) diskname on a clone disk -p[:pid] partition to clone FROM, PID/driveletter -P[:pid] TO partition, partition to clone TO, PID/letter -R Reverse copy direction, from High to Low LSNs -s:mcs size to clone, default whole area in MiB -S Smart skip unused space in filesystem or disk -skipbads:n Skip 'n' sectors on each bad-sector area detected Implies -E:i = 'ignore errors' and -M = 'merge' -v[:vol] volume to clone FROM, driveletter -V[:vol] volume to clone TO, driveletter -! or -!- Force, or skip the generic CLONE dialog Output: Clone parameter details, confirmations and progress info Examples: clone -d:1 ;Clone disk-1 to current clone -p:C ;Clone partition C: to current clone -p -P ;Partition to partition clone, dialog clone -d:1 -D:2 ;Clone disk 1 to disk 2, no dialog Remarks: When using the menu system and dialog, select the type of FROM and TO object you want to clone between, the fill in the remaining paramaters and options in the dialog. When using the commandline (or a script) you either select a specific destination using one of the -P, -D or -V options, OR you MUST select the disk, partition or volume to clone TO (destination) BEFORE using the 'CLONE' command itself. You CAN NOT clone a partition to freespace, partitions are not created automatically by CLONE. You MUST do that manually. To make a copy of a partition in freespace (or move it there) use the 'MOVE' command instead, this integrates the CLONE and the required CR command in one. Related menu items are called 'Copy Part to freespace area' and 'Move Part to freespace area' The default error strategy (-E:) is 'quit' for batch mode and 'confirm' otherwise, unless overruled by the global switch -E: on DFSee startup To CLONE a physically damaged disk for recovery, the following options are recommended for maximum reliability: -E:i to continue cloning after read errors (incl retries) Note: DFSee will automatically retry a buffer that had any bad-sectors one sector at a time, so the DFSee sector-list will contain INDIVIDUAL bad sectors already, there is usually no need to clone a whole disk or partition with -b:1 A 2-step alternative for cloning a damaged disk more quickly is: 1) Set the 'Nr of sectors skipped on bad-areas' to a large value like 8000 HEX sectors (16 MiB, and uses -skipbads) (menu: Clone or Compare objects -> Disk, skip BAD-SECTORS) 2) When the (relatively FAST) first step resulted in bad-areas, evaluate and then run the generated 'Area-Retry' script that was generated to specifically re-clone just the bad areas with single-sector retry The above is often faster, since the first step may clone almost the entire disk, with some bad-areas skipped. You can evaluate the clone result, and only when needed, run the generated Area-Retry script to try and recover the maximum number of sectors from those skipped areas too (will be slow due to low-level retries) Note that unreadable sectors on the source will contain [512] 0xFE bytes on the destination disk; easy to recognize as invalid. This can be overruled by using the '-M' option (merge), which allows recovery of a partition with bad sectors by creating a same size FORMATTED empty destination partition and CLONING all readable sectors, skipping the bad ones. LINUX/EXT When cloning a BOOTABLE Linux EXT3/4 partition, or a whole disk ALERT! with such a partition, do NOT use the SMART option (-S) since that may fail to clone some hidden GRUB info required for booting. When cloning a whole disk, you could do the disk with SMART, then redo the cloning for that single bootable EXT without the SMART option WINDOWS When cloning a whole disk, containing a bootable Windows ALERT! do NOT boot with BOTH disks attached to the system until you have changed the unique NT-signature in the MBR sector of the cloned disk. (it is OK to boot with just the clone) Booting with identical disks may cause registry settings in the Windows partition to point to the WRONG physical disk, causing failure as soon as that disk is taken out of the system later. To avoid the problem use the DFSee menu item: Mode=FDISK -> MBR area fixes incl NEWMBR -> Update NT-signature in MBR ... select the clone ... _______________________________________________________________________________ #220 CMD command CMD [command] = Force execution of command by Operating System, not DFSee Purpose: Execute an external command, using the OS command processor Parameters: command optional The command to be executed by the OS It will be executed using a "system" call for the specified command with all output redirected back to DFSee. This uses a PIPE interface and an extra thread on OS/2, but a temporary file on DOS, Windows and Linux (requires write access to current directory) When no command is specified the default shell program as defined by the 'COMSPEC' environment variable will be executed. Return to DFSee is usually with the 'exit' command from such a shell, but that may differ between shell programs. Options -B optional Consider any command given as 'trusted' by suppressing the explicit check. Output: Any normal output (stdout, stderr) from the command will be redirected to the DFSee text output buffer in the standard colors used there by DFSee. Input requested by the program can be typed at the current cursor position, which is most often the DFSee command line but may be changed to any location by the program. This may cause some confusion :-) If the command is an interactive (text mode) application, it will most likely work correctly, temporarily taking the whole screen away from DFSee. Depending on the implementation however, either screen output or the entry of commands might be incorrect. Examples: cmd ;start the default COMSPEC shell cmd mode co80 ;execute a mode command externally ;(and not the built-in DFSee one) Remarks: In many cases it is NOT NEEDED to use the 'cmd' command since any command not recognized by DFSee will be executed as an external command anyway. However, when the external command or program has the same name as a DFSee command, you can explicitly execute it as 'external' this way. In all cases, the command to be executed externally are checked against a list of 'trusted' commands. When in the list the command is executed directly, otherwise you will get a confirmation pop-up to as if you really want to run this external command. This confirmation makes sure that no dangerous commands, perhaps the result of a typo, get executed without warning. _______________________________________________________________________________ #230 COMP command COMP [options] = Compare sectors from other (disk/part/vol) to current store Purpose: Compare the contents of (part) of another store to the current one, the stores representing disks, partitions or volumes. Parameters: at optional disk nr, default is current if open or 1 size optional size to compare in sectors Options: -a:sector start sector current store (default is 0) -b[:sectors] buffer size = 1 .. track size (default track size) -d:d disk number to compare to, 1 .. max -f:sn start sector 'other' store, default is the same value as 'at'", -l compare ALL, and add differences to the list -p:p partition to compare to, PID/driveletter -s:mcs size to compare as mcs-number (see DFSTERMS.TXT) -S Smart skip unused space in filesystem or disk -v:v volume to compare to, letter default is C: Note: Most of these options are exactly identical to the CLONE command, this makes it easy to use COMPARE after cloning. Output: Compare parameter details, confirmations and progress info Examples: comp -disk:1' ;compare disk-1 to current one comp -part:C' -l ;compare partition C: to current and ;record all differences in the Sectorlist Remarks: If no disk, part or vol is specified, the 'alternate' store is used as area to compare with (if possible). If the '-list' option is not specified, the compare will stop on the first sector that is different. The list is limited in size (currently to 409600, 200 MiB) so completely different stores will not have all sectors recorded. _______________________________________________________________________________ #240 CONFIRM command CONFIRM [-y] msg = Show a notification, or a confirmation message [-y] Purpose: Display a message, and ask confirmation Parameters: msg optional textual message including spaces. A new line can be started using the vertical bar: '|' Options: -y Use [Yes] [no] [Cancel] instead of [OK] Output: None when in windowed mode, message and response otherwise Remarks: In windowed mode the confirmation will be presented in the form of a dialog with buttons. When the dialog is completed with anything else than [OK] or [No], the return code will be set to nonzero. This can be useful in scripts to control further execution of commands. _______________________________________________________________________________ #250 CS command CS [sn] [-v:cs] = Calculate 32-bit checksum for sector, optional verification Purpose: Display, and optionally verify, the checksum value for a sector Parameters: sn optional Sectornumber to calculate the checksum for. When not specified, current sector 'this' Options: -m[:"msg"] Display msg (popup) when checksums do NOT match -v:cs verify the checksum against specified value Output: Display of sectornumber and calculated checksum Remarks: For a non-matching checksum, and -v specified, the returncode for the command is 'sector mismatch' with value 246. This can be used in scripts to verify sector contents: cs 0 -v:0x12345678 -m:"MBR checksum failure, wrong disk!" _______________________________________________________________________________ #260 DELSHOW command DELSHOW [sel] = Show delfind list, with selection wildcard and threshold Purpose: Display a list of (deleted) filenames from the Sectorlist Parameters: sel optional File selection parameters, in the form: wildcard%threshold (sometimes shown as [w%t] in usage) wildcard = wildcard selection for display/recover threshold = +nn = Minimum allocation OK percentage or -nn = Maximum allocation OK percentage default: *%-100 ==> all except 100% ones Parameters: w optional wildcard selection for display t optional +nn = Minimum allocation OK percentage -nn = Maximum allocation OK percentage Output: LSN list in fnode format (as "list -f *%1" command) Remarks: Default wildcard is '*', default percentage is 0 Minimum will list all values larger, maximum all values 'up to' Wildcards are real (UNIX style) wildcards using '*' and '?' Wildcards can appear at multiple places in the path string. Examples: delshow *%100 ;All files perfectly recoverable delshow *.ini%50 ;All *.ini files at least halfway OK delshow *%-100 ;All files not fully recoverable _______________________________________________________________________________ #270 DFSCHECK command DFSCHECK [part|*] = Run dfsXXXX analysis for one or all partitions => DFS*.P* Purpose: Run the dfsXXXX.dfs script for the specified partition(s). Collect information to aid in filesystem and other recovery situations. Output will be in DFSyXXXX.P* files Parameters: part optional Specific partition to run the analysis for Not specified or '*' means all partitions FSYS optional Explicit filesystem name (like FAT) when one specific partition is being checked Remarks This is a built-in alternative for the 'DFSCHECK' + 'DFSCPART' command files that are normally used for the same purpose. It is used from the menu-system as well, when selecting: Scripts -> DFSCHECK, check Filesystems -> ... Apart from running the DFS script 'dfsXXXX.dfs' this command will also create the logfile 'DFSyXXXX.Pnn' and two binary files which will not be created if you simply run that script. Used as a startup-command for DFSee as in 'dfsdos chkpart *' the command will quit DFSee automatically when finished. Output: Some progress info, real information in the analysis files: DFSCxxxx.Pnn verbose analysis information and logfile DFSCxxxx.Bnn single sector binary image of bootsector DFSCxxxx.Inn compressed small image of FS start area _______________________________________________________________________________ #280 DFSDISK command DFSDISK [disk|*] = Run DFSDISK (lost!) partition analysis for disks => dfsdiski.* Purpose: Run the DFSDPROC script for the specified disk(s) to ANALYSE disk partitioning, including a search for LOST partitions. Collect information to aid in UNFDISK and other recovery situations. Includes a backup of partitioning information and a generic overview. Output will be in DFSDISK?.* files Parameters: disk optional Specific disk to run the analysis for Not specified or '*' means all disks CYL optional Search cylinder boundaries only (default) ALL optional Search every sector (very slow) c | ? optional cylinder value for specific GEO to use '?' causes Cyl-value to be calculated Range: 1 .. 2^32-1 (or on OS/2: 65535) h optional heads value for specific GEO to use Range: 1 .. 255, typical 64, 240 or 255 s optional sectors value for specific GEO to use Range: 1 .. 255, typical 32, 63, or 255 Options: -b:basename Base filename for resulting files, when not specified, this will be 'DFSDISKo' This basename may include a PATH as well to direct the files to a different drive or directory. -s:fs Filesystem for which SUPERBLOCKS will be included in the search, or all/none FDISK = NO filesystem superblocks, just partitioning ANY = ANY type of FS superblock supported (default) APFS = Only macOS APFS native filesystem EXT = Only Linux EXT2, EXT3 or EXT4 HFS = Only macOS HFS+ native filesystem HPFS = Only OS/2 or ArcaOS/eCS HPFS[386] JFS = Only OS/2 or ArcaOS/eCS Journaled FS NTFS = Only Windows NT/XP/Vista/7/8/10 REISER = Only Linux ReiserFS XFS = Only Linux XFS filesystem Remarks This is the built-in command for the 'DFSDISK' command/batch or script files that can be used for the same purpose. It can be selected from the menu-system as well, using: Scripts -> Full Analyse disks (support) -> ... Apart from running the analysis script 'dfsdproc.dfs' it will also create the logfiles 'dfsdisk?.sk*' which will not be created if you would simply run that script. Used as a startup-command for DFSee as in 'dfsdos dfsdisk *' the command will quit DFSee automatically when finished. Typical disk geometries H and S values being used: H:255 S:255 (32 MiB cyl) OS/2 and eComStation, disks > 1 TB H:255 S:127 (16 MiB cyl) OS/2 and eComStation, disks > 500 GB H:255 S:63 (7.8 MiB cyl) On many desktop (3.5") style disks H:240 S:63 (7.3 MiB cyl) On many laptop (2.5") style disks H:64 S:32 (1.0 MiB cyl) On 'advanced format' disks (4KB sectors) and often on SSD disks. The 64/32 geometry with 1 MiB cylinder size has been used as standard geometry on Windows starting with Vista, improving performance with modern disk hardware. Output: Some progress info, real information in the DFSDISKI.* files _______________________________________________________________________________ #285 DFSFAST command DFSFAST [disk|*] = Run DFSFAST existing partition analysis on disks => dfsfast?.* Purpose: Run the DFSDFAST script for the specified disk(s), to ANALYSE the existing partitioning scheme (NO search for lost partitions) Collect information to aid in (re)partitioning and supply minimal needed information for DFSee support.Includes a backup of partitioning information and a generic overview. Output will be in DFSFAST?.* files Parameters: disk optional Specific disk to run the analysis for Not specified or '*' means all disks Options: -b:basename Base filename for resulting files, when not specified, this will be 'DFSDISKo' This basename may include a PATH as well to direct the files to a different drive or directory. Remarks This is a much FASTER alternative for the 'DFSDISK' command command that can/should be used if all partitioning is still intact, so there are no 'lost partitions' to be recovered. It can be selected from the menu-system as well, using: Scripts -> Fast Analyse disks (support) -> ... Apart from running the analysis script 'dfsdfast.dfs' it will also create the logfiles 'dfsfast?.sk*' which will not be created if you would simply run that script. Output: Some progress info, real information in the DFSFAST?.* files _______________________________________________________________________________ #290 DIRFIND command DIRFIND [l][dir] = Put [l] levels of filenames from [dir] in the Sectorlist Purpose: Find normal files (not deleted) in a directory and optionally it's subdirectories up to the number of levels specified. Parameters: l optional number of directory levels to include in the list, or 's' for all levels dir optional directory specification, starting from the root directory Options: -l:wildcard Automatically list the found files, limiting the output to files matching the specified wildcard string. Without a wildcard, the "-l" option will list all the found files. -t:type Type of items to find, default is ALL D or d = Directories only F or f = Files Output: Sectorlist in memory to be used in following operations Remarks: List can be manipulated as usual, best viewed with "list -f" To copy (a selection of) the found files to a different disk or partition, use the "recover" command. For HPFS filesystems, the names used will be significant in the first 15 characters only, the rest of the name will be replaced by hyphens ('-'). This is needed because the FNODE only stores the first 15 characters of the name. The list option "-l:*test*" equals a "list -f *test*" command. Examples: dirfind s \os2 ;Put \os2 tree in the list dirfind 1 \os2 -l:*.add ;Show all .ADD files in \os2 dirfind s \ -l:*.dll ;Show all .DLL files _______________________________________________________________________________ #300 DISK command DISK [disk] = Select a disk (partitionable medium) and show the MBR Purpose: Select a physical, RAW-imagefile or virtual disk Parameters: disk optional disk nr, default is current if open or 1 Options: -f:'fsname' Set mode to filesystem 'fsname' on large-floppy -F Force use of First EXT-container (reread too) -g Show disk geometry too (reread too) -std Industry std letter assignment (reread too) -L[:0|1|2] Show preferred: none (0), LVM (1), Windows (2) -m Identify MBR, and show I13 limit (reread too) -q Quiet, select only, no display -r Refresh partition tables from disk (reread) and RESET previously forced geometry -R open the disk in Read-only mode -R- force the disk in Read-write mode Output: Disk Geometry and default display of sector 0 (usually MBR) Remarks: The dfs_number variable for REXX will be set to number of disks See also: WALK command _______________________________________________________________________________ #310 DISPLAY command DISPLAY = Show current display size in rows and columns Purpose: Display current display size, most likely after changing that Parameters none _______________________________________________________________________________ #320 EDIT command, string replacement EDIT [-a -h -u] = String replacement edit, using Ascii, Hex or Unicode string Purpose: Make any kind of modifications to sector contents At least one of the options 'a', 'h', 'u', 'm' or 'P' must be present, or the HEX sector editor will be started instead! (as described in the next section) Parameters pos optional Decimal or Hex offset, start of edit-area str optional A string to be placed at the specified position in the current sector. The syntax for this string is exactly the same as for the find ('f') command. So ASCII and binary specifications are possible. Note on quoting: The outermost set of quotes, which can be either single or double-quotes, will be stripped off by the parameter parsing logic before it is passed to the 'find' command. You CAN use that same quote character again in the parameter using the 'escape' character '\' Example: "The \" is a double-quote" Options: -a:'asc' ASCII replacement value, string -B Batch mode, do not prompt when values given -h:'hex' HEX replacement value, sequence of hex pairs -u:'uni' UNICODE replacement value, string -p:pos edit position, decimal or hexadecimal (0x...)", -P Prompt, allowing editing of the specified value with one of the -a, -h, -u or -m options -w- Do NOT write the sector back to disk directly Examples: edit 0x1be -h:'00' This will set the byte at offset 0x1be to the value 0x00, without any further prompting. (quotes are mandatory!) edit 126 -h:'00' -P This sets the byte at offset 126 (decimal) to the value 0x00, but will allow editing of the hexadecimal value(s) to use. edit -p:0x30 -h:'3e 54' This will replace 2 bytes at position 30 and 31 hexa-decimal, to the values 0x3e and 0x54 respectively. edit -p:27 -a:Test This will replace 4 bytes at position 27 decimal, to "Test" edit 3f -u:test This will replace 8 bytes at position 3f with Unicode "test" without prompting edit -h -P This will prompt for a position and a value in hexadecimal ... Output: Hex-dump BEFORE and AFTER for the changed sector area Remarks: The edit command will prompt you to write the data back, unless you use the '-w-' option. Then, after multiple edits perhaps, write back the data explicitly using the 'write' command. The 'show' command can be used to view the sector before writing back or making more changes. It is similar to the 'H' and 'h' command, but it does not read from the disk, it just displays the current sector buffer contents. Specifying a 'pos' parameter or the '-p' option are mutually exclusive. Using the '-p' option will cause the specified value to be used as a default in a prompt dialog. Specifying the 'str' parameter is mutually exclusive with using any of the '-a', '-h' or '-u' options. _______________________________________________________________________________ #330 EDIT command, HEX sector editor EDIT [options] = Start HEX sector-editor on current sector or (binary) file Purpose: Interactively make any kind of modifications to sector contents in the current object (including files), needed if no specific FIX commands for the data in question are available. Parameters: SSN optional Symbolic sector number (see DFSTERMS.TXT). This includes MCS-style values like '3,c' The default numberbase is hexadecimal! fname optional Name of a file to be edited binary (HEX/ASCII) wildc optional Wildcard file select in FileDialog (-dir only) Options: -A Allow append-to and delete-from (binary) file (default) -A- No append-to or delete-from (binary) file, size is fixed Options: -B Batch mode while editing, the main effect will be that the write-confirmation popup is skipped and all changes are written back unconditionally. -d Start in disassembly mode, maximized window -dir[:path] Select file from FileDialog, start in 'path' directory -e:entry Directory entry number for FAT DIR sector 0 .. 