DFSee version 17.0 2022-10-22 (c) 1994-2022: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Overview = a list of all documents Introduction = what is DFSee ? Operating mode = short description of how to handle dfsee commands User Interface = how to operate the DFSee program, TxWindows description Availability = where can I get more information License = how to register dfsee Limitations = known limitations or bugs of dfsee Improvements = improvements under consideration Acknowledgements = credits to some contributors to the DFSee program _______________________________________________________________________________ O V E R V I E W: _______________________________________________________________________________ DFSee is a rather complex program with dozens of commands that could be used. You will need some time and effort to master that complexity. All commands and some generic topics are covered in DFSmode.txt files: - DFSEE.TXT = This document: overview, introduction, bugs, wish list - DFSINST.TXT = short installation description - DFSPROMO.TXT = A short promotional text on DFSee and its concepts - DFSHOWTO.TXT = An ever growing collection of recovery scenarios and other useful DFSee usage examples - DFSTERMS.TXT = A terminology reference about DFSee and partitioning - DFSCMDS.TXT = The main command reference with all generic commands - DFSFDISK.TXT = The FDISK (partitioning) command reference - DFSHPFS.TXT = Command reference specific to the HPFS filesystem - DFSNTFS.TXT = Command reference specific to the NTFS filesystem - DFSFAT.TXT = Command reference specific to the FAT filesystems - DFSEFAT.TXT = Command reference specific to the EFAT filesystems - DFSJFS.TXT = Command reference specific to the JFS filesystem - DFSXFS.TXT = Command reference specific to the XFS filesystem - DFSHFS.TXT = Command reference specific to the HFS filesystem - DFSAPFS.TXT = Command reference specific to the APFS filesystem - DFSEXT.TXT = Command reference specific to the EXT2 and EXT3 filesystem - DFSRSR.TXT = Command reference specific to the REISER filesystem - DFSCRIPT.TXT = Reference for using command scripts with DFSee - DFSHIST.TXT = History of changes for DFSee - DFSYNTAX.TXT = Syntax rules for DFSee command, parameters and options - DFSDISK.TXT = Description and examples of the DFSee UNFDISK procedure _______________________________________________________________________________ I N T R O D U C T I O N: _______________________________________________________________________________ What is DFSee ? Display File Systems (DFSee) is a generic partition and filesystem browser/analyser. DFSee supports partition tables (FDISK, LVM), (V)FAT, FAT-32, HPFS, NTFS and JFS-structures, some EXT2/3 and ReiserFS stuff and it might support different file-systems like XFS and HFS+ in the future. DFSee, starting with version 4.00 is NOT freeware anymore, requiring registration and payment for actual use and support. Several license models are available, starting with an affordable single user individual registration (see 'buynow' for actual prices) DFSee can be used in one of several ways: - As a replacement for the classic FDISK program DFSee is a complete replacement for the partitioning tools as found with DOS, OS/2, Win9x, Windows-NT and Windows-XP/7/8/10 Apart from the standard create/delete type of functions there are a lot of special commands to display information and fix all kinds of problems related to partition tables and LVM information. An often used function here is the DFSDISK script that automates the collection of needed information to 'UNDO' an accidental FDISK operation or other partitioning related disaster. Another important feature is the ability to save and restore ALL partitioning information in a regular file that you can keep as a backup on a diskette so recovery operations will be MUCH easier (see PSAVE and PRESTORE commands and corresponding menu items). Finally, this FDISK capability is being used by large organizations for automatic (and unattended) roll-out scenarios. - As a tool to 'UNDELETE' files that have been accidentally deleted, or to recover/copy files from damaged or inaccessible filesystems This feature is implemented for HPFS, NTFS and JFS only, but on those filesystems it is a very powerful tool. It works by finding all wanted files (DELFIND or FILEFIND), and then letting the user make a selection based on a wildcard file specification and an outlook percentage for recoverability (DELSHOW or list +f). The actual recovery operation will copy the matching files to a specified directory, if possible on another disk (RECOVER). For FAT similar functions exist, but these are less powerful. - As an analysis and recovery tool for most used filesystems. This includes boot sectors, superblocks and low-level directory structures. For most supported filesystems some specific commands are available that fix common problems with that filesystem. To support a large number of possible filesystems, DFSee uses specific modes of operation. Every mode has its own set of dedicated commands and recognized data formats (sector types). Generic commands (and sector types) are available in all modes. On selecting a data source (disk, partition, volume) DFSee will try to recognize the involved filesystem and activate support for it automatically. The most important modes are: - FDISK for partitioning work, default active at startup - HPFS native filesystem on OS/2, eComStation, WSeB ... - FAT classic PC filesystems including FAT32 and VFAT - EFAT large capacity, and removable-media extended-FAT - NTFS native filesystem on Windows-NT/2000 or Windows-XP - HFS journaled filesystem on macOS - JFS journaled filesystem on OS/2 MCPs, eCS or WSeB - EXTn most used journaled filesystem on Linux - Reiser alternative journaled filesystem on Linux - AUX