DFSee version 17.0 2022-10-22 (c) 1994-2022: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Note on the format Examples of DFSee usage _______________________________________________________________________________ N O T E O N T H E F O R M A T: _______________________________________________________________________________ I will write most examples in the form of a DFSee 'scenario' that begins with starting DFSee, and then lists the commands to be used. Other examples will show the menu items that can be used. Starting DFSee could be DFSOS2.EXE, DFSDOS.EXE or DFSWIN.EXE (NT/2000/XP), in the example I will use one of them, just fill in whatever you use ... Also, on commands I might add some comment at the end of the line, preceded with a ';' character. You can include that on the actual command, it will be echoed to the screen (and possible log file) but otherwise has no effect. _______________________________________________________________________________ E X A M P L E S: _______________________________________________________________________________ #010 Make sector backup 1) Make a backup of all the important partition sectors in a file Note: It is advisable to use the DFSFAST script for this unless special parameters are required. This will produce all the required backup and information files for recovery. (see HOWTO item number 3) Using the menu: Mode=FDISK -> BACKUP partition info -> ... select the disk(s) ... For other purposes, the PSAVE command can be used directly: DFSee ;Start DFSee and scan physical disks psave * a:\dfspsave Backup of partitioning sectors q Where the last part (Backup of ...) can be any comment you like It can be restored at any time using the PRESTORE command. This will either restore all sectors, or just selected ones. See DFSFDISK.TXT To run this command directly from the (operating system) command line: DFSxxx.EXE psave * a:\dfspsave Backup of partitioning sectors The PSAVE command is also contained in the DFSTART script that can be used to make a backup of all your partitioning information after changes. It is also part of the DFSDISK script used for disaster analysis. So you can also run DFSTART or DFSFAST (not both :-) to get the backup. _______________________________________________________________________________ #020 Create logfile 2) Create logfile to keep DFSee output for analysis (or to send to me :-) Using the menu: File -> Log new output to file ... Command Explanation DFSee ;Start DFSee and scan physical disks log filename ;append logging to 'filename.log' ... or even simpler: DFS -l:filename ... Where you fill in a meaningful filename, like part of your name ... Do NOT use output redirection (DFS xxxx > filename.log) because that will cause a lot of garbage to be logged into the file. _______________________________________________________________________________ #030 DFSDISK/DFSFAST procedures 3) Collect information to perform many kinds of disk-recovery including un-fdisk ++++++++++ Running the DFSee DISK analysis procedure (DFSDISK/DFSFAST) This will collect information needed for analysis of disk problems. It will try to find existing and deleted/old partitions and report as many details about them as possible. It is almost always REQUIRED for formal support by support@dfsee.com You need a complete installed DFSee version, including the standard scripts and can run it directly with the DFSee executable from the menu: Scripts -> Full Analyse disks (support) -> All disks listed or Scripts -> Fast Analyse disks (support) -> All disks listed This is by far the easiest way to run the DFSDISK/DFSFAST procedures! See the description/screenshots for this at: https://www.dfsee.com/dfsee/dfsmenu-expert-scripts.php#id03335 Note: Unless specifically asked to do so, DO NOT CHECK the "Search ALL sectors (slowest)" checkbox in the DFSDISK dialog. It would only waste your and my time ... If you have the bootable CDROM, or the diskette that you can get from: https://www.dfsee.com/dfsee/dfsee16x_dsk.zip You can boot that and select menu-item (3) from the startup-menu. Another very convenient way to run it is using the bootable DFSPUPPY USB-stick, click the DFSee icon, and run it from the Script menu. With this method you can save the resulting files ON the USB stick. Otherwise you can run the operating system script-file (.BAT or .CMD) without any parameters and it will collect several files for every physical disk you have. (DFSDISK?.* or DFSFAST?.*) Do NOT just run the 'dfsdproc.dfs' or dfsdfast.dfs internal scripts since those will only do half the work! Send all DFSDISK?.