15 Useful only if the current sector (this) is a FAT directory sector, with 16 entries of 32 bytes each This entry will be MARKED in the hex editor window When the current sector was selected from the sector list (using a .NNN command) there will be an implicit default value that equals the correct entry number (so no need to specify the -e: option at all then) -F:ssn Symbolic sector number to start the edit session. -m:bytes Size in bytes for initial marked area (Alt-B/L/U/F) -M:position Start position of initial marked area in hex editor -p:pos edit position, decimal or hexadecimal (0x...)", Determines de location of the cursor in the item when the HEX edit window is started -r:rows Number of rows in edit dialog (default screen -5) -s:size Item size for HEX editor in sectors, the default is the current cluster-size or 1, depending on context -screen Start HEX-edit window maximized, full-screen", Examples: edit Start the HEX editor starting at the CURRENT sector (this) edit 10 Start the HEX editor at logical sector 0x10 edit -p:0x30 -s:4 Edit at the current sectornumber (this) with an initial cursor position of 0x30 and an itemsize of 4 sectors (2KB) edit -F:23,c Edit starting at Cylinder 23 (decimal, Cyl:23 H:0 S:1) This could be used to edit an EBR at that cylinder, perhaps to update the partitiontable ... edit 0 -M:0x1be -m:64 -p:0x1c2 Edit the MBR sector and highlight the partitiontable bytes in there by marking them. Put the current cursor position on the TYPE byte in the first table entry. edit -dir:\data *.bin -screen Present filedialog of all .bin files in directory '\data' and after selection, start the HEX-editor in full-screen Output: One line with the starting sector-number, then one more line for every sector when it is modified, and finally the sectornumber when leaving the editor, if different ... Remarks: Each time you navigate 'out' of a sector/item with changes, you will be prompted with a write-back confirmation that includes the sectornumber and number of changed bytes. You can use the key to cycle through the available views, currently: HEX, ASCII and DISASSEMBLY For further help and usage of the sector editor, use the context sensitive help once in the HEX editor. _______________________________________________________________________________ #340 EXPAND command EXPAND [options] = EXPAND FS to a new LARGER size, incl. Part-table update TRUNC Usage: EXPAND size | -size:new | -s Purpose: Make a filesystem in a partition on a disk larger, usually to use some freespace that is available after it on the disk. Parameters size optional Specifies new filesystem/partition size Without a specified size, the user will be prompted for the desired new size. Options: -F Force resize even if larger than indicated maximum size. Can be useful if allocation information is not correct. -s Expand to maximum possible size -size:new New expanded size as mcs-number Output: Progress, calculated new sizes and partition end position, plus a confirmation message when not working in batch mode. Finally a success or failure message. Examples: expand 1500 ;Expand to new size of 1500 MiB expand -s:5000 ;Expand to 5000 MiB expand -s ;Expand to maximum size, using ALL freespace expand ;Prompt for new size, then expand ... Remarks: The mcs-number format is [0x]nnnn[,m|c|s] with a HEX or decimal value, in MiB, Cylinders or Sectors. Default decimal MiB. The EXPAND command is implemented as a generic command, but requires a filesystem dependent part to be implemented. Currently that is only available for FAT, FAT32, HPFS and NTFS FAT(32) partitions can not be expanded by DFSee normally, the exception is when the partition has been resized to a smaller size with DFSee before. This restriction might be lifted in a future version of DFSee. An easy rollback (UNDO) can be achieved by saving all partition information first (using PSAVE) before the actual EXPAND. After a PRESTORE, the EXPAND will be rolled back and the partition is back to its original size. The EXPAND command is implemented as a combination of a DELETE, CREATE and RESIZE command with the options as required by the expand operation. _______________________________________________________________________________ #350 EXPORT command EXPORT [fn][opt] = Export Sectorlist, to LSN file and optional data file Purpose: Save an LSN-list in a file for modification or later use Parameters: fn Destination filename for the LSN-file Options: -d Write data, using fname for the sector data and derive data extension from fname extension Note: default extension for data file is .bin default extension for LSN file is .lsn Output: Progress information Remarks: The LSN file has one LSN per line, editable with a text editor. The data file holds the contents of each sector (512 bytes) as indicated by the LSNs in the list, and in the same order. (This is the same format as required by IMPORT) Note that this seperate DATA file is hardly ever needed, it is used by DFSee itself in its DFSDISK procedure to be able to import partition/boot/lvm sectors into a virtual disk for further analysis _______________________________________________________________________________ #360 FDISK command FDISK [Command] = Select FDISK mode, pass (optional) command to execute Purpose: Make FDISK the active analysis mode and command set Parameters: command optional Specific FDISK command (try FDISK ??) When no command is specified, the default is a 'part' command that will show all partitions on all disks. Options -r- Do NOT read the partition tables again, just display them ... Output: none, or output for the specified command. Remarks: When the 'batch' mode is forced using the '-b' program switch, and a command is specified, DFSee will do an automatic quit after completing the command. This is useful to execute a series of FDISK commands from a batch- or command file. _______________________________________________________________________________ #370 FI command FI [SSN] = File information on specified symbolic-SN, default 'this' Purpose: Display compact one line of infomation about the specified sector, when possible in the form of path+filename info. Parameters: SSN optional Symbolic sector number (see DFSTERMS.TXT). Options: -e:entry Directory entry number for FAT DIR sector 0 .. 15 Useful only if the current sector (this) is a FAT directory sector, with 16 entries of 32 bytes each When the current sector was selected from the sector list (using a .NNN command) there will be an implicit default value that equals the correct entry number (so no need to specify the -e: option at all then) Output: One line of information on the sector number, path+filename when available or CHS+PSN translations when not. Remarks: This is the same format as used with the 'list -f' command. _______________________________________________________________________________ #380 FIND command FIND str = Find a string using specified options and sector types Purpose: Perform a sector search starting from the current LSN until a sector of the specified type and optionally (not) containing a specified ASCII/HEX string is found. Parameters: str optional The string to search for (usually in quotes). A string of bytes (ascii/unicode/hex)that have to be present in the wanted sector. When the '$' string option is not given, it can be specified as a mix of ASCII, UNICODE and HEX. The starting mode is ASCII, switching to HEX and back is done with the ' character. Switching to UNICODE and back with " Leading white space is skipped, in HEX mode spaces can be used to improve readability. For case-insensitive UNICODE only search, use the '$/' options, specify the search string in plain ASCII. (see -a, -h and -u options too!) Note on quoting: The outermost set of quotes, which can be either single or double-quotes, will be stripped off by the parameter parsing logic before it is passed to the 'find' command. You CAN use that same quote character again in the parameter using the 'escape' character '\' Example: "The \" is a double-quote" Example 1: "last'0d0a'first" This will search for the word "last" followed by a carriage-return line-feed combination and the word first Example 2: "'e9bd13 0d4023 49 42 4d 3a38 2e'" This will search for a byte sequence, in this case the start of COMMAND.COM Options: -a:'asc' ASCII find-pattern value, string -A:'asc' 2nd 'AND' ASCII find-pattern value, string -f:pos Set start position to search FROM as mcs-number Useful to start searching from another position than the current one (THIS). The value specified is the offset to the START of the current object Default unit in the mcs-number is 's' (sectors). -h:'hex' HEX find-pattern value, sequence of hex pairs -H:'hex' 2nd 'AND' HEX find-pattern value, hex pairs -i:step Number of sectors to STEP to get to the NEXT. Default is 1 so every sector will be searched. Larger values can speed up the search considerably but of course SKIP sectors then. Useful if the wanted sectors are on EVEN sectors (step=2) or when 'probing' a huge disk for certain type of sectors like FNODE/MFT-records (step=1000 or so) This option is ignored when the '~' find-Opt is used to search on cylinder aligned sectors only. -m:'mix' Mixed ASCII/HEX/UNICODE find-pattern -M:'mix' 2nd 'AND' Mixed ASCII/HEX/UNICODE find-pattern -o:find-Opts Search and display options, default is '+' F = Find directory entries for FAT types 'D' or 'd' Fd = Find directory entries for deleted files only Fe = Find normal files by extension, not full name Ff = Entries for normal (not deleted) files only FD = Entries for normal DIRECTORIES only Fx = Find deleted or renamed file/dir entries on EFAT M = Multiple hits within one sector are possible Q = Quiet search, NO display of found sectors (fast) S = Search restricted SPACE only (DIR sectors for FS) s or 1 = Single find, display sector when found * = Repeat find, building a list (find all ...) % = No sector spanning, => fast text search [ = Freespace only => fast undelete ] = Allocated space only => fast file-grep ! = Just list found, faster and better log-format + = Verbose output even when repeating - = Backward search, towards lower sector numbers ~ = Search on sector 1 head 0/1 only, bootsectors $ = Use a case-insensitive string compare / = Assume UNICODE strings, can be combined with '$' ^ = Inverted search, find sectors NOT containing ... @[pos] = Compare at sector position [pos] only (with type dependant defaults for [pos]) -n[:offs] Start searching from NEXT/PREV sector, or from a specified offset in the current sector. Might be needed when searching again for the same pattern, to avoid finding the same one again :-) -P Prompt, allowing editing of the specified value with one of the 'ahmu' or 'AHMU' options. -t:types Types of sector wanted, default is any KNOWN. Specify multiple types in a single string For an up-to-date list, use the '???' command -u:'uni' UNICODE find-pattern value, string -U:'uni' 2nd 'AND' UNICODE find-pattern value, string Output: Sector display, format selected based on sector contents, or a single line with position and type info when repeating Remarks: When a search 'str' is specified, the default option is "1" resulting in a 'single search' and display of a found sector. Otherwise a repeated search for the specified type(s) will be performed and each sector will be listed. Specifying the 'str' parameter is mutually exclusive with using any of the '-a', '-h', '-u' or '-m' options. When these options are specified their value is used directly, or as the default in a prompt dialog. The '-A', '-H', '-U' or '-M' options specify a 2nd argument that must be present in the same sector, to make a match. (logical AND function, find xxx AND yyy) When any of the 'ahum' or 'AHUM' options is specified without a value, the user will be prompted for one. The find command is often called by other commands to implement the actual required search (like "delfind" and "bsfind") Starting with version 7.00, you can also start a FIND dialog from the menu (Edit -> Find sector data) or the Ctrl-F key. _______________________________________________________________________________ #385 FINDSPACE command FINDSPACE = Show filefind/delfind find-SPACE (DIR/MFT/FNODES/INODES)", Purpose: Display the sectors represented in the 'find SPACE' that can be used to restrict filefind/delfind to just the relevant areas of the filesystem when searching (huge speed improvement). Parameters: none Output: Display of the findSPACE structure, with starting sector and size for each of the included areas Remarks: Depending on the filesystem, and the its contents, using the findSPACE (default on delfind/filefind) speeds up searching by a factor of at least 100. _______________________________________________________________________________ #390 FIXBOOT command FIXBOOT [opts] = Fix a filesystem bootsector, FAT(32), HPFS, NTFS, JFS Purpose: Fix corrupted bootsector for one of the supported filesystems Parameters: depend on the specific filesystem, see corresponding DFSxxx.TXT Output: Progress and confirmation info Remarks: The FIXBOOT command is implemented with the filesystem specific code for each of the filesystems, and is documented there. It is available from the corresponding 'Mode=xxx' menu too. _______________________________________________________________________________ #400 FIXPBR command FIXPBR [options] = Fix HiddenSectors and Geometry bootsector to match p-table Purpose: Make bootsector value for 'hidden sectors' consistent with the corresponding offset value in the partition table, and the geometry Head/Sectors fields match the current disk-geometry. Parameters: none Options: -g Update the geometry head/sector values (default) -g- Do NOT update the geometry head and sector values -h Update the hidden sectors value (default) -h- Do NOT update the bootsector hidden sectors value Output: progress information and confirmation Remarks: A consistent value is required on operating systems like OS/2 and eComStation to allow a filesystem to be mounted correctly The value can become inconsistent when a partition is relocated from one primary location to another, or between primary and logical locations. This could happen with CLONING, or restoring an imagefile. The 'FIXHS' command is a deprecated form of this command that only fixes the hidden-sectors value, but is still supported for backward compatibility with older scripts. _______________________________________________________________________________ #410 FS command FS fs-name = Force analysis using specified filesystem knowledge Purpose: Use specific FS knowledge if the default is not correct Parameters: fs-name Filesystem name, like FAT, NTFS or HPFS Output: none Remarks: For some filesystems it is possible to force a specific mode of analysis using the fs-name, implemented are: FAT12 force a 12-bit FAT analysis FAT16 force a 16-bit FAT analysis FAT32 force a 32-bit FAT analysis _______________________________________________________________________________ #420 GB command GB [distance] = Go backwards 'distance'; an mcs-number, default is 1 sector GF [distance] = Go forward 'distance'; an mcs-number, default is 1 sector Purpose: Move backward or forward by specified distance, usually sectors and display the sector found there in its default format Parameters: distance The distance to move from the current sector (this) as an mcs-number, so sectors, KiB etc can be specified in either hex or decimal format. Default is hex sectors Output: Display of the sector at specified distance, in a default format Remarks: The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. Examples: gb 5 ;go back 5 sectors gf 3,c ;go forward 3 cylinders gf 100,k ;go forward 100 KiB gf ;go forward 1 sector _______________________________________________________________________________ #430 GEO command GEO ?|c h s f b = Set/Display specified geometry on opened object, ?=adjust Purpose: Show current or force different geometry to be used for interpreting and analysing the current physical disk Parameters: none Display the geometry currently in use, including possible overrides by previous 'diskgeo' commands c h s Overrule current geometry by the values specified for cylinders, heads and sectors. Not specifying a value, or specifying 0, will cause that particular value to stay unchanged in the GEO The value '?' can be specified for the cylinder value and will cause a recalculation for the cylinder count based on heads/sectors and the size of the disk at the time it was first selected. f optional first-sector or 'base' value to use with this. The base is the offset to LSN-0, usually the bootsector b optional number of bytes per sector Options: -b:nnn Number of bytes per sector to be used with the geometry Valid values are: 512, 1024, 2048 and 4096 -d:nr optional disk number, to be selected first, most useful in combination with the dialog -S Synchronize system-geometry (S-Geo) with new GEO too -! present a disk-geometry display and set dialog, with custom and several often used geometries to be set. Output: The resulting geometry for the physical disk currently open Remarks: You can keep the current value for one of the items by specifying zero (0), a '.' or nothing for the override Examples: diskgeo 0 255 ;set the number of heads to 255 diskgeo ? . 