Auxiliary mode for unrecognized data - As a simple but powerful binary (or HEX) display and edit tool. DFSee can access data on hard-disks, or operating system volumes like diskettes or CDROM and (image) files. _______________________________________________________________________________ U S E R I N T E R F A C E: _______________________________________________________________________________ The user interface can use either a menu-system to select the functions to be performed, or a a command entry-field with a history buffer so previous commands can be recalled. You switch between them using the function key. Some of the functions may use the windowed UI to get additional information and almost all will use the large text window for output. Output can also be copied to a file for later analysis. When using the menu system, remember to use the key to get a more verbose description of the highlighted item. This serves as a context sensitive help system, great to learn the capabilities of DFSee! Much of the appearance can be adjusted somewhat for maximum readability and personal preference. Checkout the '-scheme', '-color' and '-style' switches for startup, and the corresponding menu items to set these in the 'Edit -> Settings & Properties' menu. An even more primitive 'classic' user interface can be used as well, by starting the program with a switch '-w-' (see DFSCMDS for details) DFSee commands are single words or (hexadecimal) numbers. Most commands have one or more parameters of which some are optional. DFSee keeps track of the current LSN and some other useful LSNs so they can be referenced faster, without having to type them in. They are: Name Cmd Description Shortcut key ---- --- ----------- ------------ up 'u' up in hierarchy (Ctrl + U) down 'd' down in hierarchy (Ctrl + N) down down in hierarchy this 't' this (current) (Ctrl + T) xtra 'x' Extra, alternative (Ctrl + X) You can display and analyse either a physical disk, a partition, a volume or an imagefile. A physical disk can be opened using the 'disk' command. A disk-partition or volume can be opened first with the 'part' or 'vol' commands respectively. The next prompt display will show some status info. After opening an HPFS partition, using 'Enter' a few times will take you to the superblock, root directory, possible sub-directories up to some file. Multiple commands can be chained if separated with a special character, the default is '#' but this can be changed with the '-s:xxx' switch. An overview of the available commands is given in DFSCMDS.TXT, and can also be referenced from within the program using the 'help' command. HINT: When using DFSee to create a logfile, DO NOT USE ">" REDIRECTION, use the DFSee "log filename" command or the "-f" program switch instead. This will prevent littering the logfile with ANSI control codes. When browsing an LVM (WSeB, MCP or eComStation) system, set the screen width to over 100 characters when possible. This will allow complete display of the volume + partition names in the 'part' table T X W I N D O W S D e s c r i p t i o n ----------------------------------------- DFSee uses a windowing system a bit like the operating system GUIs as MS-Windows, OS/2 or the Mac. Unlike these GRAPHICAL interfaces, TxWindows is based on text mode displays only. This allows usage in simple systems and even from (DOS or OS/2) boot diskettes. The screen for a TxWindows application always uses a DESKTOP window as background, other windows displayed will always be on top of it. Most applications use a large scrolling 'text output window' that receives output lines from the application which is scrolled up when the screen fills up. This output window is usually very large and older output can be viewed using navigation keys like PgUp/PgDn User input is either in the form of COMMANDS that are entered in an input field usually near the bottom of the screen, or in the form of so called DIALOG windows that may have fields, buttons and so on ... A special form of dialog is the MENU BAR, it can be activated using the F10 function key, and supports selection of menu actions from several pulldown menus. You can get specific help on each item in the menu by pressing the F1 functionkey while the item is selected. The following keys are the most important ones to control TxWindows: Tab / Backtab Move to the next or previous selectable window, like between the input-field and scroll buffer, or between the control windows in an input dialog. Esc End or abort the current dialog, often equivalent to CANCELING it. Many applications also use the Esc-key to abort long-running commands like searching. Enter End current input dialog, making the entered value(s) available to the application for processing. Arrow-keys Navigate within an inputfield, scroll text lines in a text window like help or move to the next or previous control window in a dialog (buttons, fields ...) PgUp / PgDn Scroll text lines in a window one page at a time Home / End Move to begin/end of an inputfield, or output text Ctrl-Home/End Move to first/last line of a text output window Ctrl + Arrow Scroll the text in the 'text output window' in the direction of the arrow. In an inputfield the Ctrl-left and right arrow will move the cursor over one word. Ctrl PgUp/Dn Scroll the 'text output window' up or down by one page. Note: 'text output window' movement even works from OTHER windows! F1 Get help on the current window, inputfield, button ... A second F1 will give more generic help, like on the complete dialog, and a third will present the help on the TxWindows system (this text). Note: If the key triggers another (OS or desktop) function, like on Linux Gnome, use + F3 Usually end the current dialog, canceling input, or end the application itself when on the command line F4 End the current dialog, ACCEPTING