* files (zipped to one file) to DFSee support at: support@dfsee.com In the resulting filenames, the '?' stands for the platform, which are: o for OS2 d for DOS w for Windows l for Linux m for macOS _______________________________________________________________________________ #040 Repair NTFS bootsector 4) Recover a 'lost' NTFS partition where the bootsector is damaged and the partition is not recognized by NT anymore (assuming 3rd partition): Command Explanation DFSee ;Start DFSee and scan physical disks log recover part 3 fs NTFS fixboot _______________________________________________________________________________ #050 Repair JFS bootsector 5) Recover a 'lost' JFS partition where the bootsector is damaged and the partition is not recognized by OS/2 anymore (assuming 2nd partition): Command Explanation DFSee ;Start DFSee and scan physical disks log recover part 2 fs JFS fixboot _______________________________________________________________________________ #060 Repair HPFS bootsector 6) Recover a 'lost' HPFS partition where the bootsector is damaged and the partition is not recognized by OS/2 anymore (assuming 1st partition): Command Explanation DFSee ;Start DFSee and scan physical disks log recboot part 1 fs HPFS fixboot _______________________________________________________________________________ #070 Repair HPFS spareblock 7) Recover a 'lost' or damaged HPFS spareblock (sector 11) when the partition is not recognized by OS/2 anymore (assuming 1st partition): Command Explanation DFSee ;Start DFSee and scan physical disks log reCSpare part 1 fs HPFS findcp fixspare Note: with a damaged spareblock you can get various error messages from OS/2 about codepages or other things. However when starting DFSee and selecting the partition it will tell the spareblock is damaged. _______________________________________________________________________________ #080 Save or restore images 8) Save and restore (parts of) a disk or volume The "image" command can be used to save a complete disk, including partition information to one (very large!) file on a different (network) drive. To save the entire unit (opened disk/partition or volume) use: There are several image save/restore items in the menu, with custom dialogs that allow specifying most of the available options. Image -> Create Imagefile(s) -> ... select one of the actions ... and Image -> Restore/Compare imagefile(s) ... select one of the actions ... Command Explanation DFSee ;Start DFSee and scan physical disks image img-name 0 $ Images can be restored using the "restore" command, but will only work perfectly if the destination disk has the same geometry as the source disk. ('heads' and 'sectors' the same like "255, 63", cylinders same or larger). It can also be very useful to save a single sector (like the bootsector) when you are experimenting with the filesystem. Command Explanation DFSee ;Start DFSee and scan physical disks part 04 ;select the partition image bootsecX 0 1 ;save bootsector to file bootsecX.img _______________________________________________________________________________ #090 Create TRACE file 9) Create a trace-logfile to allow analysis of DFSee internal problems This is to allow analysis of traps or other unexpected behaviour by DFSee and will create a possibly LARGE logfile containing functional trace information on what DFSee is doing. There are three ways to create such a trace, the simplest one will start functional tracing right from the start and might create a HUGE file: Command Explanation DFS -111 ;Start DFSee with trace to DFS-111.log ... ;execute any DFSee command that ;shows the problem being analysed As an alternative, you can start DFSee with a regular logfile, and start the functional-trace later in the scenario. This reduces the size of the resulting logfile. Command Explanation DFS -l:problem1 ;Start DFSee with trace to problem1.log ... ;execute any DFSee command that ... ;leads towards the problem trace -t 100 ;start trace with timestamps ... ;execute the 'problematic' command(s) Finally you can start DFSee without any logging, and just before the problematic command start functional-trace to a specified logfile: Command Explanation DFSee ;Start DFSee ... ;execute any DFSee command that ... ;leads towards the problem trace -t problem2 ;start trace to problem2.log ... ;execute the 'problematic' command(s) In all cases, zip the resulting logfile(s) and send with a description of the problematic DFSee behaviour (hang, trap, crash ...) to: support@dfsee.com _______________________________________________________________________________ #100 Undelete files 10) Undelete a file on HPFS or NTFS; Find the files using: Command Explanation DFSee ;Start DFSee and scan physical disks part 01 ;select the right partition delfind ;find ALL deleted files export undel01 ;optional, save found info to a file import undel01 ;optional, import the found files again Then either use the delshow/recover commands to recover files: delshow ;optionally list them (ALL !) delshow *test*%100 ;or just a selection, here only 100% ;recoverable with 'test' in the name recover X:\undel *wildcard*%100 ;recover using some explicit wildcard Or recover ;start recovery using a selection dialog Or browse . ;start BROWSE with the list of deleted files ;use the context menu on one or more files and ;use 'Copy/Recover File(s) to other drive' Notes: - It's best to use a different drive to recover to, to avoid overwriting - The wildcard used on 'delshow' and 'recover' can contain multiple wildcard characters, and deals with the FULL PATH and filename, so you can include (parts of) the directory too. - You can also undelete a single file using the 