32 ;set the number of sectors to 32 and ;calculate the right number of cylinders ;for that geometry and disksize _______________________________________________________________________________ #435 GREP command GREP [phrase] = Search the text output window, present results in a list Purpose: Search for one or more words in the text output window, and present the search results in a list allowing easy toggle between the results and the actual search-hit, in context. Parameters: phrase A phrase of one or more words to search for Output: A selection list with on search-result per line, where the key toggles between the list and the text output window to view the search hit in context. Remarks: When no parameter is given, you will be presented with the standard 'search' dialog, with the 'grep' box checked. _______________________________________________________________________________ #440 H command H|h SSN [size [S]] = Hex-dump sector, SN x, size sect/bytes; force [S]ector Purpose: Display current or specified sector in hex-dump format Parameters: SSN optional LSN of sector to dump size optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 512 bytes for the 'H' command and 256 bytes for the 'h' command S optional Force size parameter to be sectors Options -4 Output 32-bit intel-reversed HEX values, in C or C++ syntax like: '0x12345678, 0x87654321, // xV4.!Ce. Output: Hex-dump of the sector, for the normal output that is On every line 16 bytes of data will be displayed, each line containing: - the relative offset in the record (4 hex digits) - 16 bytes in hexadecimal; separator after 8 bytes - the same 16 bytes represented as ASCII And for the Intel-reversed 32-bit values: - 16 bytes in 4 ULONG values; leading '0x' trailing comma - the same 16 bytes represented as ASCII Remarks: The ASCII representation is filtered, and non-printable characters are represented with a PERIOD character _______________________________________________________________________________ #445 HELP command HELP phrase f|i|s = Search in HELP information (aka GREP) or list sections/items Purpose: Give various help overviews, and search the builtin help system Usage: HELP [search-phrase | f | i | s] Parameters: phrase : Phrase of one or more words to search for in all help-texts builtin or loaded from external files and build a search-result list to select from. f : Present generic find dialog to search help texts i : Present list if help-items in (menu) help section s : Present list of builtin and loaded help sections Output: None, apart from find-popup or selection list window. Remarks: To show help on valid commands and sector types on the DFSee commandline, use the ?, ?? and ??? commands. Additional HELP sections can be loaded from the HELP main menu or from the DFSee commandline using the LOADHELP command. _______________________________________________________________________________ #450 ID command ID [ SSN | -L ] = Identify 'this', specified SSN or LAST sector, using SLT Purpose: Display the type for a specific sector and one major reference Parameters: SSN optional Symbolic sector number (see DFSTERMS.TXT) Default is the current sector Options: -L Use LSN of LAST used sector in FS (minimum for RESIZE) -l- Do NOT overwrite original Sectorlist with new results when a directory gets displayed Output: One line specifying corresponding SLT entry, followed by a line specifying the type of the sector itself and a sector display of the 'reference' sector, in a format based on sector contents Remarks: This function is extremely useful to relate file-data sectors from fragmented files to the Fnode for a particular file. It will tell you exactly which file a certain sector belongs to. For best output, the sector lookup table (SLT) should be made available by the 'SLT' or 'CHECK' command. _______________________________________________________________________________ #460 IM command IM [file] [opt] = Open a file with FS-image (.img/.imz) for display & analysis Purpose: Work with a saved binary/RAW or compressed/IMZ image Parameters: file optional Path or filename for the image, the default extension is '.imz'. When the file parameter, ends in a '\', the imagefiles will be listed in a file-open dialog for that directory. When not specified, a file-open dialog will be presented where a file can be selected Options -A Allow appending to a 'RAW' on write (default) -A- Do NOT allow appending to a 'RAW' on write -e:'ext' Overrule default 'imz' extension with 'ext' -f Initialise for detected Mode=xxx filesystem (default) -f- Do NOT initialise for any Mode=xxx filesystem -fs:'fs' Initialise for specified filesystem 'fs' -R Open in Read-only mode, no writes (default) -R- Do NOT open in Read-only mode, allow writes -RAW Force open in RAW mode, even for IMZ/VDI etc Output: The default display for the first sector of the image Remarks: Filesystem type is derived from first (boot) sector, and some types of imagefiles, like the DFSee .IMZ and VirtualBox .VDI are automatically uncompressed/indexed (unless -RAW is used) _______________________________________________________________________________ #470 IMAGE command IMAGE file [opt] = Save an object to imagefile(s) using specified options Purpose: Save specified sectors as a binary RAW/compressed image Parameters: file Filename for the image, default extension is '.img' When prefixed with [lpt.exe], the data is actually written to named pipe \pipe\xxx.img to LPT.EXE which will be started in a separate session automatically This allows saving the image on a different PC that is attached using a parallel (laplink) cable. f First sector number to be saved, or: . or 'this' = current sector 'this' .NNN = value from Sectorlist default: 0 s Size to save, in sectors, or: . or 'this' = up to current sector 'this' $ or 'all' or 'end' = up to end of current volume/disk .NNN = up to value from Sectorlist default: $ default saves whole area Note: Parameters 'f' and 's' are intended for backward compatibility mainly, using the options '-F' and '-s' respectively is recommended. Options: -A Append to imagefile if it already exists -b:sectors Number of sectors to buffer, the default is to use the current number of sectors per track (18 for diskettes, usually 63 for harddisks) The maximum is automatically limited to the available buffer memory. -b:1 Precise mode, 1 sector at a time, this is up to 20 times slower than optimal, but will result in the minimum number of bad sectors ending up as 'garbage' in the resulting image Note: DFSee will automatically retry a buffer that had any bad-sectors one sector at a time, so the DFSee sector-list will contain INDIVIDUAL bad sectors already, there is usually no need to image a whole disk or partition with -b:1 -D[:disk] Disk number to make an image FROM, 1..max disk -E:i Ignore errors, continue saving on read errors -E:q Quit on any read errors, exit (batch default) -E:c Confirm with user on read errors (normal default) -F:n First sector as mcs-number, default 0 -I[:"image"] Filename to make an image FROM, img filename -L Exclude LVM signature area from image (LVM/JFS) -m[:mcs-size] Maximum size of file(s) as mcs-number, using multiple files. Often used with compression. The size is unlimited when not specified at all. (but maybe limited by media or FS limits :-) -M Prompt the user to change the removable Medium for the next (size limited) file to be created -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. -p- Does not count as a progress-item (see PRITEMS) -P[:pid] Partition nr to make an image FROM, PID or letter -q Quiet, display minimal details, progress mostly -R Raw format, no headers even when compressing -R- Non-raw format, add DFSee info headers -s:n Size to be saved as mcs-number, default ALL -S Smart imaging mode (optimizing for size) Set unused sectors to ZERO in the image, or for a compressed image, use a run-length encoding, greatly reducing the size of compressed images for areas with a lot of unallocated space. DFSee compressed images with -S can be orders of magnitudes smaller than a simple ZIPPED raw image (even with zeroed sectors) and as a bonus, will restore much quicker too. Note: May not work RELIABLY on Linux (EXT4) filesystems that have a BOOTABLE GRUB installed. It seems that GRUB stores some info outside the regular filesystem which gets lost in the process. So avoid 'SMART' imaginmg and cloning with those. -v Verify of imagefile integrity, displays details on every handled block of data (63 sectors) like length, compression and CRC-32 when available. -V[:vol] Volume letter to make an image FROM, driveletter Note: When a volume corresponds to a partition, using the -P option is STRONGLY recommended! -x Create an INDEX file for compressed images too, this will speed-up opening it later for BROWSE -z Enable LZW compression on the image-file, this implies Non-raw format using DFSee info headers -6 Do NOT use CRC32 checks or advanced compression This will make the created images compatible with 6.xx and older versions of DFSee. -! Force option dialog to be used, even when sufficient parameters are specified. In this case, only the file name and the -m option is passed to the dialog, other options are ignored and need to be set in the dialog itself. Output: Progress information Remarks: When '.' is specified for s, sector 'f' up to 'this' is saved When '.' is specified for f, the start-sector is 'this' When '.' is specified for both, only the 'this' sector is saved The 'f' parameter is mutually exclusive with the -F option and the 's' parameter with the -s option. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. The default error strategy (-E:) is 'quit' for batch mode and 'confirm' otherwise, unless overruled by the global switch -E: on DFSee startup When using compression, the number of sectors (-b:xx) used for buffering MUST be the same in the IMAGE and RESTORE commands and it should be less than or equal to the number of sectors per track, or the RESTORE will fail! Smart imaging, with the '-S' option is ONLY SUPPORTED for the filesystems where the allocation information fully understood by DFSee. Currently that are FAT/FAT32/EFAT, HPFS, JFS, HFS, NTFS, EXT2/3/4, SWAP and ReiserFS. But note the disclaimer for EXT4 with a BOOTABLE GRUB above, with the -S option. When using the '-S' option, it is advised to use a buffer size not much larger than the track size (typically 63 sectors) to increase the chance on the buffer being completely unused so it can be skipped on the imaging action. For Windows-NT with NTFS and OS/2 versions with a kernel 4.50 or newer with JFS, the files CAN exceed 2GiB (large file support). This means you could write an image from a 9GiB partition to a large JFS partition for example. When imaging acros a network connection, the limits vary and may go undetected depending on the network protocols used. As an example, saving an image to a SAMBA share connected to a Reiser-filesystem on Linux results in a 4 GiB limit, but there will be NO warning when exceeding it. To avoid problems you can use the '-m' option to limit the size of (multiple) generated files to just below 2GiB. Note that unreadable sectors on the source will result in sectors with a 0xFE byte pattern in the image. This is easy to recognize as invalid. To create an image directly from the OS commandline, using the image dialog window, use a command like: DFSOS2 -w image -P:1 #confirm Press a key to exit ...#q And to run it in text-mode, no windowing, no dialog: DFSOS2 [-b] image -z -P:3 part3img#q The optional '-b' suppresses the confirmation, for batch use. The SIM command is an alias for IMAGE (deprecated) _______________________________________________________________________________ #475 IMZ command IMZ [imz] [opt] = Start BROWSE session on selected IMZ compressed image file Purpose: Access a filesystem contained in a compressed image Parameters: imz optional Path or filename for the image, the default extension is '.imz'. When the imz parameter, ends in a '\', the imagefiles will be listed in a file-open dialog for that directory. When not specified, a file-open dialog will be presented where a file can be selected Options -e:'ext' Overrule default 'imz' extension with 'ext' Output: * For an image with a FILESYSTEM (partition, volume), present a filemanager like display for the ROOT directory * For an image with a complete PARTITIONED DISK, present a list of all partitions (not just this image!) and after selection one partition, starts a BROWSE session for the contained filesystem, if any. Remarks: Using BROWSE, you can selectively COPY files from a compressed image, making these a good alternative for other backup solutions. _______________________________________________________________________________ #480 IMZ2RAW command IMZ2RAW imz raw = Create uncompressed (RAW) image from an IMZ compressed one Purpose: Recreate the original uncompressed image from a small backup Parameters: imz Filename for the compressed IMZ inputfile raw Filename for the uncompressed RAW outputfile Options: -! Use dialog to check or specify more options Output: Progress information Remarks: This is a wrapper/front-end function for the RESTORE command, making it easy to recreate an uncompressed image from an IMZ. The output filename will default to the same path and name as the input, with a default file extension .IMG The IMZ imagefile can be a 'multiple files' one, and will be assembled into a single RAW imagefile. _______________________________________________________________________________ #490 IMZINFO command IMZINFO imz = Display information from an (IMZ compressed) imagefile Purpose: Show available information in an IMZ image file header Parameters: imz Filename for the compressed IMZ inputfile Output: Information about the contents of the (compressed) imagefile Example output for a test file: ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ³ ³ IMZ info for 'testimz.imz': ³ ³ ³ ³ DFSeeImageFile #0001 on 2019-12-14 20:25:58 ³ ³ DFSee OS/2 ; version 16.6 2019-12-14 (c) 1994-2019: Jan van Wijk ³ ³ Store A : Whole Memory disk 1 FDISK size: 200.0 GiB ³ ³ Disk 1 : name = Mem D1 200.0 GiB ³ ³ Base at : 0x00 Size:0x19000000 Offs:0x018c18000 Sect:0x05a0 ³ ³ Reg This is a permanent key for 16.x, it will not expire. ³ ³ Expanded: 737.280 bytes, or 1440 = 0x05a0 sectors ³ ³ ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Remarks: For an uncompressed (IMG) file there wil be just the filesize and number of files, when it is a multi-file image. _______________________________________________________________________________ #500 IMPORT command IMPORT [fn][opt] = Import LSNs to the Sectorlist and optional data to disk Parameters: fn Source filename for the LSN-file with sector numbers OR a (log) file with more verbose information that includes these sectornumbers Options: -d:dname Read data, using dname for the sector data -d Read data, using fname for the sector data Note: default extension for data file is .bin default extension for LSN file is .lsn Output: Progress information Remarks: The LSN file must be an ASCII file with one LSN per line. It can be the result of an export, derived from a log-file or created completely by hand. The verbose format resulting from a "list -v", "list -f" or a "delshow" command is also valid. (use "log" cmd to capture) This is often more convenient than bare LSN lists because the verbose format contains info like path/filename so it is easier to select specific files for recovery with that. The data file must have at least as many sectors (512 byte) as there are LSNs in the LSN file, and they must be in the same order as those LSNs. Each sector will be written to the currently opened store, at the corresponding sector number. (This is the format as used by the EXPORT command) Note that this seperate DATA file is hardly ever needed, it is used by DFSee itself in its DFSDISK procedure to be able to import partition/boot/lvm sectors into a virtual disk for further analysis. It is NOT needed when exporting and importing sectornumber lists for filerecovery. _______________________________________________________________________________ #505 LABEL command LABEL [label] = Display/edit the volume label in the bootsector Purpose: Set a volume label in the bootsector, for most filesystems and to an alternate location when needed for the active FS Parameters: label optional New volume label, usually with a maximum of 11 characters, longer on some FS's Default value is the current volume label -l optional Update the 16-character length Linux style label instead of the 11-character one. (currently implemented for JFS only) Options -!- Skip input dialog for a new value Output: Progress information Remarks: The volume label for most PC-style operating systems is a field in the bootsector, used to identify this volume in directory listings and other filesystem commands On some, like JFS or FAT(32) it may ALSO be present in an alternate location like the superblock or Root-directory, and DFSee will update both when changing the label value. On others, like NTFS and EXTn, there is NO label in the bootsector, but it resides ONLY in the alternate location which is updated by DFSee when changing the label value. The length may NOT be restricted to 11-characters in that case, and that is reflected in the edit-window for it. The NTFS label in the $Volume MFT record is 32 characters On Linux-style filesystems like EXTn and JFS, the label (sometimes called Volume-Name) is a 16-character string. Since JFS has both the 11-character and the 16-character label string, you need to specify the '-l' option on the command to indicate you want to update the Linux variant. _______________________________________________________________________________ #510 LIST command LIST [opt] [str] = Display LSNs in the Sectorlist, using options/string Purpose: Display the sector number list in a selected format Parameters str optional wildcard selection or command to execute For the '-f' option it is a selection string with criteria separated by '%' characters, in the following syntax/order: w%t%m%M%S%d = File selection filter string, containing: w = wildcard : wildcard selection on full path and filename string t = percentage : minimum file-allocation-OK percentage m = minsize : minimum filesize as MCS number like 1,s M = maxsize : maximum filesize as MCS number like 999,k S = filter type : D=Directories F=Files B=Browse-mode N=Normal (all) d = modifydate : Restrict to files modified AFTER date or #days-ago Default filter : '*%0%0%*%N%*' => any percentage/size, Normal, any date For the '-c' option, it is the command to be executed for each sectornumber in the list (but options are discarded). Only '-v', '-v-', '-t' or '-t-' options will be passed on. The options are mutually exclusive, except for the -f:option values that may be combined as in -f:i8.3 Only the 1st char of an option value is significant. Options: -b = Verbose bootsec, for BSFIND/UNFDISK analysis -C = FAT only, display location as CLUSTER, not sector Combine with '-e' for EA or '-I' for EA-RelativeClust -c = Execute a command for each LSN, plus 1 line contents -d- = Suppress contents display (with '-c' option) -d = Display sector contents, default format -d:hex = Sector contents, default + hex dump -e = FAT only, display EA-data location, not regular data -f = Verbose PATH info when available (is default) -f:i = Verbose PATH, indirect using SLT information -f:8.3 = Verbose PATH, use short 8.3 name (NTFS only) -g = Show lsn -> psn -> CHS logical geometry -g:system = Show lsn -> psn -> CHS system geometry -I = FAT only, show decimal EA-index value as location -lfn- = FAT only, show short instead of long filenames with -f -l- = Do NOT create new list when displaying directory information. This allows displaying a list of found directories, like resulting from the SUBFIND command. The -l- option is FORCED when using the '-d' option. (this option is also added to the cmd given with -c) -n = No contents list, just show number of entries -r = Show as a cluster/block (badsect) Range, incl. size -s = Show size-offset in MiB, type from list, CHS and PSN -t = Show size-offset in MiB, type from data, CHS and PSN -t or -t- = TEST options passed trough to a cmd given with -c -v = Use verbose output, one line per LSN -v