DFSee version 17.0 2022-10-22 (c) 1994-2022: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Command reference = overview FAT specific commands Detailed description = description for every command Note: All generic commands can be found in DFSCMDS.TXT, for example: ALLOC, CHECK, CLONE, RESIZE, RECOVER, SAVETO, SCAN, WIPE _______________________________________________________________________________ C O M M A N D R E F E R E N C E: _______________________________________________________________________________ FAT specific commands Active filesystem : FAT, specific commands are: \[path-spec] = find and show ROOT or file/directory relative to root BOOTINI [part] = Find the (first) BOOT.INI file present in the filesystem BSCLEAR = Reset bad-sector/cluster administration to ZERO bad sectors DELFIND [name] = Find deleted files with DIR-entry containing (partial) name CHECK [drive] = Check filesystem integrity for drive-letter (CHKDSK) FATSET cl|.NNNN = Set FAT-allocation chain for cluster/size or .NNNN list item FATSHOW [*|nr] = Display contents of the FAT from memory, [nr]= # of entries FATSELECT [f] = Select FAT area to be used (cached), f = 1 or 2; default is 1 FATSYNC [f] = Synchronize FAT-areas from 'f' to other, default is from 1 to 2 FATSIM img [f] = Save FAT table contents for FAT 'f' (1 or 2) to an imagefile FATWRIM img [f] = Restore an imagefile with the FAT table to FAT 'f' (1 or 2) FILEFIND [name] = Find normal files with DIR-entry containing (partial) name FINDROOT = Find and list possible FAT32 root directory clusters/sectors FIXBOOT [os|2] = Fix FAT(32) bootsector from P-tables or spares for OS 'os' FORMAT [opts] = Format current object with a FAT12/16 or FAT32 filesystem NOBADS = Reset bad-sector/cluster administration to ZERO bad sectors SETROOT [s|.nn] = Set FAT32 root directory LSN to sector [s] or listvalue [.nn] SPACE [clust] = Show allocation for specified cluster or current LSN 'this' SUBFIND [opt] = Find subdirectories (.. entry) from start or current lsn For an up-to-date list of commands, use the '?' command FAT specific sector types (see ??? command) '1' = First FAT area '2' = Second FAT area '3' = Start 12-Bits FAT '4' = Start 16-Bits FAT '8' = Start 32-Bits FAT '\' = Root directory 'd' = Sub directory 'D' = Directory data 'I' = File data 'X' = Bad sector area _______________________________________________________________________________ D E T A I L E D D E S C R I P T I O N: _______________________________________________________________________________ \path-spec = find and show file/directory relative to root (FINDPATH) Purpose: Locate and display the DIR entry for given file/dir full path Parameters: none Output: The chain of directory-sectors+index upto the found DIR-entry followed by the display of the Dir-entry, or an error message when a path component was not found. Remarks: Synonym for the FINDPATH generic command, where path-spec is a separate parameter to the command _______________________________________________________________________________ BOOTINI [part] = Find the (first) BOOT.INI file present in the filesystem Purpose: Display, and optionally FIX the Windows BOOT.INI file Parameters: part optional partition number to be used for the current partition in the 'default=' line in the BOOT.INI file. Specify '*' to use the value as calculated by DFSee ... Options: -c Work on the CURRENT sector, do not search the file -2 Try to update the 2nd line with same ARC path too. (making the change complete in almost all cases) Remarks: When found, some info of the file will be displayed, and the line containing the DEFAULT partition to be booted will be displayed including the 'partition(W)' partition index. It should look like: default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS Below that line, the partition index calculated by DFSee is shown. This is based on the assumption you want to boot to an installed Windows-NT/W2K/XP in THIS SAME partition! For booting to other partitions with Windows installed, use the value shown in the 'BI' column that is included in the 'part -s' display. Incorrect values for the default partition index will lead to boot failures with messages like: Windows could not start because the following file is missing or corrupt: Windows\system32\Hal.dll The specified or calculated value will be substituted for the partition index in the default line. Of course you need to reboot to test if this fix worked ... Note: When the '-2' option is not specified, or