the input (like an [ OK ] button) F10 Toggle the main-menu ON or OFF Alt + F5 Restore resized, minimized or maximized window to its previous size. (initial, or just before min/maximize) Alt + F10 Maximize the current window to the size of it's parent client window (usually 'text output window' or desktop) Alt + F9 Minimize the current window to just its title bar, or F12 make it completely invisible when no title bar present. This allows you to look under or behind the window. When the main inputfield is active, the whole DESKTOP will be minimized revealing the previous screen. Alt + F12 Cycle through available 'text output window' colors: NORMAL: White on black background, use all FG colors BRIGHT: White on black background, bright colors only INVERT: Black on white background, no bright colors Select the scheme with best readability Ctrl + r Repaint ALL windows on the desktop, can be useful in very rare cases to correct screen painting problems. Alt + c Change appearance of the user interface using: - Arrow-key UP/DOWN: overall window color scheme - Arrow-key LEFT/RIGHT: 'text output window' colors - Page Up / Page Down: windowing line-style scheme Alt + m Move or Resize the currently displayed window: - Arrow-keys: Move or Resize the window - Insert-key: Switch between Move and Resize Alt + / Cycle through available TRACE settings: OFF, TITLEBAR or SCREEN/LOGFILE (depending on other trace settings). Other available (function) keys might be displayed in the bottom line for a dialog window. Note that some of the keys mentioned above might not work when the command line entry field is active. For entryfields the following editing keys are available: Insert Toggle between Insert and replace mode Delete Delete the character at the cursor position Backspace Delete the character before the cursor position Home Move cursor to the start of the entryfield End Move cursor to the end of the entryfield Ctrl + Backspace Clear entry-field completely, making it empty Ctrl + B Clear entry-field from cursor to beginning of field Ctrl + E Clear entry-field from cursor to end of field Ctrl + Right Arrow Move one word to the right in the field Ctrl + Left Arrow Move one word to the left in the field When the field supports a history buffer (like a command field would): Ctrl + D Delete current line from history, if full match Ctrl + K Add current line to the history, no execute Up [prefix] Recall previous (older) command from history Down [prefix] Recall next (newer) command from history F11 [prefix] Show history contents in a selection popup list On each of these, the prefix is the part of the commandline BEFORE the cursor that will be used to FILTER the result of the requested action Other keys are either inserted/replaced in the entryfield content, like letters, digits and punctuation, or simply ignored Completion: All characters in the entryfield upto the cursor are used in the partial match. Use Alt + up/down to walk through commands starting with the same characters _______________________________________________________________________________ O P E R A T I N G M O D E: _______________________________________________________________________________ An important concept is the "operating mode". When you startup DFSee normally, it will be in "FDISK" mode and knows all about fdisk-related stuff and has fdisk-related commands available. All the other modes relate to specific filesystems, and are normally activated automatically upon selecting a partition or volume to work with. The mode is always displayd at the status-line near the bottom of the screen, together with other relevant details about which disk or partition you are currently working on. When using the menu, you can also find it as the 'Mode=xxxx' menu. You can get a brief list of the available commands in any mode by using the "?" command (a single question mark) as a command, or use the 'Help -> FS-specific commands' menu item. There are also a lot of commands that are independent of the mode and could be called "generic". You can get a brief list of those by using the "??" command (TWO question marks) or by using the corresponding 'Help -> Application commands' menu item. More help can be found in the .txt files, with most of the "generic" commands in DFSCMDS.TXT. The commands are in alphabetical order there, but to find things you could use a "search" function from the text editor or viewing program you use ... The commands specific to a mode are in DFSmode.TXT, so for the FDISK mode they are in DFSFDISK.TXT and for HPFS they are in DFSHPFS.TXT. Some hints and tips are in DFSHOWTO.TXT ... The mode is set automatically when you start DFSee, and when you select some object like a disk or a partition to work with. Selecting something to work on is done with the DISK, PART, VOL or IM commands, or with the corresponding menu items, like 'File -> Open Partition to work with' If automatic selection of the mode fails (because the object is damaged), you can force a specific/desired mode by using the FS command, as in: FS HPFS Which will force the HPFS mode to become active. _______________________________________________________________________________ A V A I L A B I L I T Y: _______________________________________________________________________________ 1) Home: https://www.dfsee.com 2) Download: https://www.dfsee.com/dfsee/download.php 3) Registration: https://www.dfsee.com/dfsee/buynow.php _______________________________________________________________________________ L I C E N C E: _______________________________________________________________________________ This version of the program is SHAREWARE, it is NOT FREE! However, evaluation of the program is allowed for a limited time. Any real use or getting support requires a one-off registration: - Standard reg: For use by ONE person