'saveto' command and specifying the files sequence number: .NNNNN shown at the left of the 'list' output. _______________________________________________________________________________ #120 Update HPFS bad sector list 12) Update the HPFS bad sector list with the results of a DFS scan Find all sectors that are unreadable: Command Explanation DFSee ;Start DFSee and scan physical disks part 01 ;select the right partition scan ;find unreadable sectors export badguys ;save in an ASCII file badguys.lsn Now replace the internal bad Sectorlist with the new modified one: Command Explanation DFSee ;Start DFSee and scan physical disks part 01 ;select the right partition import badguys ;get the bad Sectorlist from file fixbs ;and insert in HPFS badsector list Notes: - You can do this in one step too, no real need to export/import _______________________________________________________________________________ #130 Show SLT anomalies 13) Show all detected anomalies in the SLT (Sector Lookup Table) like file allocation errors Command Explanation DFSee ;Start DFSee and scan physical disks part nn ;select a partition check ;build SLT and report all errors _______________________________________________________________________________ #140 Display FAT area 14) Display the FAT for a diskette in drive A: Command Explanation DFSee ;Start DFSee and scan physical disks vol a fatshow _______________________________________________________________________________ #150 Display FAT root directory 15) Display the FAT Root directory for partition C: Command Explanation DFSee ;Start DFSee and scan physical disks part C ; select the partition d ; next is bootsector d ; next is root directory _______________________________________________________________________________ #160 Save MBR 16) Save the master boot record (MBR) on a different PC connected with a parallel laplink cable and running the LPT tool: Command Explanation DFSee ;Start DFSee and scan physical disks disk 1 sim [lpt.exe]d:\images\mbr.img 0 1 _______________________________________________________________________________ #170 Restore MBR 17) Restore the master boot sector from a different PC connected with LPT: Command Explanation DFSee ;Start DFSee and scan physical disks disk 1 wrim [lpt.exe]d:\images\mbr.img 0 1 _______________________________________________________________________________ #180 Resolve original HPFS filename 18) Resolve original name of OS/2 HPFS FILExxxx.CHK files (created by CHKDSK) When CHKDSK recovers files it will place them in a FOUND.xxx directory in the root directory. This directory contains one or more recovered files with names like FILE0001.CHK The original name of the file is still in the Fnode, it can be shown using the following DFSee HPFS commands (assuming partition 03) : Command Explanation DFSee ;Start DFSee and scan physical disks part 03 ;Select partition 'id' (must be HPFS) \found.000\file0001.chk ;Search and display Fnode for .CHK Now 15 characters of the original name are shown as "Fnode Name String" Note: This will only work with the older CHKDSK versions, the newer ones create a binary CHKDSK.LOG in the root directory of the checked drive, and use a different naming scheme where the original name is reflected already. It is NOT in the (file*.chk) FNODE anymore. To read the CHKDSK.LOG use the PMCHKLOG.EXE program that is supplied by with later OS/2 versions, ArcaOS and eCS _______________________________________________________________________________ #190 Show freespace areas 19) Show freespace areas on any filesystem supporting the DFSee ALLOC command Command Explanation DFSee ;Start DFSee and scan physical disks slt $ _______________________________________________________________________________ #200 Scripted workstation partitioning 20) Automatically FDISK a workstation using a batch file or command file like: echo DFSee FDISK generic workstation > dfsfdisk.log dfsdos -b newmbr 1 clean dfsdos -b create primary bmgr dfsdos -b startable 1 dfsdos -b create logical fat 6 1 -1,c MAINT dfsdos -b create primary hpfs * 1 +0 WARP This will create a disk with boot manager (image prepared with DFSIBMGR), a small maintenance partition at the end of the disk minus 1 cylinder and a primary partition filling the rest of the disk. Note: This can be done using a native DFSee script (like makepart.dfs) too and this will perform much quicker when run from a diskette because the executable file only gets loaded once. See item 46 for an example. _______________________________________________________________________________ #210 Scripted server partitioning 21) Automatically FDISK a server machine using a batch file or command file like: echo DFSee FDISK RAID server > dfsfdisk.log dfsdos -b newmbr * clean dfsdos -b create primary bmgr dfsdos -b startable 1 dfsdos -b create primary hpfs 300 1 0 SYSTEM dfsdos -b create logical fat 200 1 dfsdos -b create logical hpfs * 1 0 RESTORE dfsdos -b create logical hpfs * 2 dfsdos -b create logical fat * 3 dfsdos -b setboot 0:SYSTEM dfsdos -b setboot m:advanced _______________________________________________________________________________ #220 New MBR 