or -v- = VERBOSE options passed trough to a cmd given with -c -w = Show in Wide format, 6 LSNs and INFO on each line -X = Only display files that have EA-data attached Output: List of sector numbers in compact, verbose or special format For the formats with just a SINGLE line of output for every value in the list, there will be an underlined header-line explaining the different pieces of information in the line. For large lists, this will be repeated at the end. Remarks: List also available for REXX in the dfs_sn. stem variable Lists can be imported and exported to files, see import/export When using the '-c' option, the '-f' option can be added to get an additional line of path+filename info preceding the actual command output. The '-f:i' option is only useful when the SLT information is collected (using the SLT or CHECK command). It will list PATH info for file-data. It is most useful AFTER using the '-f' option, since that will list PATHS for the file Fnode sectors. Together, all file PATHS for Fnodes and file-data are shown. The column format for the '-f' format is approximately: .Index = Value : T Pct Location Size Path Index Index in the Sectorlist range 0 .. max Value Hexadecimal value on that index in the list T Type of the sector when known (f = file) Pct Percentage recoverability, approximation Location Location of associated data, sector or cluster Size Size of the file, rounded UP to sector boundary Path Name of the file, including PATH when known For FAT filesystems only, the location may contain the index in the extended-attribute file "EA DATA . SF" with option '-I' or relative cluster nr in "EA DATA . SF" with options '-I -C' or the location of EA-data for the file as LSN, with '-e', or that location as a cluster number with the options: '-e -C' _______________________________________________________________________________ #512 LISTSET command LISTSET sn [sz] = Add 'sz' sectornumbers starting from 'sn' to the Sectorlist Purpose: Add a SN or range of SN's to the LSN memory list for later use Parameters: sn optional First SN to add to the list, special values are: X, U, D, T for Xtra, Up, Down (default is This) sz optional Number of entries to fill with increasing sn's default is 0 when no sn given, 1 otherwise Options: -c[:n] Clear/truncate the list to [n] sn entries, before adding Output: none Remarks: The Sectorlist contents can be listed using the 'list' command with one of the options: -f ;lists path+filename for metadata (Inode/MFT etc) -f:i ;lists path+filename for actual file data -w ;just lists the sectornumbers, 6 per line -r ;lists contents as ranges of sectors or cl/blocks Truncating the list to a specific size, without adding anything can be done using the -c:n option WITHOUT specifying a 'sn' _______________________________________________________________________________ #515 LOADHELP command LOADHELP fn [ds] = Load additiona help section from file, with description Purpose: Load additional (text) file with DFSee help items from a file Usage: LOADHELP fname [descr] Parameters: fname Filename for helpfile, path and extension optional\n" descr Optional description for this new help section Output: Message when helpfile is successfully loaded. _______________________________________________________________________________ #520 LOCK command LOCK [ign] = Lock physical disk, to allow writing to it Purpose: Lock a physical disk Parameters: ign optional Ignore lock failure, do not prompt interactively for write permission Output: none _______________________________________________________________________________ #530 LOG command LOG [file | .] = Start, stop or resume logging, (appending) to a file Purpose: Close current LOG, open new and capture DFS output in it Parameters: File specification, or '.' for last used logfile name If no parameter is specified, logging is stopped. The LAST '^' or '@' character in the 'file' name (and extension) is replaced by a 3-digit number, starting with 001, incrementing (can be combined with the ~1 .. ~9 datetime fragments below) A single '~' character before a delimitter like (-_.=+) or at the END of the name, is replaced by the current date in ISO format 'YYYYMMDD' The name may contain multiple date/time format strings, substitued as: ~0 ISO standard date (YYYYMMDD) ~1 Day 2 digits (DD) ~2 Month 2 digits (MM) ~3 Year 4 digits (YYYY) ~4 Hour 2 digits (HH) ~5 Minute 2 digits (MM) ~6 Second 2 digits (SS) ~7 Full name of current weekday ~8 Full name of current month ~9 2 digits ISO 8601 weeknumber Options: -7- Do NOT strip output to 7-bit ASCII, allow use of 'graphic' box characters in the logfile. Default is 7-bit ASCII only. -r Close and reopen log on each line (slow) -r- Open log just once (this is the default) Output: Concatenated output of DFS commands given after the 'log' command, up to next 'log' or 'q' command. ANSI control characters for colors and cursor positioning are not written to the logfile. Remarks: After logging has been stopped using a 'log' command, it can be resumed to the same file using 'log .' There is no check on available space on the destination drive, file may end up empty if disk(ette) is full. The same logfile specification can be used more than once, output will be concatenated. On each 'log' command the current logfile will be closed. Special characters such as the 'box' characters with the 8th bit set, will be translated to 7-bit ASCII unless the '-7-' option is given AND the global switch '-7' is not used. Reopening the log on each line can be useful if you have problems with a crashing program or computer, causing the logfile to be only partially written to disk. NEVER change diskettes or other removable media while DFSee is still logging to the same medium! This may make the medium inaccessible (until formatted again). The initial prompt for a logfile at startup (dfswork) can be suppressed by using the '-l-' or '-l:filename' startup switch: _______________________________________________________________________________ #540 MAP command MAP [disknr opt] = Display graphical map of partitions on a disk Purpose: Give an easy to interpret visual image of the disk layout Parameters: disknr optional number of disk to display, default is all '.' is current disk only opt optional options, '+' is more verbose, '-' is less Options: -? or ? Show usage information for MAP command -d Display for current disk only -d:disknr Display for specified disknr only -F Force use of First EXT-container (implies -r) -g Show disk geometry too (implies -r) -i Industry std letter assignment (implies -r) -L[:0|1|2] Show preferred: none (0), LVM (1), Windows (2) -m Identify MBR, and show I13 limit (implies -g) -M Display a partitionable Media map too -r Refresh partition tables from disk (reread) Output: Some lines of drawing-characters and text representing the disk with its partitions. The partitions are sized according to their real size. Freespace is also shown the same way. The color of the areas indicate the filesystem-type. Each area contains the most relevant textual info as well. Example output: ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ºÉÍÍ»ÉÍÍÍÍ»ÉÍÍÍ»ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͺ ³³ ³ ºº ºº ºº ºÚÄÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄÄ¿ÚÄÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄÄ¿ÚÄÄÄ¿ÚÄÄÄÄ¿º ³³ ³mºº1 ºº2 ºº3 º³4 ³³5 ³³6 ³³7 ³³8 ³³9 ³³10 ³³11 ³³12 ³º13 ³³ ³bºº ºº ººP: º³L: ³³M: ³³K: ³³D: ³³N: ³³E: ³³H: ³³V: ³³ ³º ³³ ³rººBMººNTFSººHPFº³HPFS³³HPF³³HPF³³HPFS³³HPFS³³FAT³³HPFS³³JFS³³NTFS³ºFreeSpace³³ ³ ºº ºº ºº ºÀÄÄÄÄÙÀÄÄÄÙÀÄÄÄÙÀÄÄÄÄÙÀÄÄÄÄÙÀÄÄÄÙÀÄÄÄÄÙÀÄÄÄÙÀÄÄÄÄÙº ³³ ³ ºÈÍͼÈÍÍÍͼÈÍÍͼÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͺ ³³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Remarks: Loosely modelled after the Partition-Magic display _______________________________________________________________________________ #550 MEDIA command MEDIA [options] = Display partitionable media (DFSee disk list), optional Update Purpose: Display list of partionable media, also called the DFSee disk list with an optional update of the list before showing (re-scan) Parameters: none Options: -update Detach all, re-scan physical disks and attach them -d:count Only attach the first 'count' physical disks -d- Don't attach any, same as '-d:0', empty disk list -v Verbose, include a 'map' display of updated list Output: A list of all physical and virtual/image disks currently attached with addition disk-identification info from the OS when available and an optional MAP of each disk in a compact layout Remarks: Linux implementation uses the 'hdparm -i devicename' command and a GREP filter to supplu the OS info, works mainly for IDE/SATA disks and may fail on some systems, in which case the 'Model' name for the disk is retrieved from the '/sys/block/DEV/device/model' file where DEV is the bare device name like 'sda' On Windows, the information is retrieved from the Registry: HKLM->System\\CurrentControlSet\\Services\\Disk\\Enum The 'DeviceInstanceID' found there is slightly formatted for better readability, specifically to show the Vendor, Product and Revision strings for USB devises. Other platforms, OS disk-identification not implemented yet. _______________________________________________________________________________ #560 MENU command MENU [pd] = Activate the menu, opening default or selected pulldown Purpose: Activate the menu-system, with the specified pulldown opened Parameters: letter optional First letter of the menu pulldown f = File e = Edit m = Mode=xxx a = Actions i = Image d = Display h = Help Output: none _______________________________________________________________________________ #570 MENU2HTML command MENU2HTML [pd] = Generate HTML/PHP documentation for specified pull-down menu Purpose: Create up-to-date descriptions with help-texts and links to separately created screen-shots for the specified pulldown. Parameters: letter optional First letter of the menu pulldown f = File e = Edit m = Mode=xxx a = Actions d = Display h = Help Options -h : Generate static HTML instead of PHP -f:filename : Filename for generated HTML or PHP -m:leadtext : Chapter lead-text or number\n", c0); Output: none Remarks: The default filename will be constructed from the pulldown and prefix, as an example: dfsmenu-expert-file.php Reference tags for each documented item will be generated to allow easy references to a specific item on a website. The tags are based on the menu-item/help id, shown in the help popup window when a menu-item is highlighted in DFSee Example reference for menu item 3110: .../dfsmenu-expert-file.php#id03110 For the PHP version, screenshots will be dynamically embedded if the corresponding .GIF files exist in the ...shots and ...shots/thumbs subdirectories at runtime. For HTML, they must exist at the time the MENU2HTML cmd is being executed. For the example above that could be: ../dfsmenu-expert-shots/id03110-1.gif ../dfsmenu-expert-shots/id03110-2.gif etc (upto -19.gif) and ../dfsmenu-expert-shots/thumbs/id03110.gif _______________________________________________________________________________ #580 MODE command MODE [c,r] [-w-] = Set columns and rows for display, -w- is non-windowed Purpose: Change display size, and switch between windowed - classic Parameters: c optional Number of columns (screen width) 10 .. 102 r optional Number of rows (screen length) 1 .. 102 Options -w Use windowed mode (this is the default) -w- Use non-windowed, classic mode Output: none Remarks: The column and row may be specified as "col,row" as well The maximum column and row values might be limited more than specified here, depending on Operating System capabilities. Most often rows * columns must be 8192 or less. _______________________________________________________________________________ #590 MOVE command MOVE -b|-e | -f = Move towards Begin or End, or move/copy to Freespace area Purpose: Move partition towards begin/end of the disk within freespace or Move/Copy the partition to another selected freespace area Usage: MOVE -b[:offset] | -e[:offset [-f:fsp-id [-c [-l:x]]] [-a | -A-]-] Parameters: none Options: -a : Align resulting partition start to a cylinder boundary -A- : Do NOT align KiB and MiB values to track/cyl multiples -b : Move to exact begin of freespace area BEFORE partition -b:mcs-nr : Move towards begin freespace, offset from current pos. -c : Copy, not Move, do NOT delete original. (requires -f) -C- : Do NOT copy the contents of the partition, just Ptable -e : Move to exact end of freespace area AFTER the partition -e:* : Move to exact end of freespace area specified with -f -e -f:[id] : Move to exact begin of freespace area selected with -f -e:mcs-nr : Move towards end fsp, offset from current (or start -f) -f:fsp-id : Move/Copy to fsp-area on same/other disk (implies -e) -l:letter : Set preferred driveletter for new volume (requires -c) -P : Prompt for offset value to be used, in MiB or Cylinders The mcs-number format is [0x]nnnn[,g|m|k|c|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders or Sectors. Default is decimal MiB. Output: Calculated begin and end position of the CURRENT partition before and after the MOVE (old and new position). Then, after a final confirmation has been presented, the progress information for the involved DELETE, CLONE and CR commands will be shown. Examples: move -b:100 ;Move partition 100 MiB towards begin disk move -b ;Move partition all the way to begin fsp move -e ;Move partition all the way to end of fsp move -f:3 ;Move partition to begin of fsp-area 3 move -e:0 -a ;Move towards end, forcing Cyl. alignment move -e:10,k -a- ;Move 10 KiB towards the end, NO alignment move -f:2 -e:1,c ;Move to fsp-area 2, 1 cylinder from start move -f:5 -c ;Copy to fsp-area 5, keeping original too. move -f:7 -c -l:y ;Copy to fsp 7, use LVM-letter Q: on copy. Remarks: Moving a partition within a freespace area (-b or -e) allows the current and new location of the partition to overlap. This means it is OK to move a partition over a short distance like a single cylinder to make room for something else. In all cases you will have to let the operating system that wants to USE the moved/copied partition rediscover them. The safest way to do that is a BOOT of that operating system. When moving or copying a partition that is SEEN by the OS that is running DFSee, AVOID accessing the partition after the MOVE! Most MOVE operations are implemented using the commands: CLONE ;copy partition data to new location DELETE ;delete partition from Part-tables CR ;recreate partition in new location There will only be a very short period between the DELETE an the CR recreate, so data loss is unlikely. However, a MOVE to begin freespace (-b) with OVERLAP uses: DELETE ;delete partition from Part-tables CLONE ;copy partition data to new location CR ;recreate partition in new location This implies that there is NO partition definition in the partition tables while the data copying is taking place! Aborting the long running 'CLONE' with the key, or a power failure will therefore result in the partition being DELETED, and its data most likely lost. You will get an additional CONFIRMATION to warn you about this when appropriate. LVM information on MOVE operations is FULLY preserved and adjusted to the new physical location. Also any COPY of a single partition LVM-volume (move -c) will have complete and unique LVM-information, with names and IDs derived from the old ones and made unique using the new freespace-ID. WARNING: MOVE/COPY on a multiple partition LVM-volume is NOT SUPPORTED! Doing this will result in an inaccessible volume that will only be recoverable using LVM and DFSee if you know exactly what you are doing! After a MOVE, the partitions are intact but marked as 'available'. For recovery see below. After a COPY, the volumes/partitions will be cross linked, which is quite hard to recover from. The MOVE/COPY menu-items in the Actions menu will be disabled when such a partition is selected. This limitation may be removed in future versions of DFSee ... If you HAVE MOVED one or more partitions from such a volume the recovery for it would be roughly: 1) Recreate the volume using LVM.EXE and "from existing" Make sure you use the partitions in the original order. 2) In DFSee, select the FIRST partition (erased bootsector) and issue a "fs jfs" plus a "fixboot" command. 3) From the OS2 command line, issue a "CHKDSK x: /f" where x: is the driveletter of the JFS volume. Displayed driveletters after a COPY (move -c) for an LVM system might be incorrect for the new partition since the bootsectors are exactly the same. This will clear up if you change the LABEL of that partition (using the operating systems 'label' command). The alignment options -a and -A- should not be needed in normal cases, where the partitions are aligned already. They are required only if you want to: - move over a non-aligned distance in KiB/MiB (-A-) - move a non-aligned partition to an aligned position (-a ) _______________________________________________________________________________ #600 PART command PART [pid|d:|.] = Show partitions, or select one using pid or drive-letter Purpose: Select a disk partition for analysis or show a list of them Parameters: pid optional Absolute partition ID (PID) for the partition to select, as shown by a 'part' overview pid,r optional Relative partition ID, for specified or current disk, "1,r" is the first partition on that disk Note: ',r' is to be taken LITTERAL! To specify a specific disk use an aditional '-d:nr' option. d: optional Drive-letter for a partition (part C:) . optional Reselect the current partition if any, otherwise auto use the 'auto' PID as set by a CR or CLOSE command Options: -? or ? Show usage information for PART command -2 Check consistency 1st versus 2nd FAT (default) -2- Suppress checking of 2nd FAT consistency (FAT only) -a Show allocation map for partition on open / listing -a- Don't show allocation map for partition (default) -b UNIX-style table, values in blocks (UNIX default) -b- PC-style table, with label info (regular default) -c Perform a filesystem-check on each partition -C[:'str'] Compact space or 'str' separated partition list -d Display or select for current disk only -d:disknr Display or select for specified disknr only -e To add info on extended partitions to table -e:1 Info on 1st extended partition only (container) -F Force use of First EXT-container -f- Do NOT display any freespace lines -fs:'fsname' Set mode to filesystem 'fsname' on selected partition -file:[name] XML name, default XXXdisks.rdf, -file- is STDOUT -g Show disk geometry too (implies -r) -i Industry std letter assignment (implies -r) -L[:0|1|2] Show preferred: none (0), LVM (1), Windows (2) -label:XXX XML identifying string, default 'dfs' or 'ecs' -m Identify MBR, and show I13 limit (implies -g) -n To get a table with all numerical information -p- Do NOT display the actual partition lines -q Quiet, display minimal partition details -R Select the partition in Read-only mode -r Re-read partition tables from disk (refresh) -s To get a (comma) separated list of partitions -s[:'str'] Verbose comma or 'str' separated partition list requires 218 character wide display to show all -S Use double-Spaced lines with -s or -C formats -t or -t- Display partition table, or do NOT display it -u Add UUID 16-character string when supported by FS -v To get a multiple line verbose list (incl LVM) -V Verbose, including some partition contents -w or -w- Include ALL warnings or do NOT display any -w:selection Filter warnings using selection letters -w:0xMMMMMMMM Filter warnings using Hex mask (see below) -x[:'fs1 fs2'] Request the extra (resize) information 'fs' restricts to FS like 'NTFS FAT32' only in the 'part -s' and 'part -xml' formats. -xml Partition info in XML format to a file or STDOUT Output: Either the list of partitions in the specified format, or the verbose partition display for the selected partition. Remarks: The return code (rc) will be zero for a valid partition id or the number of partitions otherwise (useful in