on their own personal computer(s). (no commercial use) - Professional reg: For use by ONE person on your own and your customers systems. (commercial use allowed) For details on the license agreements see: https://www.dfsee.com/dfsee/buynow Without registration almost all functions are fully operational. You WILL get some registration reminders and the trial time is limited to a few months from release date. Further development depends on my own needs and feedback I receive from users, and the amount of registrations getting in over time ... Suggestions and other comments regarding DFSee and filesystems are welcome. If you have a disk-related problem, feel free to contact me. I cannot guarantee prompt or continuous attention but I will do the best I can ... You can reach me through the Internet: support@dfsee.com Just send plain text emails there, any HTML email will be automaticaly discarded as SPAM ... NOTE: Version 3.42 was the last 3.xx version and is now FREEWARE Development of the 3.xx version was stopped so new functionality and a better user interface will now only be in the SHAREWARE version. Version 4.28 was the last 4.xx version. Version 5.00 with a new 32-bit DOS-extender version was released early august 2002 and has been updated frequently until december 2003 when version 5.56 was released. Version 6.00 with the menu-system was released january 2004, and the last free update to that, 6.17 was released in december 2004. Version 7.00 with the many functional and UI improvements was released february 2005, and the last free update to that, 7.15 in december 2005. Version 8.00 with UI enhancements and full JFS support was released end of march 2006, and the last free update to that, 8.17 in september 2007. Version 9.00 with geometry sniffing and many Linux related stuff was released in August 2007. It was updated throughout 2008 and 2009 until the last free 9.xx upgrade that came with 9.15 in march 2009. Version 10.0 with some enhancements for partition-table recovery and various other smaller improvements and bug-fixes was released in August 2009. Further improvements will aim at better and more intelligent partition recovery as well as file recovery from damaged filesystems. There will be a major release, requiring a payed upgrade every one or two years, with free upgrades in between. _______________________________________________________________________________ L I M I T A T I O N S A N D B U G S: _______________________________________________________________________________ - EXPAND/RESIZE command on NTFS and HPFS, and RESIZE on FAT works, but is not very useful when the partitions have scattered data all over the volume. - Allocation integrity checks on HPFS do not check the allocation for EAs _______________________________________________________________________________ C O N S I D E R E D I M P R O V E M E N T S: _______________________________________________________________________________ Rewrite of this documentation in a description, command reference and technical info on filesystems (possibly in HTML and/or PDF) More coverage of other filesystems like XFS and HFS+ ... MAC OS X version, port finished, but not much specific MAC functionality. _______________________________________________________________________________ O N L I N E H E L P: _______________________________________________________________________________ As a command line program, DFSee has limited online help, useful to check the syntax and parameters. The following is available: MENU help : The menu introduced with version 5.52 offers a lot of extra help for the end user. First there is a specific 'help' menu leading to generic help, but more important, EVERY item on the menu has its own context sensitive help to be called with the key 'help' command : This will display a short introduction and a few important selection commands. '??' command : List all generic commands, available in every mode '?' command : List all commands specific to the current mode '???' command : List sector types recognized in the current mode key : Popup window with some help about the user interface. When used in dialogs (LVM, PTEdit) it will be help on the whole dialog or specific fields in it. DFSxxx -? : List available switches for the DFSee executable from the operating system command line. The switches set some preferences and options like windowing, using a logfile and batch mode. (.EXE can be DFSOS2.EXE, DFSDOS.EXE or DFSWIN.EXE) Most commands that require parameters will also display a short usage and help when called without any parameters, or sometimes when called with the parameter '-?' Finally, whenever a (confirmation) dialog window is presented to ask a question or get other input, you can use the function-key to get additional help on that specific dialog or question. _______________________________________________________________________________ A C K N O W L E D G E M E N T S A N D C R E D I T S: _______________________________________________________________________________ There are several people besides myself that have contributed valuable work to the DFSee program either by testing, requesting specific functionality or writing and improving the documentation. There are too many to mention them all, but special thanks goes to: Iain Allen For numerous bug/feature reports and troubleshooting help Mike O'Connor For the checking and updating all the documentation Steven Levine For many tips, bug reports and feature discussions Felix Miata For testing several features and for critical opinions Jochen Schnuerle For extensive LVM testing and some German translations Erik P. Olsen For enhancing the Linux shell-scripts Gil Dabah For the x86 disassembly engine diStorm (Rage Storm) ----------------------------[ www.dfsee.com ]-------------------------------