22) Make a clean master boot record, getting rid of all old partitions Command Explanation DFSee ;Start DFSee and scan physical disks newmbr 1 clean ;Create fresh MBR on disk 1 with ;clean, empty partition table _______________________________________________________________________________ #230 Restore backup sectors 23) Restore saved backup of all the important partition sectors from a file Command Explanation DFSee ;Start DFSee and scan physical disks prestore * a:\dfspsave Each of the available *.PDn files will be restored to the same disk it was created from. All saved sectors will be restored and, when not using batch mode, the user will be prompted for each of them allowing a more selective restore. _______________________________________________________________________________ #230 Restore saved sectors to other disk 24) Restore PSAVE file of one disk, to a different one, clone partition tables Command Explanation DFSee ;Start DFSee and scan physical disks prestore 3 a:\dfspsave.pd1 Assuming a PSAVE has been run with at least one disk present, the file dfspsave.pd1 will contain all important partition sectors for disk 1. This will be restored to the specified disknumber 3. _______________________________________________________________________________ #250 Verbose partition overview 25) Create a detailed overview of all your disks and partitions in a text file Command Explanation DFS -l:diskpart ;Start DFSee and open a logfile part -V -a This can also be run directly from the command line, as in: DFS.EXE -l:diskpart -Q part -V -a _______________________________________________________________________________ #260 Clone disk 26) Clone a physical disk to another (identical) one, including all data Command Explanation DFS -l:dskclone ;Start DFSee and open a logfile disk 2 ;select/open the TARGET disk clone -d:1 ;clone disk-1 to disk-2 This can also be run directly from the command line (batch mode!), using: DFS.EXE -l:dskclone -b -Q disk 2#clone -d:1 A more user-friendly way of to start disk cloning is using the menu: Actions -> Clone or Compare objects -> Disk to Disk, regular ... or Actions -> Clone or Compare objects -> Disk, skip BAD-SECTORS ... Which will present the generic CLONE dialog window, with some fields pre-selected, where you can specify some addional options and finally start the actual clone operation. _______________________________________________________________________________ #270 Clone partition 27) Clone partition from another partition (data only, no partition table) Command Explanation DFS -l:pclone ;Start DFSee and open a logfile part 7 ;select/open the TARGET partition clone -p:1 ;clone part-1 to part-7 This could be used to clone the BMGR to another disk, including all code and configuration data. A more user-friendly way of to start disk cloning is using the menu: Actions -> Clone or Compare objects -> Partition to Partition ... Which will present the generic CLONE dialog window, with some fields pre-selected, where you can specify some addional options and finally start the actual clone operation. _______________________________________________________________________________ #280 Resize partition 28) Resize (truncate) the first partition, making 500 MiB available Command Explanation DFS -l:truncate ;Start DFSee and open a logfile part 1 ;select/open the partition resize -f:500 ;truncate to current size minus 500MiB _______________________________________________________________________________ #290 Create binary image using Clone 29) Create an imagefile for a partition, using CLONE instead of SIM Step 1: Create a dummy image file at the destination Step 2: Open the created dummy and CLONE an existing partition to it echo dummy > v:\part05_backup.img DFS -l:imgclone im v:\part05_backup.img clone -p:05 q Note: The resulting image will be as large as the partition! In real life, the IMAGE command is the better alternative. _______________________________________________________________________________ #300 Resize HPFS, FAT or NTFS partition 30) Resize an HPFS, FAT or NTFS partition using DFSee (updated for 10.2) For HPFS you can use the RESIZE menu item, after selecting the partition: Acions -> Resize partition and FS -> Expand, make partition larger or to reduce the size: Acions -> Resize partition and FS -> Resize, make partition smaller Note: In general, FAT partitions can only be made SMALLER, not larger. Some more remarks about resizing NTFS, and bootable Windows: +++++++++++++ Bootable Windows Resize procedure +++++++++++++ Since DFSee only resizes from the end you will have to make sure the end of the partition is EMPTY, by moving any data that is there to the start of the partition. DFsee itself will not do that yet. The obvious way is to use the "Disk defragmenter" that is built into Windows-XP. In defragmenting, it will move most data to the start of the disk, but often some 'unmovable' stuff stays behind near the end. In XP, you can find the defragmenter in computer managent: Start -> Control Panel -> Administrative tools -> Computer Management There choose "Disk defragmenter", and select the partition you want to