when updating the second line with the same numbers has failed for some reason, this is not a full 'REPAIR' of your BOOT.INI, but the minimum update to allow booting Windows again! You need to properly edit BOOT.INI once Windows is running again, or use the 'bootcfg /rebuild' command from the recovery console that can be started from regular Windows installation CDs. When there is damage to the BOOT.INI file beyond an incorrect partition index, fixing it this way might not be possible. _______________________________________________________________________________ BSCLEAR = Bad Sector Clear, set number of bad sectors/clusters to ZERO Purpose: Reset all clusters marked as BAD to represent FREE so the FAT contains NO bad clusters anymore. Parameters: none Output: Message when cleared, or already empty Remarks: In older DFSee versions, this command was called 'nobads' To determine in what files/directories (if any) the current bad sectors are used use the following commands: list -f ;shows path for meta info like Fnodes list -f:i ;shows path for actual file data blocks _______________________________________________________________________________ CHECK [drive] = Check filesystem integrity for drive-letter (CHKDSK) Purpose: Perform a filesystem check, and report the errors found Parameters: drive PID or driveletter for partition to check. When not specified, the CURRENT object is checked. Options: -r Force refresh of the Sector Lookup Table (SLT) even if one exists already Output: Two lines for each sector in error that is found, the first lists the sector number, where it is referenced from and a short description. The second line is an error description. For FAT the reported errors are: 0x000001 Linked to some structure, but not in allocation-map 0x000002 Allocated in allocation-map, but no known link 0x000004 Allocation chain ends in a free cluster 0x000008 Allocation chain ends in a cluster with bad sectors 0x000010 Cluster value is invalid for current volume 0x000020 Cluster chain is too long for specified item 0x800000 The filesystem is marked DIRTY (open files) this may cause bogus errors to be displayed! Remarks: Some of the errors are generic, but most are filesystem specific. The generic ones are also listed with the 'SLT' command in dfscmds.txt. _______________________________________________________________________________ CL = Translate and display 'this' LSN as a cluster number Purpose: Find out what cluster number corresponds to current LSN Parameters: none Output: The cluster number, or an error message when invalid _______________________________________________________________________________ CL clust [cmd] = Translate specified cluster number to LSN, display with cmd Purpose: Display data using a cluster number instead of an LSN Parameters: clust mandatory The cluster number of interest cmd optional DFS generic command to execute with clust as its first and only parameter (like 'H') Output: The output for the cmd. When no explicit cmd is specified this will be the DFS default for the corresponding LSN, usually a display of that sector(s) in an appropriate format. _______________________________________________________________________________ DELFIND [name] = Find deleted files with DIR-entry containing (partial) name Purpose: Find deleted files, with name starting at current LSN Parameters: name optional part of filename wanted, no wildcard Options: -c Start find from current sector instead of start -d- Search outside EXISTING directories too (SLOW!) -v Verbose search, list files while found (SLOW!) Output: Find-result list Remarks: All deleted files and directory entries where the name starts with 0xe5 = 'å', will be found and added to the list. There is NO RECOVERY possible yet for deleted files, although the SAVETO and RECOVER commands will work, the resulting files will be CORRUPT due to missing allocation information for deleted files on FAT (except for small files, upto 1 cluster) List can be manipulated as usual, best viewed with "list -f" By default, only DIR areas are searched, which is at least a hundred times faster as searching the whole filesystem. Note: SLT will be built automatically when not present yet, to allow display of full path and filename _______________________________________________________________________________ FATSELECT [fat]= Select fat to be used (cached), fat = 1 or 2; default is 1 Purpose: Update the in-memory FAT from the specified FAT from disk Parameters: fat