REXX scripts). To select a relative partition on a specified disk, use the 'pid,r' syntax combined with a '-d:disk-nr' option, example: part 3,r -d:2 ;select 3rd partition on disk 2 The 'Vol' column might show discrepancies between the actual driveletter as currently seen/used by the operating system, and some other administration like LVM-info or the Windows DosDevice mapping. This indicated by the ':' being replaced by the lowercase PREFERRED driveletter. Some examples: >C: ;active C:, actual same as preferred LVM/Windows D: ;D: drive, actual same as preferred LVM/Windows Eh ;E: drive as actual, H: as preferred LVM/Windows -e ;NO drive as actual, E: as preferred LVM/Windows E- ;bootsector same as actual E:, but NO LVM letter or a preferred windows driveletter 'Eh' as shown by DFSee would show as "H->E:" by LVM.EXE The -L option controls what 'preferred' driveletters are used -L:0 (or -L-) Means NO preferred driveletters (actuals only) -L:1 Means to check LVM-preferred driveletters -L:2 Means to check Windows DosDevice letters (-L:2 only available in DFSWIN.EXE) For DFSWIN.EXE, the default is "-L:2" otherwise it is "-L:1" The maximum number of partitions handled by DFSee is 1000, on a maximum of 24 different physical disks. Some useful filter values to be used with the "-w:" option are: a or 0x0000ec00 Show cylinder alignment warnings b or 0x00070000 Show IBM BootManager related warnings c or 0x000000f0 Show CHS related warnings only f or 0x00000008 Show not formatted warnings only i or 0x00000006 Show INT13 limit related warnings only m or 0x0007ea3f Show all minor warnings M or 0xfff815c0 Show all Major warnings s or 0x03f00000 Show size overlap related warnings t or 0x00076001 Show non-trivial minor warnings x or 0x04000000 Show extended-container type 0x0f warnings * or 0xffffffff Show ALL warnings Hex values can be combined (added) for more complex selections An LVM type volume with multiple partitions (disk spanning, JFS) will be selected correctly, every partition belonging to the set will be searched until the one with a valid bootsector has been found. (only THAT partition will be usable from DFSee) To show the table with ALL info completely visible, the screen size should have a certain minimum width (columns): PART 114 columns when showing LVM-style labels PART -s 218 columns standard CSV formatted output PART -s -x 253 columns extended CSV formatted output Examples: An example of the list output in table form (default) is: DFSee OS/2 8.09 : Executing: part -r -m Number of disks : 4 P-Geo Disk 1 Cyl : 16383 H: 16 S:63 Bps:512 Size : 0x0950F8B0 = 76319.1 MiB L-Geo Disk 1 Cyl : 10337 H:240 S:63 Bps:512 Size : 0x0950E110 = 76316.1 MiB BIOS Int13 limit : 1024 cylinders, limiting to Size : 7560.0 MiB MBR crc c51e1623 : 0x7ea9d168 = IBM OS/2 LVM, 14.105 May 2006 .. (disk 2 and 3 are like 4 :-) P-Geo Disk 4 Cyl : 0 H: 0 S:0 Bps:512 Size : 0x00000000 = 0.0 KiB L-Geo Disk 4 Cyl : 512 H: 12 S:32 Bps:512 Size : 0x00030000 = 96.0 MiB Error, disk 4 PD4 : reading the MBR info in the 1st sector failed! DUMMY, disk 4 seems reserved with no media present (USB/PCCARD etc) ÚÄÄÄÂÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÂÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄ¿ ³ID ³Dr³Type, description³ux³Format³Related ³VolumeLabel³LVM Volume, Partit³Size MiB³ ÃÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ ³01*³ ³Prim 07 Inst-FSys³ 1³NTFS ³Win NT ³WinXpPro ³WinXP, IBM-preload³ 12344.0³ ³02>³ ³Prim 0a IBM-BMGR ³ 2³BMGR ³LVM ³I13X-aware ³, [ BOOT MANAGER ]³ 7.3³ ³03*³D:³Log 07 Inst-FSys³ 5³HPFS ³IBM 4.50³ECS12 ³eCS12, Clean insta³ 1114.7³ ³04 ³E:³Log 06 FAT16 ³ 6³FAT16 ³MSDOS5.0³DEVELOP ³Develop, FAT - 20³ 2045.0³ ³05 ³F:³Log 07 Inst-FSys³ 7³NTFS ³Win NT ³Fotos ³Fotos, XPdata ³ 19195.2³ ³06*³G:³Log 07 Inst-FSys³ 8³HPFS ³IBM 4.50³ECS1024X768³eCS768, Cisco350 W³ 1114.7³ ³07 ³H:³Log 07 Inst-FSys³ 9³HPFS ³IBM 4.50³HDRIVE-T42 ³Data, OS2-big ³ 12351.4³ ³08 ³V:³Log 35 Warp-LVM ³10³JFS ³IBM 4.50³Virtuals ³VPC, Virtual space³ 10107.0³ ³09*³M:³Log 07 Inst-FSys³11³HPFS ³IBM 4.50³ECS12R ³eCS12r, 2200 WiFi ³ 1114.7³ ³10*³-o³Log 07 Inst-FSys³12³JFS ³IBM 4.50³CENTRINO ³Centrino, Intel220³ 1114.7³ ³11 ³L:³Log 0c FAT32-Ext³13³FAT32 ³DFSee7.x³LONGNAMEFS ³LFN-exchange, f32-³ 4444.4³ ³12 ³ ³Log 07 Inst-FSys³14³NTFS ³Win NT ³New Volume ³NTFStest, Expand-h³ 5101.4³ ³13 ³U:³Log 35 Warp-LVM ³15³JFS ³IBM 4.50³WSE-DEMOJFS³Demo-JFS, wse2006-³ 3004.7³ ³14 ³ ³FreeSpace Pri/Log³ ³-- -- ³-- -- --³- - - - - -³ ³ 3255.8³ ÀÄÄÄÁÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÁÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÙ Number of disks = The number of disks reported by the system Ph-Geo disk n ... = Physical geometry for disk 'n' (using extended-INT13, BIOS) LogGeo disk n ... = Geometry for the same disk 'n', as reported by the OS BIOS Int13 limit = Size of the disk that can be used with regular int13 (BIOS) MBR code ........ = Identifying checksum plus description for the MBR-code Id nn=d: WARNING = Any informal, strange or alarming conditions on partition Where: ID = The selection-id used by DFSee for this partition Postfix: '>' for active partition, any disk '!' active partition, bad bootsector '*' for partitions bootable by BMGR '-' bootable by BMGR, bad bootsector 'r' Removable device, can be ejected 'R' Removable AND Active or Bootable Dr D: = Actual drive letter, capital including a colon, indicates partition is accessible as volume D: -d = Drive 'D:' in LVM (preferred), but NOT mounted Fd = Drive 'D:' in LVM (preferred), but mounted as F: will be displayed in LVM itself as: 'D: ==> F:' D2 D3 = Second or 3rd partition of a multiple LVM volume Type, description = Type info and hex value of the type, type info: Prim = Primary (active, accessible) Hide = Hidden (primary or special) Log = Logical volume in an extended partition Lhid = Logical volume, currently hidden ux = The device number as used by Unix/Linux with /dev/.d. Format = The filesystem format string as found in the bootrecord for the partition or special values: "none" if not formatted at all (no AA55 signature) "unknown" if signature present but unrecognized Creator = The OEM identification string from the bootrec of "unknown" if no valid bootrecord is found For IBM BMGR it can be either FDISK or LVM VolumeLabel = The volume label as found in the bootrecord, or the BootManager version indicator for IBM BMGR: "I13X-aware" means BMGR supports boot > cyl 1023 "MaxCyl:1023" means BMGR can NOT boot > cyl 1023 BM-Name = The name for this partition as registered in the OS/2 BootManager data area LVM Volume, Part = The full LVM volume and partition names (replaces BM-name when LVM info present on disk) Size MiB = The gross size of the partition in Mibibytes In the table, just above the actual partitions, the Linux device name, disk number and descriptive (LVM or DFSee created) name for the disk will be shown. An example of the list output in decimal block form is: DFSee OS/2 8.09 : Executing: part -b ÚÄÄÄÂÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÂÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄ¿ ³ID ³Dr³Type, description³ux³ Fmt ³ Cylinders ³BeginSect³EndSector³ Sectors³Size MiB³ ÃÄÄÄÅÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ ³01*³ ³Prim 07 Inst-FSys³ 1³NTFS ³ 0 - 1671³ 63³ 25280639³25280577³ 12344.0³ ³02>³ ³Prim 0a IBM-BMGR ³ 2³BMGR ³1672 - 1672³ 25280640³ 25295759³ 15120³ 7.3³ ³03*³D:³Log 07 Inst-FSys³ 5³HPFS ³1673 - 1823³ 25295823³ 27578879³ 2283057³ 1114.7³ ³04 ³E:³Log 06 FAT16 ³ 6³FAT16³1824 - 2100³ 27578943³ 31767119³ 4188177³ 2045.0³ ³05 ³F:³Log 07 Inst-FSys³ 7³NTFS ³2101 - 4700³ 31767183³ 71079119³39311937³ 19195.2³ ³06*³G:³Log 07 Inst-FSys³ 8³HPFS ³4701 - 4851³ 71079183³ 73362239³ 2283057³ 1114.7³ ³07 ³H:³Log 07 Inst-FSys³ 9³HPFS ³4852 - 6524³ 73362303³ 98657999³25295697³ 12351.4³ ³08 ³V:³Log 35 Warp-LVM ³10³JFS ³6525 - 7893³ 98658063³119357279³20699217³ 10107.0³ ³09*³M:³Log 07 Inst-FSys³11³HPFS ³7894 - 8044³119357343³121640399³ 2283057³ 1114.7³ ³10*³-o³Log 07 Inst-FSys³12³JFS ³8045 - 8195³121640463³123923519³ 2283057³ 1114.7³ ³11 ³L:³Log 0c FAT32-Ext³13³FAT32³8196 - 8797³123923583³133025759³ 9102177³ 4444.4³ ³12 ³ ³Log 07 Inst-FSys³14³NTFS ³8798 - 9488³133025823³143473679³10447857³ 5101.4³ ³13 ³U:³Log 35 Warp-LVM ³15³JFS ³9489 - 9895³143473743³149627519³ 6153777³ 3004.7³ ³14 ³ ³FreeSpace Pri/Log³ ³ ³9896 -10336³149627520³156295439³ 6667920³ 3255.8³ ÀÄÄÄÁÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÁÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÄÄÙ The decimal start/end/size information shown is in BLOCKS with a default blocksize of 1 sector. Different sizes can be specified on the -b option. For example to display using a 1KB blocksize use: 'part -b:2' An example of a list fragment for verbose form (HPFS) is: DFS partition Id : 08 disk nr : 1 = FixedDisk Diskgeo = Cyl:14946 H:255 S:63 P-table for this : 017FE09E = EBR:5, entry:0 Previous P-table: EBR:4, entry:1 System Indicator : 07 = Inst-FSys Linux-devicename: /dev/hda9 FileSyst. format : HPFS Partition type : Logical Visible Bootrec-OEM-name: IBM 4.50 Partition Label : OS2DATA Boot capability : Not bootable by BIOS and MBR-code or OS/2 boot manager Bootsec checksum : B8FE2D50 Bootsect. offset : 0000003F = 63 Dec Cylinder size : 3ec1 = 7.84 MiB P-table in EBR : -000003f = i13: 00 81 1e = Cyl: 1566 H: 0 S: 1 = 017fe09e 1st part sector : 00000000 = i13: 01 81 1e = Cyl: 1566 H: 1 S: 1 = 017fe0dd Last part sector : 0181d666 = i13: fe 3f 43 = Cyl: 3139 H:254 S:63 = 0301b743 Partition size : 0181D667 = 12346.8 MiB = 1573.996 cylinders Cluster size : 00000001 = 0.5 KiB in 1 sector(s) of 512 bytes LVM Ph disk name : Maxtor 114.5 GiB Drive letter: H LVM partition : OS2-big Volume name : Data OS reported free : H: Free 5714.2 MiB of 12346.8 MiB, on filesystem: HPFS Pid08=H: minor-W : Starts after cyl 1023, problem for older BIOSs/DOS (Int13) Bootsec. checksum : B8FE2D50 --------------------------- end of PART command ----------------------------- _______________________________________________________________________________ #610 PSN command PSN xx = Analyse & display sector using PSN xx Purpose: Display sector using Physical Sector Number addressing Parameters: xx = physical sector number, decimal or 0x prefixed hex Output: Sector display, format selected based on sector contents Remarks: Output that scrolls off the screen can be repeated using the 't' command. (display 'this' sector) _______________________________________________________________________________ #615 PATCHKEY command PATCHKEY = Replace keyvalue in current sector by actual registration key Purpose: Replace a (temporary) registration key value in the current sector by the value for the actual, and validated, registration key Parameters: none Output: One line to indicate success or failure Remarks: Used to automatically register a created USB-stick (DFSEEPUPPY) _______________________________________________________________________________ #620 PRITEMS command PRITEMS x [name] = Set number of items/passes for the progress indicators Purpose: Allow multiple items to be individually tracked with a progress indicator like: "13% pass 1 of 3" Parameters: x optional Total number of items/passes to be done name optional Name to presented (partition, pass etc) Output: none Remarks: This command is intended to be used from automated scripts and other built-in commands, to allow a 0 .. 100% progress to be shown for each item, while still informing the user of the total progress. Items could be passes in multi-pass operations (SECUREWIPE) or partitions being imaged to a file or whatever ... _______________________________________________________________________________ #630 PT command PT [*|pid|drive] = Display partition table for current or specified pid/drive Purpose: Quickly show the partition table of a partition, and possibly navigate to related LVM information and the bootsector Parameters: pid optional partition id to show table for drive optional driveletter for the partition * optional show info for ALL partitions Options: -d restrict 'all partitions' to current disk only -d:disknr restrict 'all partitions' to disknr -r Display related bootsector and LVM info too Output: Display of the partition table entries in the sector (max 4) Remarks: In the Mode=FDISK, the 'pid' parameter is NOT optional When a partition table is displayed, it is quite easy to navigate to some related information using single letter commands 'd' (or , 'x' and 'u'. The corresponding PSN values are displayed in the status line of DFSee. An overview of this navigation is shown below: ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³Partition table³ÄÄÄxÄÄ>³LVM information³ÄÄÄuÄÄ>³LVM signature³ ÚÄijsector for pid ³<ÄÄxÄÄijsector (DLAT) ³<ÄÄdÄÄijsector ³ ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ³ ^ ³ ^ ³ ³ ³ ³ ³ ³ ³ ³ d u u x d u ³ ³ ³ ³ ³ ³ ³ ÚÄÄÄÄÄ ³ ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ³ ÀÄ>³Next ³ ÀÄ>³Boot sector for³<ÄÙ ³ ³Ptable ÀÄÄÄÄÄÄijthe partition ³<ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ÀÄÄÄÄÄÄ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ _______________________________________________________________________________ #640 PTE command PTE [pid|xx [e]] = Show & edit partition table at sector [xx] or part [pid] Purpose: Interactive smart editing of partition tables (PTEdit) Parameters: pid optional partition id to edit table for xx optional sector number with partition table e optional entrynumber 1..4 to get 1st focus Options: -f Force adding 0x55AA signature if not present -d:disknr disk to edit partition tables on, default current -i:img image filename containing the partition table (should be a disk image to be useful :-) -p:part partition to edit table for, number or letter -s- Turn smart field updating off, startup default is on", Output: Single line per partition table sector updated (or not). All other output is in the interactive edit dialog window. Examples: pte -part:5 ;PTEdit on table for partition 05 pte -p:H ;PTEdit on table for drive H: pte -d:2 ;PTEdit on disk 2, MBR table Or, directly from the Operating System command line: DFSDOS pte -p:5 ;PTEdit on table for partition 05 DFSOS2 pte -part:H ;PTEdit on table for drive H: DFSOS2 pte -disk:2 ;PTEdit on disk 2, MBR table Remarks: Can only be used in WINDOWED mode (default, or set with -w) Activated with default values by using the function key There is extensive help-information for each separate field in the edit-dialog, as always activated with the key. A second while in that help, will show the generic help for the PTEdit dialog as a whole. Changes to a partition table are written back after an extra confirmation dialog after pressing any of the following keys: Write back changes, end PTEdit interactive session Write back changes, continue on NEXT partition table Write back changes, continue on PREV partition table Cancel any changes, end PTEdit interactive session With 'smart field update' active, it is very easy to keep all fields in a partition table entry consistent. Updating the linear sector values (LBA) will also update the CHS fields and vice versa. The PTEdit dialog is extrememly useful for interactive update of the 'active' flag, the system type and the size (and ending CHS) for a partition as well as updating the starting sector (and CHS) for primary partition. To change the starting sector (and CHS) for a logical partition, it is better to use the DELETE and CREATE commands because it requires relocation of the partition table and not just updating its values. While the dialog is up, commands that are started using a function key can still be executed. (F4 .. F9 are useful) The output in the "text output window" can still be scrolled using + arrow keys or + PgDn/PgUp. _______________________________________________________________________________ #650 q command q = Quit DFSee OS2: 5.55 06-11-2003 (c) 1994-2003; Jan van Wijk Purpose: Exit DFS program Remarks: Opened physical disk and logfile will be closed on exit Asynchronous running threads will be aborted. _______________________________________________________________________________ #660 QUERY command QUERY [item] [n] = Query specified item value for disk/partition/freesp [n] Purpose: Extract exactly one numeric value from the table with disk and partition info. Display it and return in exit-code (RC) Parameters: item optional specifier for the information-item to query. '?' or -? will give usage information. 2 or 3 chars (uppercased) are significant When no item is specified, a compact table with partition info is shown ('part -C -m') n optional Disk-number, freespace-id, partition-id or for a partition, the associated driveletter Usage: QUERY info-specifier [disk | freespace-id | partition-id | driveletter] Note: All values are ROUNDED DOWN to fit a 16-bit integer value! Without parameters, a compact partition list is shown (like 'part -C -m') PArts = # partitions FRee = free exists DIsks = # disks present PValid = P# valid = 0 FValid = F# valid = 0 DValid = Disk-nr valid = 0 PLet = Drive-letter FLog = log possible DLog = # logical partitions PPrim = is a primary FPrim = pri possible DPrim = # primary partitions PType = part type FType = freesp type DTotal = # partitions on disk PCyls = # cylinders FCyls = # cylinders DCyls = # cylinders on disk PHeads = # heads FHeads = # heads DHeads = # heads PSects = # sectors FSects = # sectors DSects = # sectors/track PKiB = P-size in KiB FKiB = freesp in KiB DKiB = Cylinder size in KiB PMiB = P-size in MiB FMiB = freesp in MiB DMiB = Disk size in MiB PGiB = P-size in GiB FGiB = freesp in GiB DGiB = Disk size in GiB PDisk = Disk-number FDisk = Disk-number DFree = # freespace areas PFirst = First cyl. FFirst = First cyl. DFMiB = freespace disk in MiB PEnd = Last cyl. FEnd = Last cyl. DFGiB = freespace disk in GiB P-clus = sect/cluster FId = freesp id DBmgr = IBM BootMgr present PName = LVM present Lvm = LVM present DNames = #parts with LVM info POk = Status 0=clean, 1=unknown 2=dirty DX = #parts without LVM PInfo = 1st FS-letter P0mft = MFT fragments PBtini = Win BOOT.INI OK = 0 MKiB Minimum GKiB Grabable UKiB XKiB Maximum EKiB Maximum MMiB = size of GMiB = freed on UMiB = Used XMiB = freespace EMiB = expand MGiB filesys GGiB resizing UGiB size XGiB (defrag) EGiB size Cyls = # of cylinders, current geometry Version = DFSee major version nr Heads = # of heads, current geometry VMinor = DFSee minor version nr Sects = # of sectors, current geometry RValid = Registration valid = 0 Bmgr = LVM On-BMGR-menu flag (PID/letter) Inst = LVM Installable flag Output: Two lines with the command, the resulting value in HEX and decimal, and the used partition/freespace and/or disk-number. The DFS return code (exit RC) is set to the queried value. For some commands, extra output will show selecting the partition in question, to get FS-specific information For QUERY with a numeric or no parameter at all, the output will be that of "part -C -m" followed by the query parameters. Remarks: When given as the first (or only) command on DFSee invocation, and with any parameter, this command will automatically QUIT on completion, making batch file syntax more readable. This command is VERY useful in batch/command files to base program flow on certain disk/partition characteristics Example: batch file to test if a partition is a primary one: dfsdos query Primary 2 if errorlevel 1 goto PRIMARY :LOGICAL echo Partition 2 is a logical partition goto end :PRIMARY echo Partition 2 is a primary partition :END The 'compact' list is intended for email/newsgroup postings Some examples of useful partition queries are: query ;compact list all partitions query -v ;verbose list all partitions query -m- -d:2 ;just disk 2 query -C- -m- ;the standard 'framed' table query -t- -m- -w ;list warnings only query 3 ;show partition 3 query -disk:2 1,r ;show 1st partition on disk 2 _______________________________________________________________________________ #655 RAW2IMZ command RAW2IMZ raw imz = Create a compressed imagefile (IMZ) from a RAW image file Purpose: Make a smaller image, for