resize later. You may have to do this multiple times for the best result. It may help to (temporarily) remove the SWAP-file if that is on the same partition, since that is 'unmovable' and is often near the end. You can disable the swap-file in Start -> Control Panel -> System In the System Dialog, select the "Advanced" tab, and then click the "Settings" button for the "Performance" catagory. (that says something about 'Virtual Memory') In the next dialog, again select the "Advanced" tab, and then click the "Change" button for the "Virtual memory" catagory. Then, select your partition to resize from the list (if there) and select the radio Button "No Pagingfile", then click the "Set" button. After switching off the Pagingfile, reboot and defragment the partition (again). In a similar way you could remove/disable other systemfiles like the ones for System-restore that take up a lot of space. Some 3rd party defragmenters might do better in actually making freespace available at the end of the partition. Word of CAUTION and DISCLAIMER: Resizing a BOOTABLE Windows-XP, -2000 or -NT with DFSee is pretty reliable starting with 7.12, however, there is no 100% guarantee ... failures to boot can often be recovered by running the required CHKDSK from ANOTHER Windows system, most easaly accomplished by booting a real Windows installation CDROM, going to the "Recovery Console" and run "CHKDSK C: /p /r" (This should work with XP, Win-2000 and NT) However, since it is not always recoverable, I STRONGLY advise to have a good backup of your Windows installation before doing the resize, or be prepared to reinstall. As a minimum, make sure you have a backup of any USER-DATA that might be on the partition, and that would be hard to replace! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++ Window-XP disk-space optimization You can often save a significant amount of disk space by disabling the 'suspend to disk' setting in Windows XP, that will get rid of the 'HYBERFIL.SYS'in the root that is the same size as your memory ... This will also making defragmenting the disk to make the end of the disk available for resizing more efficient. You disable HIBERFIL.SYS through the XP GUI (control panel): Start Control Panel Power Options Or if you have those silly 'themes' enabled: Start Control Panel Performance and maintenance Power Options Then in the 'Power Options Properties' dialog: Select 'Hibernate' tab and uncheck "Enable Hibernation" You can also temporarily disable swapping, or move the swapfile (called PAGEFILE.SYS) to another disk, like E: in your case. The PAGEFILE(s) together are about 1.5 times the size of memory. Start Control Panel System Or if you have those silly 'themes' enabled: Start Control Panel Performance and maintenance System Then in the 'System properties' dialog: Select the 'Advanced' tab [Settings] for "Performace" Select the "Advanced" tab again [Change] on "Virtual memory" Now highlight the drive you want to change the setting for which is probably C: and lower the amount, or disable it altogether ("no paging file"). Do not forget to click [Set] If you want to move the swapfile to another drive, select it and specify a custom size or the "system managed size" Then reboot to have the actual 'PAGEFILE'SYS' updated. ++++++++ end Windows XP disk-space) _______________________________________________________________________________ #310 Using DOS diskette 31) Using a DOS boot diskette for DFSDOS.EXE TIP: Do NOT USE EMM386 in combination with DFSDOS version 5.xx and later, as this is known to cause stability problems on some cases like a solid hang on startup of DFSDOS.EXE. NOTE: The DFSee CDROM ISO distribution ZIP also contains an IMAGE from a bootable FreeDOS diskette in the form of (Dos/OS2) executable called 'bootdsk.exe' that will self-extract to a diskette when run. Of course it also contains the latest DFSDOS.EXE for that version. _______________________________________________________________________________ #320 Change HPFS or JFS filename (low-level rename) 32) Change the filename in an HPFS directory and Fnode, or JFS directory This is sometimes needed to get rid of a file that has 'illegal' characters in the name like '>' or other strange characters created in a different codepage. 1) Automated procedure, using BROWSE (works on JFS as well) This is implemented as one of the selections in the 'context-menu' that is available on the current file in the BROWSER, by using In short, the steps to rename a file (on HPFS or JFS filesystems) are: a) Select the partition from the menu or using the 'part nn' command b) Start the BROWSE dialog using the menu or the key c) Navigate to the directory/file you want to rename d) Use or to open the context menu e) Select the 'Edit the base filename for File/Dir' action f) In the rename-dialog, change the name, KEEPING THE LENGTH THE SAME! 2) Manual procedure, HPFS specific High-level: a) Find the FNODE for the file ('find' command or '\path+filename') b) Update Shortname if needed ('H .' + 'edit' command) c) Check and write back ('show' + 'write' command) d) Find related directory block ('u' + 'd' command) e) Find