optional Number of the FAT, either 1 or 2 Output: none Remarks: FAT12, FAT16 and FAT32 formats are supported _______________________________________________________________________________ FATSET cl|.NNNN = Set FAT-allocation chain for cluster/size or .NNNN list item Purpose: Set the FAT-entries for a CONTIGUOUS file in both FAT-areas, based on the starting cluster and size, supplied directly or as a .NNNN reference in the sector list (with FAT directory data, most likely) It will write the required number of FAT-entries (depending on size) into the FAT, each cluster pointing to the next in-sequence, and the last one with the special 'End-Of-File' FAT value. Parameters: cluster hex cluster number, 1st cluster used by file/dir .NNNNN sector list index, to get the LSN+entry value to retrieve the 1st cluster and size from DIR-entry (Subdirectories and empty files are ignored!) -size:filesize filesize in bytes, decimal, default one cluster and needed with an explicit cluster value only. -v- Non-verbose operation, process silently Remarks: This command is intended as one of the required steps needed to make one or more files visible and accessible again, like after an accidental FORMAT of a camera SD-card (aka 'UNFORMAT') Apart from this function, that needs to be executed against EVERY file and directory, you need to FIND the original cluster(s) with directory information, and recreate/re-link that to a still existing directory (like the root, or DCIM subdirectory) You need a non-ZERO size to mark clusters in-use so empty files and directories will be ignored when iterating over sector list .NNNN entries. The command can be executed from the DFSee file/dir BROWSER by selecting one or more files, and using the popup-menu item: Execute command with .NNNN list ref It will use the information in the directory entry represented by each item in the list, to correctly set its FAT chain. Note 1: An alternative to attempting a full UNFORMAT would be to locate the cluster(s) with directory info (listing the contents) and then use =BROWSE to show tehm, and allow the files to be copied/recovered to ANOTHER drive. The FAT file copy/recover functonality supports copying CONTIGUOUS files, where all the FAT entries have been reset to the 'unused/free' value 0. After copying the needed files, the media can then be formatted to make it usable again. Note 2: Both methods described above will ONLY work reliable for FAT media where all files are written sequentially, so the clusters for any file are CONTIGUOUS (not fragmented) on the media, and the existing (empty) formatting uses the SAME layout as the one used when writing the files to be recovered. This will normally be the case when the medium (like an SD-card) are always formatted on the SAME device (like your camera) and the files are ever only WRITTEN to it, and NEVER DELETED, since deleting files and then write more, will cause fragmentation ... _______________________________________________________________________________ FATSHOW [*|nr] = Display contents of the FAT from memory, [nr] entries Purpose: List all FAT-entries separately for analysis Parameters: nr optional Number of FAT-entries to show. * = all entries, default is 160. Output: A list of FAT-entries with 8 values in each line, and values are shown as such. Remarks: A graphical display of the FAT can be made using 'ALLOC' _______________________________________________________________________________ FATSYNC [f] = Synchronize FAT-areas from 'f' to other, default is from 1 to 2 Purpose: Make sure both FAT-areas are identical (after a crash etc) Parameters: f optional Number of the source FAT, 1 or 2 (default 1) Output: Progress and a message indicating success or failure Notes: The contents of the selected FAT is read sector by sector then written to the other FAT area, to make them identical\ You may determine which area (1 or 2) to copy by selecting each one with FATSELECT, then run a CHECK command to find inconsistensies compared to the directory structure info _______________________________________________________________________________ FATSIM img [f] = Save FAT table contents for FAT 'f' (1 or 2) to an imagefile Purpose: Save the complete file allocation table (FAT) to an imagefile Parameters: img mandatory Name of the imagefile to create f optional Number of the FAT, 1 or 2 (default 1) Options: -z Enable LZW compression on the image-file Output: Message indicating success or failure _______________________________________________________________________________ FATWRIM img f = Restore an imagefile with the FAT table to FAT 'f' (1 or 2) Purpose: Restore the complete file allocation table from an imagefile Parameters: img mandatory Name of the imagefile to restore f optional Number of the FAT, 1 or 2 (default 2) Output: Message indicating success or failure Remarks: When used to synchronize FAT areas after a detected problem, use a FATSIM command (usually from FAT-1) to an imagefile, directly followed by a FATWRIM command to the other FAT area. This is a potentially dangerous operation, also usually both FATs on the disk need to be in-sync, 2 FATWRIMs may be needed. The used imagefile should have the right size, and preferably be created with the FATSIM cmd from the same (size) partition To synchronize FAT areas, after a 'not in sync' error message, make sure to do a FATWRIM to the OTHER area as the FATSIM! For example, sync using the following two commands: fatsim myfat 1 fatwrim myfat 2 (the defaults will do the same, if there are two FAT areas) Notes: Instead of this (using an intermediate imagefile) you may use the FATSYNC command, which does a direct copy _______________________________________________________________________________ FILEFIND [name] = Find normal files with DIR-entry containing (partial) name Purpose: Find one or more directory entries for specified filename Parameters: name optional Filename, or part of the name to find this is not a true wildcard, but can be any part of the 11-character 8.3 name. When you specify '*.xxx' or '*.y*' it will search for files with extension 'xxx' or 'y*' respectively. Options: -c Start find from current sector instead of start -D search directories only, not files -d- Search outside EXISTING directories too (SLOW!) -v Verbose search, list files while found (SLOW!) Output: Find progress and result Remarks: The result is a list of sector numbers of directory entries. A 'list -f' will list them, showing the sector number for the directories and the index for the entry in that sector. You can select a single file from the list using the .NNNN syntax, and use the "saveto" command to recover that file. List can be manipulated as usual, best viewed with "list -f" The 'recover' command can be used to recover multiple files. By default, only DIR areas are searched, which is at least a hundred times faster as searching the whole filesystem. Note: SLT will be built automatically when not present yet, to allow display of full path and filename _______________________________________________________________________________ FINDROOT = Find and list possible FAT32 root directory clusters/sectors Purpose: Find possible root directory clusters/sectors when the FAT32 root directory reference in the bootsector is missing or damaged. Parameters: none Output: One line for each possible root directory cluster/sector Remarks: All found sectors will be put in the Sectorlist as well, and can be saved for later use with the 'export' command. The 'list +f' command can be used to display them, and individual ones can be displayed from the Sectorlist by selecting them with .NNNNN command. Note: this might reuse the Sectorlist for the directory shown, so make sure you have saved the original one to be restored with 'import'. _______________________________________________________________________________ FIXBOOT [os|2] = Fix FAT(32) bootsector from P-tables or spares for OS 'os' Purpose: Fix corrupted bootsector for a FAT or FAT32 partition Parameters: os | 2 optional 2 = specify 1 or 2 sector spare copy, FAT32 or x = Code for desired operating system to boot I or P PCDOS with IBMBIO/IBMDOS.COM M MSDOS with IO/MSDOS.SYS O OS/2 with OS2BOOT V OS/2 with OS2LDR, Veit Kannegieser N Win-NT with NTLDR (FAT16) W Win-9x with IO/MSDOS.SYS (FAT16) 9 Win-9x with WINBOOT.SYS (FAT32) The default is 'M' for MSDOS. OS is only relevant for FAT partitions that need to be bootable. Options: -s optional Force a copy of the SPARE bootsector (FAT32) Output: Progress and confirmation info Remarks: For any of the filesystems (FAT, HPFS, NTFS, JFS) check the corresponding DFSxxx.TXT documentation file for 'FIXBOOT'. For FAT32 with a damaged bootsector this will try to copy a spare bootsector, either a single one when no parameter, or both sectors when the parameter '2' is specified. If the bootsector at sector 0 is damaged, you can force copying the SPARE sector by using the '-s' option. Otherwise a valid bootsector will be created