backup or other purposes Parameters: raw Filename for the uncompressed RAW inputfile imz Filename for the compressed IMZ outputfile Options: -m[:mcs] Maximum size per imagefile, default 650 MiB -M Media change prompt after each file (removables) -! Use dialog to check or specify more options Output: Progress information Remarks: This is a wrapper/front-end function for the IMAGE command, making it easy to create a compressed image from a RAW one. The output filename will default to the same path and name as the input, with an extension of .IMZ Multiple files are possible, to make them fit on a CDROM for instance, in the same way as with the IMAGE command. When no '-m' option is specified at all, there will be a single .IMZ file of unlimited size! _______________________________________________________________________________ #670 RECOVER command RECOVER path sel = Recover files from Sectorlist to a path, using selection Purpose: Undelete multiple files using (a selection from) a list Parameters: path optional Path to save the file copy, default is last path used, initial value is "." which is the current working directory sel optional File selection parameters, in the form: wildcard%threshold%minsize%maxsize%type%modifydate wildcard = wildcard selection on full path string threshold = +nn = Minimum allocation-OK percentage -nn = Maximum allocation-OK percentage minsize = minimum filesize as MCS number like 1,s maxsize = maximum filesize as MCS number like 9,m type = D=Directories F=Files B=Browse-mode N=Normal (all) modifydate = Restrict to files modified AFTER date or #days Default is : '*%100%1,s%*,s%N%*' ==> any 100% one, any date Options: -8.3 Force 8.3 names on output, as required on most FAT16 -A- NO alloc check, assume 100% (faster, implies -O:n)" -E:i Ignore errors, continue execution when RC is not 0 -E:q Quit on any errors, exit (default when in batch mode) -E:c Confirm with user on errors (default when interactive) -O:q Quiet mode, just report on errors -O:n Normal verbosity, a single line per saved file -O:v Verbose mode, some file detail in 3 lines (default) -O:x Extreme verbose, include progress indicator 'dots' -O:m Maximum verbose mode, include 'skipping' messages -p- Do NOT append original path to specified destination path, only use the targets basename (simple 'copy') -r- Do NOT recurse into subdirectories (no DIR contents) -u Force unique names using hex sector number prefix Output: All files are recovered one by one using the "saveto" command automatically on each selected LSN from the list. Note: Operations using the Sectorlist on FAT/FAT32 like SAVETO are limited to 64 GiB partitions by design! Progress is reported with output like the "ca" command, depending on the specified output verbosity (-O:) Error messages will be given as appropriate. The default error strategy (-E:) is 'quit' for batch mode and 'confirm' otherwise, unless overruled by the global switch -E: on DFSee startup Remarks: See "saveto" and "delshow" command too. LSN list is the find-result list as shown with "delshow" It can be edited using "export" or "log" + "delshow" and imported again using "import", to make specific selections The file contents is always recovered, date&time and attributes may be lost, or could be retained, depending on the filesystem. If no directory is specified it will default to the last one used for saveto. This directory should be on ANOTHER drive! If a path for the deleted file can be resolved, it will be included in the saved copy if possible, unless -p- was used. If the directories do not exist they will be created. This means a whole directory tree can be undeleted in one operation, while retaining the structure. For HPFS filesystems, the names used will be significant in the first 15 characters only, the rest of the name will be replaced by hyphens ('-'). This is needed because the FNODE only stores the first 15 characters of the name. When the destination does NOT support long filenames (FAT) all names will be converted to an 8.3 compatible format. If a combined filename+path would exceed the allowed length for the destination directory (and operating system) the path and filename will be truncated or abbreviated to get it within limits. Although this will NOT guarantee that the whole recovered directory tree has consistent naming it DOES guarantee unique filenames and paths. Individual files can be recovered using the 'SAVETO' command, and recovering can also be done from the interactive directory browser dialog (BROWSE command). _______________________________________________________________________________ #680 REPEAT command REPEAT [command] = Repeat a (multi) command string, counted or forever ... Usage: REPEAT [-r:n] [-v | -v-] command Purpose: Repeat a command forever, or for a specified number of times usually for (stress) testing purposes Parameters command A complete DFSee command-string including parameters and options for the command. It can be a multi-command as well, with more than one command separated by '%' Options -E:i = Ignore, do not quit on command errors -r:nr = Repetition count, FOREVER when not specified -v = Verbose, announce each iteration -v- = No command echo, no promptline Example repeat -r:5 say Hello number $0 %sleep $0 This will use the 'say' command to display 5 'Hello' lines with the current number displayed, each followed by DFSee 'sleeping' for that same number of seconds. repeat -r:999 log scan-$0 %scan -w This will repeat a full-read/write scan for bad sectors on the currently selected object, logging to a specific file for each iteration. Stops after 999 iterations or when the key is used ... Output: Regular output for the command(s), with the addition of the current iteration being displayed, when specified with -v Remarks: The key will abort the repetition The command string can use substitution of the '$0' symbol to identify the current iteration step, value 1 .. n Multiple commands must be separated with '%' instead of the regular '#' character. Otherwise the rest of the commands will not be part of the repetition and only be executed once after the repetition ends. _______________________________________________________________________________ #690 RESIZE command RESIZE [options] = Resize FS to new size, including partition table update TRUNC Usage: RESIZE size | -s:new | -s | -f:size | -f | -m Purpose: Make a filesystem in a partition on a disk smaller, usually to allow creation of another partition. Typical use: create freespace to install a new Operating System WARNING: Resizing a filesystem is one of the most dangerous operations, with many reasons why it might not work correctly. Do NOT resize a filesystem unless you have a tested BACKUP of the data, or the data is easily replaced by other means. Parameters size optional Specifies remaining filesystem/partition size Without a specified size, the user will be prompted for the desired new size. Options -c:[0|1|2] CHS style: 1=PQMagic, 2=MS, default 0=IBM/DFSee To override the global style being used. -f:size Size to free-up as mcs-number -f Free-up half the available size -F Force resize even if smaller than indicated minimum size. Can be useful if allocation information is not correct. -m Maximum size, resize FS to partition size -s:new New remaining size as mcs-number -s Split partition in half Output: Progress, calculated new sizes and partition end position, plus a confirmation message when not working in batch mode. Finally a success or failure message. Examples: resize -f:1000 ;Create a freespace of 1000 MiB resize -f:1,c ;Create a freespace of 1 cylinder (BMGR) resize -s:5000 ;Keep 5000 MiB in the current partition, ;making the rest available as freespace resize -max ;Make FS equal to the partition size, ;useful to expand HPFS/NTFS filesystems ;after making the partition itself larger Remarks: The resulting freespace will always be AFTER the remaining partition, the start of that partition will stay in the same location on the disk. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. The RESIZE command is implemented as a generic command, but requires a filesystem dependent part to be implemented. Currently that is only available for FAT, FAT32, HPFS and NTFS Following a RESIZE operation, a 'CHKDSK /f' may be performed on the filesystem, from an operating system that supports it. In most cases, that CHKDSK will be performed automatically. For HPFS this CHKDSK is mandatory, since it finishes the resize by updating the allocation bitmaps to represent the new size. For NTFS it is optional. The filesystem is left in a perfect clean state, with all bitmaps and other size information set to represent the new size. For FAT(32) the implementation is quite safe because only the partition bootsector and the partition table entry are modified. Interruption (like power failure) might result in a truncated filesystem in a large (unmodified) partition, but never in a corrupted or otherwise damaged filesystem. The new size for a FAT partition can be any size larger than indicated by the 'alloc' command, and smaller than the current size. It will be rounded to cylinder boundaries automatically. When the desired new size is not possible because the last used cluster is located too close to the end, you might want to run a DEFRAGMENT on it with another utility, or the built-in tools found in several Windows Operating Systems. The smallest size possible at any time is shown at the end of the 'alloc' display which is displayed when opening the partition from the menu. _______________________________________________________________________________ #700 RESTORE command RESTORE file = Restore an imagefile to the currently selected object Purpose: Write sectors back from an image to opened partition or volume Parameters: file Filename for the image, default extension is '.img' When the 'img' parameter ends in a '\' for a directory, or there is no parameter at all, a list of available imagefiles is displayed, plus a usage text. When prefixed with [lpt.exe], the data is actually read from named pipe \pipe\xxx.img from LPT.EXE which will be started in a separate session automatically This allows retrieving the image from a different PC that is attached using a parallel (laplink) cable. f First sector number to be written, or: . or 'this' = current sector 'this' .NNN = value from Sectorlist default: 0 s Size to write, in sectors, or: . or 'this' = up to current sector 'this' $ or 'all' or 'end = up to end of current volume/disk .NNN = up to value from Sectorlist default: $ Note: Parameters 'f' and 's' are intended for backward compatibility mainly, using the options '-F' and '-s' respectively is recommended. Options: -b:sectors Number of sectors to buffer, the default is to use the current number of sectors per track (18 for diskettes, usually 63 for harddisks) The maximum is automatically limited to the available buffer memory. -c Compare image data against data in current object, stops at first difference found (implies -t test) -D[:disk] Use option dialog to restore to a disk -F:n First sector as mcs-number, default 0 -I[:"image"] Use option dialog to restore to an imagefile -L Exclude LVM signature area from image (LVM/JFS) -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. -P[:pid] Use option dialog to restore to a partition -q Quiet, display minimal details, progress mostly -s:n Size to be restored as mcs-number, default ALL -S Calculate size to restore from the imagefile itself overruling the current size of the object. For RAW imagefiles (IMG) this is from the filesize, and for compressed (IMZ) it is taken from the header together with the startsector (overruling the start) -test Test only, no actual writing to the current object -v Verify of imagefile integrity, displays details on every handled block of data (63 sectors) like length, compression and CRC-32 when available. -V[:vol] Use option dialog to restore to a volume Note: When a volume corresponds to a partition, using the -P option is STRONGLY recommended! -! Force option dialog to be used, even when sufficient parameters are specified. In this case, only the image file name will be passed to the dialog, other options are ignored and need to be set in the dialog itself. Output: progress information Remarks: You MUST select the disk/partition to write TO (destination) BEFORE using the RESTORE command itself (or the menu item). On the RESTORE command itself, or with the menu-item, you will select the imagefile to be restored FROM (source). You CAN NOT restore an image to freespace, partitions are not created automatically, you MUST do that manually. Compressed image-files created by IMAGE will be recognized and automatically decompressed on the fly. Note: When using compression, the number of sectors used for buffering MUST be the same as used with the IMAGE command, and must be less than or equal to the number of sectors per track or the RESTORE will fail! The -S option is useful when expanding an IMZ file to a RAW image, but is also useful to enhance progress-reporting when restoring a small IMZ file to a large object. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. Smart imaging is automatically supported as well, files that have been created using this option on the 'IMAGE' command do not have any data for empty sectors/clusters, and will cause these areas to be skipped on the writing, saving a lot of time. For Windows-NT with NTFS and OS/2 versions with a kernel 4.50 or newer with JFS, the files CAN exceed 2GiB (large file support). If the image consists of multiple files (.002/.003 etc) these will all be automatically written, when a file is not found (removable media) the user will be prompted to insert the next medium containing that file ... To verify the integrity of a .IMZ compressed image, without actually restoring it, use the "-t -v" options together. The WRIM command is an alias for RESTORE (deprecated) _______________________________________________________________________________ #710 RUN command RUN [script] [p] = Run a DFSee script, with optional parameters and options Purpose: Execute a NATIVE (or REXX) DFSee script with multiple commands Parameters: script optional The name of the script file. If no extension is given a '.DFS' extension will be appended. When there are any spaces in the name, it should be enclosed in quotes! p optional Arguments to be passed as parameters. Up to 9 arguments can be specified and can be used anywhere in the script as '$1' to '$9' while $0 is the script filename (no extension) Arguments can be enclosed in single or double- quotes to allow spaces or special characters Options: -E:i ignore errors, continue execution when RC is not 0 -E:q quit on any errors, exit (default when in batch mode) -E:c confirm by user on errors (default when interactive) -h brief help on variable usage and host variables -P Prompt for the script filename and/or parameters. This will present dialogs where the script to run and any arguments to use can be specified. When parameters are specified with the -P option, the first one (script) MUST be one of: - A wildcard (with * or ?) to select a script from the current directory. - A relative or absolute path to find the script in -p:0 or -p- no prompting or command echo by the command handler -p:1 echo command by handler, but no prompting afterwards -p:2 no echo by handler, but prompting afterwards -p:3 echo before, and prompt after executing (default) -q quit DFSee after executing the script -s single step, confirm each line before executing it -v verbose, show details about running the script Examples: run ;Present filedialog for scripts in current dir run hello ;Run a script called hello.dfs in current dir run -P do* ;Present dialog for 'do*.dfs' in current dir run -P a:\ ;Present dialog for scripts on the A:\ drive Output: SCRIPT progress when running in verbose mode, confirmation dialogs on errors, and regular output from executed commands Remarks: Whenever a filedialog is presented to select a script, there will be an additional prompt box to specify any arguments to be passed to the selected script. All lines in the script that do NOT start with a ';' in the first column, are sent to the command handler inside DFSee to be executed as a command. These commands can be multiple commands as usual (using '#' separators) and can also contain additional comment at the end of the command using ';' as a start-comment symbol. When using the -E:confirm or E:quit types of error handling, every return code from a command that is not 0 will cause either the confirmation dialog, or terminate the script. The return code (RC) for the whole script will be that of the last command that is executed in the script itself. Native scripts can RUN other scripts (nesting) but are limited to about 10 levels of nesting. OS2 REXX: In the OS2 version of DFSee scripts can also be written using the REXX language and the built-in DFSee REXX support. For a description see the DFSCRIPT.TXT documentation file. For an example REXX-script see DFSINFO.CMD _______________________________________________________________________________ #720 S2CL command S2CL lsn = Translate LSN to cluster number and display that Purpose: Display hexadecimal cluster number for specified sector (LSN) Parameters: lsn optional Sector number 0 .. max-sector Output: Sector number (LSN) and corresponding cluster number Remarks: none _______________________________________________________________________________ #730 SAVETO command SAVETO [d][l][n] = Save filedata for current file to new file, optional rename Purpose: Recover a file based on its dir-entry and FAT/FNODE/INODE/MFT, by a sector by-sector copy of its data to a new file. Parameters: d optional Path to save the file copy, default a:\ l optional LSN representing the file to recover HPFS: LSN of the file FNODE NTFS: LSN of the MFT-record JFS: LSN of the Inode EXT: LSN of the Inode FAT: Combined LSN of directory+entry nr EFAT: Combined LSN of directory+entry nr Default is the CURRENT sector (this) n optional New name for the file (rename on copy) Options: -8.3 Force 8.3 names on output -A- NO alloc check, assume 100% (faster, implies -O:n)" -e:entry Directory entry number for FAT DIR sector 0 .. 15 Useful only if the current sector (this) is a FAT directory sector, with 16 entries of 32 bytes each (or 0..127 for 128 entries, for sectorsize 4 KiB) When the current sector was selected from the sector list (using a .NNN command) there will be an implicit default value that equals the correct entry number (so no need to specify the -e: option at all then) -O:q Quiet mode, just report on errors -O:n Normal verbosity, a single line per saved file -O:v Verbose mode, some file detail in 3 lines (default) -O:x Extreme verbose, include progress indicator 'dots' -O:m Maximum verbose mode, include 'skipping' messages -p- Do NOT append original path to specified destination path, only use the targets basename (simple 'copy') -r- Do NOT recurse into subdirectories (no DIR contents) -u Force unique names using hex sector number prefix"); Output: Progress is reported with one RED or GREEN dot for each sector a '¯' character for each allocation-extent and sometimes a 'ä' for even higher-level allocation sets. (depending on verbosity) Remarks: The file contents is always recovered, date&time and attributes may be lost, or could be retained, depending on the filesystem. If no directory is specified it will default to the last one used for saveto. This directory should be on ANOTHER drive! If a path for the deleted file can be resolved, it will be included in the saved copy if possible, unless -p- was used. When the destination does NOT support long filenames (FAT) all names will be converted to an 8.3 compatible format. Multiple files can be saved using the 'RECOVER' command, and recovering can also be done from the interactive directory browser dialog (BROWSE command). Note: Operations using the Sectorlist on FAT/FAT32 like SAVETO are limited to 64 GiB partitions by design! _______________________________________________________________________________ #740 SCL command SCL clsize = Force cluster size to specified value (decimal, sectors) Purpose: Force a specific number of sectors per cluster Parameters: clsize mandatory Number of sectors per cluster (decimal) Output: none Remarks: Should be automatically correct, special purpose usage only _______________________________________________________________________________ #750 SERIAL command SERIAL [serial] = Set new Volume serial Number in the bootsector for a FS Purpose: Set a volume serial number for filesystems that support it Parameters: serial optional New volume serial number Options -! Force input dialog for a new value Output: Progress information Remarks: The volume serial number is a field in the bootsector, used by many but not all filesystems to uniquely identify this volume. It can be in in different places in the bootsector, depending on the filesystem being used. DFSee recognizes, and can update the serialnumber for FAT12, FAT16, FAT32, NTFS, HPFS and JFS. Originally intended to identify removable media like diskettes it is still being used by some operating systems and disk tools and should normally be UNIQUE for the whole system. Duplicates may occur when CLONING partitions, or when using IMAGING to save and restore partition contents. unless these cpies of partitions are intended for backup purposes only, it is advised to make the copies unique by changing the volume serial number using the 'serial' command or the corresponding menu item in the 'Mode=xx' menu. Duplicate serialnumbers may cause DFSee to display incorrect driveletters for the original and the copy of it. DFSee will display BOTH assigned driveletters in case of doubt, and issue a verbose warning with the PART display as well. _______________________________________________________________________________ #760 SHIFTL command SHIFTL [options] = Shift data inside sectors towards beginning (aka LEFT) Purpose: Move bytes WITHIN a sector towards the beginning (shift left) Options -F:sector First sector of area to shift, default 0 -l:bytes Number of bytes to shift, 1 .. 511 default 2 -s:size Size of area to shift, as mcs-number default 1 Output: Progress information Remarks: The first '-l' bytes in the first sector will be lost, and the last '-l' bytes in the LAST sector handled will remain there as duplicates of the bytes shifted left. They would need manual correction using 'edit' when important. _______________________________________________________________________________ #770 SHIFTR command SHIFTR [options] = Shift data inside sectors towards the end (aka RIGHT) Purpose: Move bytes WITHIN a sector towards the end (shift right) Options -F:sector First sector of area to shift, default 0 -l:bytes Number of bytes to shift, 1 .. 511 default 2 -s:size Size of area to shift, as mcs-number default 1 Output: Progress information Remarks: The last '-l' bytes in the last sector will be lost, and the first '-l' bytes in the FIRST sector handled will remain there as duplicates of the bytes shifted right. They would need manual correction using 'edit' when important. _______________________________________________________________________________ #780 SHOW command SHOW [s] = Hex-dump current sector (or half-sector), s sectors/bytes Purpose: Display current (last read, edited) sector in hex-dump format Parameters: s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default size is 512 bytes for 'SHOW' and half that, 256 bytes for 'show' Output: Hex-dump of the sector, see the 'h' and 'H' commands Remarks: The main difference with 'h' and 'H' are that the current contents of the sector buffer (possibly changed by an 'edit') are shown. 'h' and 'H' will first read a sector from disk. _______________________________________________________________________________ #790 SCAN command SCAN [sn] [-w][-a-] = Scan bad sectors; use Read or Read/Inverse/Write/Verify Purpose: Identify bad sectors on a physical disk or logical volume Parameters: sn Start sector for the SCAN as an MCS-number default value is the current sector. Options -a- NO automatic identification display for bad sectors based on existing SLT data (CHECK) -b:N Number of sectors to buffer, the default is 18 for diskettes, and 63 for harddisks being the natibe tracksize for the device. The maximum is automatically limited to the available buffer memory. -b:1 Precise mode, 1 sector at a time, this is up to 20 times slower than optimal, but reports bad sectors exactly per sector. Note: DFSee will automatically retry a buffer that had any bad-sectors one sector at a time, so the DFSee sector-list will contain INDIVIDUAL bad sectors already, there is usually no need to scan a whole disk or partition with -b:1 -skipbads:n Skip 'n' sectors on each bad-sector area detected to speed up checking a whole disk, sacrificing precision. Default value 2048 sectors = 1 MiB -w Use the read/write/verify/write sequence, Output: Progress indication based on sector numbers, and one line for each bad sector found, plus an SLT display of a related sector if automatic SLT display is enabled. Remarks: For REXX, the dfs_sn.0 stem variable will hold the number of bad sectors found and dfs_sn.1 through dfs_sn.n the actual bad sector numbers (can be shown with the 'list' command) Without the write option, only a single 'read' will be done for each buffer (1 .. N sectors), this can be executed on a running system with open (locked) files on the disk/volume. With the write option a "read/write inverse/read/write normal" sequence is done for each buffer with content checking. The contents of each sector will stay the same, so the function can be safely executed on formatted disks with live data. This sequence takes at least 4 times more time to complete and also, for safety, the disk will be locked. This means that often the write option can only be used when the complete physical disk is not being used. _______________________________________________________________________________ #795 SCRFILE command SCRFILE [fn] [l] = Save screen buffer to file [fn], last [l] lines Purpose: Save screen (buffer) contents to a file for latyer analysis Parameters: fn optional Filename to save to, default is screen.log l optional Number of lines to save, always ENDING on the LAST line written to the screen. The defauilt is to save ALL the lines present in the screen buffer. _______________________________________________________________________________ #435 SEARCH command (or '/') SEARCH [phrase] = Search the text output window, highlight the search-result Purpose: Search for one or more words in the text output window, and highlight the search-result when found. By default the search will search BACKWARDS from the end of the output window. Parameters: phrase A phrase of one or more words to search for Output: The highlighted search-result, with the output window scrolled to make the line in question visible. Remarks: When no parameter is given, you will be presented with the standard 'search' dialog, with the 'grep' box unchecked. When using the '/' alias for 'search' you should omit the space Examples: search Registration /Registration _______________________________________________________________________________ #800 SET command SET var [value] = Set/show a DFSee system variable value Purpose: Set a DFSee system variable to a specific value and/or show the actual value of a variable Parameters: var [value] Name and optional value for a variable - ALIGN Default partition alignment on CREATE auto Cyl on MBR-type, MiB on GPT ones (default) cyl Align on Cyl boundaries using disk geometry mib Align on 1 MiB (0x800 sectors) boundaries #sectors Align on multiples of specified nr of sectors - ANSI Ansi color and cursor movement, default ON on ANSI support ON off Off, black & white output - ASCii ASCII 7-bit only (avoid 'graphical' chars) on Strip 8th bit from output characters off Off, allow any character value - COLOR User interface text fg/bg colors (part of scheme) - ERROR Error handling strategy, default CONFIRM confirm Ask user to quit, or ignore the error ignore Ignore error, set returncode ($_rc) 0 quit Quit the operation, keep non-zero $_rc - EXPert User interface selection, complexity basic Most used functions only (menu, dialogs) expert All available functionality - GEOcalc mode ON or OFF, contents-based disk geometry (switch OFF to see the 'real' disk size) - FLOPPY Include diskettes A: and B: in volume/drive lists - GPTauto Automatic interpretation of GPT guard/tables (switch OFF to see the 'guard' partition) - HIDDEN Show hidden items in File Dialogs on Show .filename or attribute Sys/Hidden off Hide .filename or attribute Sys/Hidden (default) - HISTORY Behaviour of the commandline history buffer: plain Default, very predictable behaviour, with NO removal of duplicate commands, and NO filtering based on prefix filter Only list items from the history where the typed prefix on the commandline matches the start of the item unique Do NOT store any exact duplicates in the history, can be useful when many commands are issued. classic A combination of FILTER and UNIQUE - INSERT Insert mode for keyboard input in entryfields on Input is INSERTED at cursor position off Input OVERWRITES current cursor position 2 .. N AUTO INSERT mode for entryfields, with insert set 'ON' for fields longer than N - LOGauto Automatic logfile numbering and date prefix on | num Use automatic log numbering 001..999 date USE YYYYMMDD postfix, append if existing off Use filename 'as is', append if existing - LOGFILE Control actual logging to current logfile on Logging is enabled (standard) off Logging is (temporarily) disabled - PEDantic mode ON or OFF, extra warnings & details - PT0show mode ON or OFF, show (deleted) partition type 0x00 - PRIO Process priority (non-DOS OS only) m = Min lowest priority l = Low lower priority s = Std standard priority h = High higher priority x = maX highest priority q = Query just show current setting - RADIX Default mcs-number Radix mask, default 0 = DEC H all classes set to HEX\n" 0 all classes set to DECimal\n" mask classes with bit SET will be HEX all others are DECimal\n\n" Classes defined for DFSee, and defaults: 1 = Standard class (DEC) 2 = mcs-numbers ,s unit specified (DEC) 4 = mcs-numbers any other units (DEC) 8 = DFSee sector number, no unit (DEC) 16 = DFSee size values, no unit (DEC) 32 = DFSee partition type, no unit (DEC) For the RADIX value, just add the numbers. - RESET Reset terminal on program exit, default OFF on Reset on exit off No reset - SCHEME User interface appearance (includes COLOR and STYLE) 3d Grey 3-dimensional dfsee DFSee classic Cyan nobl Non-blinking Brown cmdr Commander NC/FC/MC white Black and White 3D black Black & White only - SCREEN Screen output, default ON on Screen output on off Off, output to LOG or REXX only invert Inverted colors (toggle value) bright Bright foreground (toggle value) - SELCLIP Selection of CLIPBOARD, not PRIMARY for copy/paste on Use 'xclip -selection CLIPBOARD' off Use 'xclip -selection PRIMARY' (default) (This is a Linux only setting) - Showhid Show hidden items in DFSee BROWSE dialog on Show .filename or attribute Sys/Hidden off Hide .filename or attribute Sys/Hidden (default) - STYLE User interface linestyle being used (part of scheme) 0 double 1 3d 2 halfblock 3 fullblock - SEParator Separator character for multi-commands - SKIPFS String of space separated filesystem names that are skipped on drive-letter correlation Specifying 'FAT32' will avoid the 'program exit' bug in the OS/2 version due to a FAT32.IFS bug - SYNCLVM mode ON or OFF, OS/2 dynamic sync of LVM info (OS/2 version only, may cause spurious traps) - TYPE Type-ahead, default for DOS: Off, others: ON on Type-ahead enabled off Type-ahead disabled - VARiable and expression substitution in commands Remarks: Setting the lowest priority (Min) might cause DFSee to stop processing (CPU-starvation) if there are other high priority tasks running in the system. _______________________________________________________________________________ #810 SLT command SLT [p [s]][opt] = Display Sector Lookup Table at index 'p', showing 's' lines Purpose: Display (selection of) the Sector Lookup Table Parameters: p optional Position, start index in the SLT to display, '+n' and '-n' show next/previous screen full where n is the optional pagesize 'a' = display the entire SLT (can be huge!) 'e' = one page until the end of the table s optional Number of entries to display, default will result in one screen full; '*' = rest of SLT Options: -1 or -1- Output on a single line (with verbose -v) -a[:lsn] Display SLT for sector-numbers around 'lsn' with a default of the current sector 'this'. -c Check allocation consistency too (might be slow! -d- Do not set the -v and -1 values as new defaults -lfn- Do NOT show long (FAT) filenames but short ones -m[:mask] Error filtering mask, default all errors Hexadecimal value, each set bit will include a specific error value for a filesystem. (using '-m' implies the '-c' option as well) -M Force creation of 'magic' recovery names to (unmounted) JFS filesystems. (JFS only) -P Prompt mode, option dialog for parameters -r Refresh SLT even when one already exists -t:type Display specified area types only (??? cmd) -v or -v- Set verbose, error-text and path+filename -x Stop building SLT in background, discard SLT Output: One or two lines for each entry in the SLT, containing: LSN Start LSN for a range of sectors size Number of sectors in the range ref Other sector referring to this range (fnode) type Type of the sectors in the range error 6-digit Hexadecimal error value, some are generic, some are specific to a filesystem. The filesystem specific ones are also listed with the 'CHECK' command in each DFS[fs].txt, DFSHPFS.txt for HPFS for example. 0x000001 Linked to some structure, not in alloc-map (needs -c) 0x000002 Allocated in alloc-map, but no known link (needs -c) 0x800000 The filesystem is DIRTY or MOUNTED (in use by the OS), operations like resizing are NOT advisable now! Remarks: Sector ranges might overlap, the smallest matching range will hold the best identification for a specific sector. The start-index will default to the position of the sector last searched using the 'id' cmd. If needed the SLT will be built in a background thread. _______________________________________________________________________________ #820 SLT2LIST command SLT2LIST [opts] = Add (selected) sectors from the SLT to the Sectorlist Purpose: Allow analysis (export) of sectors related to filesystem errors Parameters: cl optional Number of sectors added per (error) area Options: -a Add to existing Sectorlist -F:from Include range start sector, default 0 -m:mask Error filtering mask, default 0xfffffffe resulting in just 'lost clusters' added -m:0 Add EVERY SLT area to the Sectorlist, not just the ones with reported errors. -r Add REFERENCE sectors to the list only -s:size Size of the 'include' range, default ALL Output: none _______________________________________________________________________________ #830 SORT command SORT [-d] [-u] = Sort Sectorlist; [-d] = descending [-u] = no duplicates Purpose: Sort the list ascending/descending [, remove duplicates] Parameters: -d optional Sort descending, default is ascending -u optional Make list unique by removing all duplicates Output: none _______________________________________________________________________________ #835 SPEED command SPEED [-b:N][-w] = Determine sector read or read/write speed for current object Purpose: Quickly test how fast an opened disk/device can read/write data Options -w Use a read/write/verify/write sequence,to perform a non-destructive write speed test -b:N Number of sectors to buffer, the default is 18 for diskettes, and 63 for harddisks being the native tracksize for the device. The maximum is automatically limited to the available buffer memory. Output: Progress indication based on milliseconds in the 6 seconds period followed by a throughput summary after the measurement is done Remarks: Without the write option, only a single 'read' will be done for each buffer (1 .. N sectors), this can be executed on a running system with open (locked) files on the disk/volume. With the write option the SAME data read, is written back. The contents of each sector will stay the same, so the function can be safely executed on formatted disks with live data. Note that the measured speed will (sometimes heavily) be influenced by CACHING in the disk device being measured so use multiple runs of the SPEED command to get a feel for that You can also change the current sectornumber for the opened object to a drastically different value, to make it likely the requested read data is NOT YET in the cache. _______________________________________________________________________________ #840 STORE command STORE [letter] = Select store to be the current store; or display stores Purpose: Display all stores with attached contents for open stores, or make the specified store-nr the default one Parameters: letter optional ID of the store to be made CURRENT A or B for user stores, S for system-store Options -R Set the selected store to Read-only mode -R- Set the selected store to ReadWrite mode Output: A list with all stores and their associated contents, or a single line indicating the just-selected default store. Remarks: At the moment the use of another store than the CURRENT is only used by a few of the DFSee commands like CLONE and COMP. A store can be representing: - A partitionable medium, usually in FDISK mode (cmd DISK/WALK) - A partition on a disk, with a mode like HPFS (cmd PART) - A volume opened directly, with a FS mode like HPFS (cmd VOL ) - An image file opened for analysis (cmd IM ) DFSee currently uses 3 stores: S or 0: The system store, used by DFSee internally A or 1: User first store (the CURRENT at startup) B or 2: User second store (alternate at startup) _______________________________________________________________________________ #850 SYNCLVM command SYNCLVM vol [dr] = Sync LVM engine to use [dr] letter for volume, or HIDE it Purpose: Force external LVM engine to use/hide driveletter for volume Parameters: vol mandatory LVM volumename for the volume to be changed dr optional Driveletter to be assigned to the volume When not specified, volume will be HIDDEN Output: Single line of progress / result of the action Remarks: This command is available on the OS2 version of DFSee only, and needs the LVM Engine to be available, meaning LVM.DLL should be accessible and in the LIBPATH ... This command may be useful to hide a volume if you want to make changes to it like wiping or restoring an image. Keeping the volume visible, may cause problems with the filesystemdriver (IFS) that is attached to the volume due to caching issues. (propblems like traps are possible) When using FORMAT in DFSee, the volume is automatically HIDDEN during the format, and re-assigned afterwards. Warning: Using the LVM.DLL to synchronize LVM info dynamically is known to cause traps (in OS2LVM.DMD and LVM.DLL) on some systems. Removable media seem to suffer more from that than fixed ... _______________________________________________________________________________ #860 t command t [sector type] = Display 'this' sector as Hex or specified sector type Purpose: Display current sector in any specified or default format Parameters: type optional Specifies display format as: a = ASCII h = HEX any = any valid sector type (use ??? cmd) none = default (based on sector contents) Output: Sector display in requested format Remarks: _______________________________________________________________________________ #870 TRACE command TRACE [lvl|fn] = Set trace level and destinations or DFSee functional trace Purpose: Set and check TRACE level, format and destinations Parameters: lvl optional level/dest. 0 = no trace 1 = trace to title bar other = detail level fn optional Trace filename with fixed lvl = 100 May include a path specification. Options: -d[:xx] add xx ms delay for each trace line, slowdown -f[:ff] retain