based on above mentioned bootsector code and size info from the partition table and locations of the FAT areas and Root directory. The 'V' type will create an OS/2 bootsector that directly loads the OS2LDR (skipping OS2BOOT) and was kindly made available by Veit Kannegieser. It may be used to create a removable device (like an USB stick) booting OS2. The partition table info (type and size) must still be valid, or valid FATs and Root directory must be present, or both. OS '9' will be forced when there is a 2nd bootsector with a valid FAT32 signature (and freespace info). _______________________________________________________________________________ FORMAT [opts] = Format current object with a FAT12/16 or FAT32 filesystem Purpose: Format a partition or volume with an empty FAT filesystem Options: -a:offset = Sector offset for first FAT area from bootsector -b[:bufs] = Buffersize for wipe FAT area, -b will use 1-track -c:spc = Clustersize in 512 byte units: power of 2, 1 .. 64 -f:bits = Number of bits used for FAT entries: 12, 16 or 32 -l = Long format, clear all data-area sectors to ZERO -o:letter = Operating system identification letter, boot code: I or P PCDOS with IBMBIO/IBMDOS.COM M MSDOS with IO/MSDOS.SYS O OS/2 with OS2BOOT V OS/2 with OS2LDR, Veit Kannegieser N Win-NT with NTLDR (FAT16) W Win-9x with IO/MSDOS.SYS (FAT16) 9 Win-9x with WINBOOT.SYS (FAT32) -r:size = number of entries in root directory (FAT12/16) -s:vsn = volume serial number to be used (use 0x for hex) -v:label = ASCII label string for filesystem identification -! = force use of option dialog to specify parameters Remarks: Formatting a partition or volume will destroy ALL data that is currently on the volume, and is NOT recoverable! _______________________________________________________________________________ NOBADS = Reset bad-sector/cluster administration to ZERO bad sectors Purpose: Make sure the filsystem specific administration for bad sectors is reset to a state where NO bad-sectors are present. Parameters: none Output: Message indicating success or failure Remarks: This is most useful after CLONING (or imaging) a damaged disk or partition that had bad sectors areas to a new disk. Running the 'NOBADS' command will reclaim the previously marked sectors/clusters back for normal use. For FAT12, FAT16 and FAT32, this command affects the 1st and 2nd FAT areas, where all 'BAD' markings (ff7, fff7, 0ffffff7) are replaced by the 'FREE' mark (000, 0000, 00000000). _______________________________________________________________________________ SETROOT [s|.nn] = Set FAT32 root directory LSN to sector [s] or listvalue [.nn] Purpose: Set the (DFSee internal) value for the root directory sector Parameters: s|.nn optional sector number (hex) or a .NNNNN value from the Sectorlist, from a FINDROOT command Output: Message indicating success or failure Remarks: This can be done after finding possible root directories with the FINDROOT command, and will be made effective with the next FIXBOOT command _______________________________________________________________________________ SPACE [clust] = Show allocation for specified cluster or current LSN 'this' Purpose: Show size and fragmentation of allocated space for a cluster Parameters: clust optional Cluster number Output: A list of allocation-chunks with LSNs and sizes Remarks: none _______________________________________________________________________________ SUBFIND [opt] = Find subdirectories (.. entry) from start or current lsn Purpose: Find all starting-sectors for subdirectory clusters Parameters: none Options: -c Start find from current sector instead of start Output: Find progress and result Remarks: The result will be a list of sector numbers of directory sectors. A 'list +f' will list them, showing the cluster numbers for the directories. You can save the list using the 'export' command. Selecting a single entry from the list with the ".nnn" command will display that particular directory, showing the files. Selecting a single file from that list, again using the ".nnn" command will show the directory-entry information for that file. You can use the "saveto" command to recover that file. Note that selecting from the initial list, and displaying directory info, builds a NEW list destroying the find-result. You can use the 'export' and 'import' commands to save that find-result and work with other entries in the list later. _______________________________________________________________________________