ff numbered logfiles when cycling -m[:mm] cycle to next logfile after size mm KB -r Close and reopen log on each line (slow) -r- Open log just once (this is the default) -s Trace to the scroll-buffer (screen) too -s- Switch off trace to screen -t Add timestamps and force thread-id display -t- Switch off timestamp and thread-id Filename with optional path for tracefile. This is the same file used as normal LOG. If logfile specified, level is set to 100 Output: The resulting trace-level and selected destinations Remarks: The file used by TRACE and LOG are the same file, so regular DFSee output will be mixed with the functional trace of the code generating that output. The (left) +/ key cycles levels 0 -> 1 -> 100 -> 0 TRACE is only available in the trace versions, these will be the default delivered executables starting with version 5.11 TRACE is intended for very complex situations and for analysis of DFSee problems (debugging). Trace can also be started directly at startup by using the '-123[t][s][r][l]' switch, or the equivalent DFSEETRACE environment variable with value '123[t][s][r][l]' Example: 'SET DFSEETRACE=101tr' this will start a trace to logfile DFS-101.log, with timestamps and close/reopen on each line and the trace level set to 101. _______________________________________________________________________________ #880 TRANS command TRANS [-type] xx = Translate and display value 'xx' as Lsn, I13, CHS and PSN Purpose: Translate value xx from [-type] to 4 possible representations Parameters: xx optional input value(s) to translate, default as LSN The default is the 'this' value (as lsn) Options: -c = CHS, 3 decimal values; cyl, head, sector -i = INT, 3 hex-byte CHS, as in Part-table and INT13 interface -l = LSN, logical sector number -p = PSN, physical sector as a hexadecimal number Output: One line with all 4 possible representations of the value 'xx' Remarks: The option, if any, specifies the format of the 'xx' parameter This function is useful to calculate values for partition table entries or CHS values. The same functionality is used in the 'list +g' command against each sector number in the list. _______________________________________________________________________________ #890 TXDIR command TXDIR fn [o] [a] = List files for wildcard selection 'fn' and several options Purpose: Show a directory like list of files, using specified options Parameters: fn optional Path and filename specification, wildcard The default is the current directory. o optional Selection of object to show: SFDP S=subdirs, F=Files, D=Dirs, P=Parent .. a optional Selection by file-attributes +A archive-bit -A NO archive bit +R read-only -R NOT read-only +S system-bit -S NO system bit +H hidden -H NOT hidden Options: -b Display file base-name only, no path etc. Output: One line for every matching file or directory, either with date, time, size, attributes and the full path+filename for the file, or just the basename when '-b' is specified. Remarks: The 'o' and 'a' parameter may NOT contain any spaces, example: 'DP' = show directories only, including the parent '+A-R-S-H' = non-system/hidden/readonly files, archived bit set This command can be useful as a built-in DIR/ATTRIB command. Results are identical to the (TxWin) File-Open dialogs ... _______________________________________________________________________________ #895 UICTEST command UICTEST = UI test, display Colors, Character-set, drawing-Characters Purpose: Check display of the following UI scollbuffer capabilities: COLORS PC/ANSI color set, 16 foreground/background colors CHARSET Display all possible (256) ASCII codepoints CBOXES Display pseudo-graphics using 'box' characters _______________________________________________________________________________ #896 UICC command UICC [fg] = UI color cube display, display an 88 or 256 color palette Purpose: Display all colors in the 88 or 256 standard color palettes (to allow tuning their usage within DFSee by the programmer) Parameters: fg optional Foreground color used to display color numbers in addition to the pure black and pure white Range is 0 .. 87 or 0 .. 255 respectively. The default fg color is 8 (mid-grey) Options -c:[4|6] Force 88-color palette (4x4x4 cube) or a 256-color palette (6x6x6 cube) Default '4' for rxvt, '6' for xterm/Terminal Output: Three areas with ranges of different background colors, same FG: 0 .. 15 Standard PC set of colors (often too bright on UNIX) 16 .. 79 4x4x4 colors for 64 'cube' colors in 88 color palette or 16 ..231 6x6x6 colors for 216 'cube' colors in 256 color palette 80 .. 87 8 grey-scale colors in between pure black and white or 232..255 24 grey-scale colors in between pure black and white Remarks: This will work as intended only when NOT running windowed, so when writing to the raw terminal (start DFSee with -w-) This is also done in the supplied 'dfspalet' script for UNIX _______________________________________________________________________________ #898 UIKEYS command UIKEYS [-u] = UI key/mouse test, (RAW) key-values and mouse coordinates Purpose: Check generated raw key codes including escape-sequences on UNIX Output: TxLib/DFSee unique keycode, low-level escape-sequence for Unix, a timestamp for keyboard and mouse, include coordinates and a DBLCLK detection for the mouse. Options -u Overwrite the same screen line over and over _______________________________________________________________________________ #900 u command u [sector type] = Display 'up' sector as Hex or specified sector type Purpose: Display current sector in any specified or default format Parameters: type optional Specifies display format as: a = ASCII h = HEX any = any valid sector type (use ??? cmd) none = default (based on sector contents) Output: Sector display in requested format Remarks: _______________________________________________________________________________ #910 UNLOCK command UNLOCK = Unlock physical disk, after writing to it Purpose: Unlock a physical disk Parameters: none Output: none _______________________________________________________________________________ #912 VDI command VDI [vdi] [opt] = Open VirtualBox Base/Snapshot diskimage for BROWSE/Analysis Purpose: Access partitions/filesystems contained in a VirtualBox diskimage Parameters: vdi optional Path or filename for the image, the default extension is '.vdi'. When the imz parameter, ends in a '\', the imagefiles will be listed in a file-open dialog for that directory. When not specified, a file-open dialog will be presented where a file can be selected Options -e:'ext' Overrule default 'vdi' extension with 'ext' Output: For a VBox BASE VDI, this will add it as a new DISK, from which you can select a partition, and start a BROWSE session. For a (matching) SNAPSHOT VDI, it will automatically ADD this to the corresponding BASE VDI disk. To add a complete virtual disk, you should first open the BASE VDI, then all snapshots in the correct order, oldest to newest. When a snapshot VDI selected does NOT match any of the already opened BASE VDI disks, it will be opened as if it was a BASE After a complete VDI has been loaded, you can analyse it in any way supported by DFSee for disks, including BROWSING a filesystem in one of the contained disk partitions. Remarks: Using BROWSE, you can selectively COPY files from a VirtualBox disk image, without having to actually run a Virtual Machine. _______________________________________________________________________________ #916 VER command VER [-g][-update] = Display a single line of version/builddate information Purpose: Display a single line with version and builddate Options -update Mark as 'Update' instead of 'Current' version, and add a packaging date/time string as well EXE-switch -g Output single line to STDOUT, even if -q used Output: A single line, with Current/Update, DFSee version and date and for updates, a packaging date and time string Remarks: Intended to be used to inform the user of possible updates to the program (accessing a website using wget for example) Can be used to generate a 'version descriptor' file as well during build/delivery, which can be uploaded with the actual delivery ZIP file or other upload, for example: dfsos2.exe -q -Q -g ver -update > dfsee_update.info _______________________________________________________________________________ #920 VOL command VOL [drv] = Show all volumes, or select one using drive-letter Purpose: Work with logical volumes including floppies and CDROM Parameters: drv optional Drive-letter for the volume to open Options -c Include CDROM type drives (default) -c- Exclude CDROM type drives -f- Include floppy-drives A:/B: (default) -f- Exclude floppy-drives A: and B: -l Include LAN drives (on OS/2, default) -l- Exclude LAN drives (on OS/2) -R Select the volume in Read-only mode Output: Either the list of volumes or the default display for the first sector of the volume (usually a bootsector). Remarks: Network or other "virtual" filesystems are not supported for 'open' like 'vol X:', but they might be listed depending on the used selection options. The OS/2 version will include the network share name for LAN drives as well. For Windows-NT and OS/2 versions with a kernel 4.50 or newer, the volume CAN exceed 2GiB (large file support). When using the menu-system the key or the menu-selection to show the list of volumes will also cause the submenu with available volumes to be refreshed (Open volume ..) This might be useful after inserting/removing a removable medium like a diskette or CDROM while DFSee is active. _______________________________________________________________________________ #930 WALK command WALK [disk-nr] = Select partionable medium (disk) and show partition tables Purpose: Select a physical or virtual disk, list MBR/EBR sectors Parameters: disk-nr optional disk nr, default is current if open or 1 Options: -r reset previously forced geometry -R open the disk in Read-only mode Output: Disk Geometry and default display of every partition table sector (MBR/EBR). This will 'walk' the chain of EBR sectors. _______________________________________________________________________________ #940 WIPE command WIPE [pat] [f s] = Wipe disk/vol/part area with pattern at LSN [f], size [s] Purpose: This will wipe an entire volume or disk, or a specified part of it, using the specified pattern. Parameters: pat The pattern to use for wiping, it can be any length from a single byte up to 256 bytes. When no parameters are given the fill pattern is binary 0. There are two special pattern characters: z and r To use a pattern of ZEROES, use a SPECIAL value: wipe z ;wipe whole object with ZERO wipe z 0 10 ;wipe first 10 sectors, ZERO To use a RANDOM pattern, repeated for every sector wipe r ;wipe whole object with RANDOM wipe r 0 10 ;wipe first 10 sectors, RANDOM To use a simple text as a pattern, use: wipe 'hello world' 0 10 ;fill first 10 sectors with hello world A more complex pattern can be specified as a mix of ASCII, UNICODE and HEX. The starting mode is ASCII, switching to HEX and back is done with the ' character, to UNICODE and back with the " character. Note on quoting: The outermost set of quotes, which can be either single or double-quotes, will be stripped off by the parameter parsing logic before it is passed to the 'wipe' command. You CAN use that same quote character again in the parameter using the 'escape' character '\' Example: "The \" is a double-quote" f First sector number to be wiped, or: . or 'this' = current sector 'this' .NNN = value from Sectorlist default: 0 s Size to wipe, in sectors, or: . or 'this' = up to current sector 'this' $ or 'all' or 'end = up to end of current volume/disk .NNN = up to value from Sectorlist default: $ Options: -a:'asc' ASCII wipe-pattern value, string -b:sectors Number of sectors to buffer, the default is 18 for diskettes, and 63 for harddisks The maximum is automatically limited to the available buffer memory. -f Wipe ONLY freespace within a filesystem, meaning all sectors/clusters that are NOT marked as being used for a file or are otherwise 'in use'. -F:n First sector as mcs-number, default 0 -h:'hex' HEX wipe-pattern value, sequence of hex pairs -m:'mix' Mixed ASCII/HEX/UNICODE wipe-pattern -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. -P Prompt, allowing editing of the specified value with one of the -a, -h, -u or -m options -s:n Size to be wiped, as mcs-number, default ALL -t Test only, no real wipe will be performed -u:'uni' UNICODE wipe-pattern value, string -V Verify each sector wiped by reading it back, this can slow the process down considerably! Output: Progress indicator with one dot for each wiped area resulting in about one screen full of dotted lines for the full partition or disk being wiped. Remarks: A disk, partition or volume needs to be opened first. You can easily call DFS (or DFSDOS) from the command line specifying a 'wipe' for the entire volume or disk. Specifying the 'pat' parameter is mutually exclusive with using any of the '-a', '-h' or '-u' options. The 'f' parameter is mutually exclusive with the -F option and the 's' parameter with the -s option. The mcs-number format is [0x]nnnn[,g|m|k|c|h|t|s] a HEX or decimal value, in GiB, MiB, KIb, Cylinders, Tracks or Sectors. Default is decimal MiB. Example: wipe "'00'" 0 1 or: wipe z 0 1 or: wipe -size:1 Will set sector 0 to zeroes, clearing boot code and, when the current object is a complete disk, the partition table wipe z . 2 Wipe 2 sectors with zeroes, starting from the current sector wipe z 0 . Wipe all sectors from 0 up to the current sector with zeroes wipe -m:"test'0d0a'line2" -Prompt -size:0x100 Wipe 0x100 sectors starting at sector 0 with the mixed string specified, but allow editing of that string first wipe wipe entire vol/disk/partition with default pattern of zeroes dfsdos part d#wipe#q From the DOS command line, select partition D: and wipe it completely using the default pattern dfsdos disk 1#wipe "'ff'"#q or: dfsdos disk 1#wipe -h:"ff"#q From the DOS command line, select physical disk 1 and wipe it completely using hexadecimal pattern 0xff dfs disk 2#wipe "DFS was here" 0 1#q or: dfs disk 2#wipe -a:"DFS was here" -s:1#q From the OS/2 command line, select physical disk 2 and wipe the master-boot record with the string "DFS was here" _______________________________________________________________________________ #950 WIPEFREE command WIPEFREE [part] = Wipe freespace in a filesystem to all zeroes (wipe -f) Purpose: Wipe all freespace inside the filesystem to ZERO Parameters: part optional partition, number or letter Options: -i:img Image filename -O:v Verbose, extra progress info -O:q or -O- Minimal progress reporting (no dots), just start and end signal with throughput and # of sectors done. -p:part Partition, number or letter -test No wipe, just show 'what if' ... -v:vol Volume, driveletter Remarks: Only one of -p, -v or -i can be specified at one time Use 'wipe -f' directly for more options Wiping FREESPACE is NOT recoverable, the data or garbage that is there will be permanently lost. This will make later UNDELETE or other data recovery impossible. When in doubt make a backup first The filesystem should be CLEAN, so run a chkdsk before using this. Also, it is NOT SAFE to wipe freespace in a filesystem that is in use meaning there are open files (your system/boot partition for example) Try to run the wipe while booted from another disk or diskette Freespace wipe can be useful to improve security. Unused space will not contain sensible information anymore Using the default pattern of all ZEROES will optimize the filesystem for compression environments, for example when used within VirtualPC as a compressed filesystem. Note: 'zerofree' is an alias, for backward compatibility only Example: wipefree -p:03 ;wipe freespace in part 3 to zero _______________________________________________________________________________ #960 WIPELST command WIPELST [sel][p] = Wipe [sel]ected sectors in list with [p]attern Purpose: Wipe sectors in the (delete) list with a pattern This makes deleted files INVISIBLE for future undelete commands Parameters: sel optional File selection parameters, in the form: wildcard%threshold (sometimes shown as [w%t] in usage) wildcard = wildcard selection for display/recover threshold = +nn = Minimum allocation OK percentage or -nn = Maximum allocation OK percentage default: *%-100 ==> all except 100% ones p optional The pattern to use for wiping, it can be any length up to 256 bytes default: All zeroes Options: -a:'asc' ASCII wipe-pattern value, string -h:'hex' HEX wipe-pattern value, sequence of hex pairs -m:'mix' Mixed ASCII/HEX/UNICODE wipe-pattern -u:'uni' UNICODE wipe-pattern value, string Output: Progress is reported with one line per file (file-info list), or a single dot per sector when selection overruled with '!' Remarks: '!' as first parameter will overrule the normal file-display and validation, and wipe EACH SECTOR in the list. Wiping file-list sectors (from delfind), is intended to clean the disk from obsolete file-info (Fnodes), making 'delfind' return less deleted files the next time. The files wiped CAN NEVER BE UNDELETED ANYMORE! See also "wipe" and "delshow" command Wiping sectors from the list using '!' can also be useful for rewriting bad sectors that have been found using the SCAN command. In some cases this makes them readable again. Specifying the 'p' parameter is mutually exclusive with using any of the '-a', '-h' or '-u' options. When these options are specified their value is used as default in a prompt dialog. _______________________________________________________________________________ #970 WIPESECURE command WIPESECURE [-f] = Wipe disk/vol/part area in a SECURE way (DoD spec, slow!) Purpose: Wipe ALL (or freespace) sectors multiple times, with verify, as specified by the US military DoD 5220.22 and NIST SP800-88 specifications making recovery of data impossible Parameters: none Options: -f Freespace area wipe only, this allows a periodic wipe of freespace to avoid any undelete or data recovery of deleted files without affecting the normal file-data in the filesystem. Output: Progress is reported from 0..100% for each of the three passes Remarks: This operation can be VERY SLOW due to the multiple passes. If you want to secure wipe a complete large ATA disk (> 15GB) it will most likely have an internal 'Secure Erase' command. Currently that is NOT used by DFSee, but there is a free DOS based utility available from the University of California. It is upto a hundred times faster and also erases any normally inaccessible areas like HPA and bad-sector replacement sectors. You can download this from: http://cmrr.ucsd.edu/hughes/SecureErase.html _______________________________________________________________________________ #980 WRITE command WRITE [ . | sn ] = Write sector back to current or specified sector number Purpose: Update a sector on the disk, possible after editing it Parameters: sn optional sector number specification (LSN) '.' or 'this' is the current sector Options: -a:sn sector number to write the data to, if no value is specified, you will be prompted for one Output: none Remarks: Only one sector (512 bytes) will be written. Writing back changed data to the disk can cause BIG TROUBLE when you don't know EXACTLY what you are doing. Use it with extreme care (and maintain backups if possible :-) The WRITE command is executed automatically by the EDIT command, unless you use the '-w-' option on EDIT. _______________________________________________________________________________ #990 x command x [sector type] = Display 'xtra' sector as Hex or specified sector type Purpose: Display current sector in any specified or default format Parameters: type optional Specifies display format as: a = ASCII h = HEX any = any valid sector type (use ??? cmd) none = default (based on sector contents) Output: Sector display in requested format Remarks: _______________________________________________________________________________ ----------------------------[ www.dfsee.com ]-------------------------------