the long-filename in there ( 'H . ' + some 'd' commands) f) Edit the long-filename in there ('edit' command) g) Check and write back ('show' + 'write' command) Low-level: change '\tmp\filename.bad' to 'filename.txt' DFS.EXE part 03 \tmp\filename.bad H . ;display HEX, to determine location (16) edit -p:16 -a:"txt" ;update the truncated name in the FNODE show write . u d ;display the DIR-block ;if BTree pointers are listed, select ;the right block using a ".nnn" cmd ;Note the alphabetic ordering of names H . ;Display first of possible 4 sectors d ;use "d" or until the sector d ;with the filename in it is found edit -p:0xa4 -a:"txt" ;update (full) name in the DIRECTORY show write . q 3) Manual procedure, JFS specific (Note filenames are in UNICODE!) High-level: a) Find the DIRECTORY structure ('find' command or '\path+filename') e) Find the long-filename in there ( 'H . ' + some 'd' commands) f) Edit the long-filename in there ('edit' command) g) Check and write back ('show' + 'write' command) Low-level: change '\iso\dfsee142.iso' to 'dfsee161.iso' DFS.EXE part 06 \tmp\ ;locate and show directory summary d ;advance from summary display to file-list H . ;display HEX, to determine location (16) edit -p:80 -u:"161" ;update the (full) name in directory entry show write . t ;display the changed DIR-block Much more detailed examples using the HEX-editor are in item #630/#650. Note: Instead of the 'H ./edit/show/write' command sequence, you can also use at that point to start the HEX-edit dialog window, that supports those operation in a more friendly and interactive way. _______________________________________________________________________________ #330 Reboot to bootable partition (IBM BM) 33) Reboot to a different operating system partition (IBM BootManager installed) OS/2 or eComStation installations with IBM BootManager installed can use the standard SETBOOT.EXE program to reboot to any bootable partition. You can do the same using the DFSee program. Added benefit is that you can use it from a Windows partition as well (to boot back to OS/2) and that you can have an extra confirmation step if you like. Example to boot from eComStation to an XP partition called "WinXP": Create a new program object by locating any existing program icon, right-click and select "Create another -> Program" and fill in: Path and filename: H:\T\DFSOS2.EXE Parameters: -w+ setboot -i:WinXP Working Directory: h:\t Session type should be "OS/2 Window" (or "eCS Window") type of program. For the icon you can use DFS.ICO or DFSEE.ICO from the distribution ZIP file, or any other icon you like. As setup like this ("-w+") it will ask for a confirmation (are you sure) If you want to skip that too, just add the "-B" switch to the parameters and specify to start the program "minimized". Example to boot back to "eComStation" from the XP partition: In Windows (NT, W2K, XP) just create a 'shortcut' to the DFSWIN.EXE program and specify the right parameters, example: "-w+ setboot -i:eComStation" This will work in a similar way on Windows-7 or later, but it requires ADMINISTRATOR rights to work properly (even if you ARE an administrator) so start it with a right-click and specify 'Run as Administrator') Note: For a Windows installation to work with the IBM BootManager it MUST be installed into a SINGLE primary partition! The factory installed with TWO primaries will fail to boot, since BootManager 'hides' one of them! _______________________________________________________________________________ #340 Copy files from a damaged or inaccessible FS 34) Copy files from a damaged or inaccessible filesystem Sometimes you lose access to NTFS files because of some kind of crash, a failed update or whatever. DFSee is often still capable of finding files within the NTFS filesystem and copy them to another disk. This can be very useful to save a few very important files before reinstalling or trying other recovery methods. 1) Automated procedure, using BROWSE This is implemented as one of the selections in the 'context-menu' that is available on the current file in the BROWSER, by using In short, the steps to rename a file (on any supported filesystem) are: a) Select the partition from the menu or using the 'part nn' command b) Start the BROWSE dialog using the menu or the key c) Navigate to the directory you want to copy/recover files from d) Use the to mark multiple files to recover (optional) e) Use or to open the context menu f) Select the 'Copy/Recover File(s) to other drive' action g) In the recover-dialog, fill in the destination directory and other recovery options as desired, then [OK] to start copying 2) Manual/command-based procedure (works on selected filesystems) DFS.EXE -l:myproj part 02 filefind .java list -f *myproj* recover a: *myproj* q This will first find all filenames containing ".java" in their name on partition number 2 (must be a supported FS) and then list all those that also have "myproj" somewhere in the full path specification. Finally the same files as displayed by list are recovered by copying them to the diskette in A: The 'recover' could use a more specific wildcard, like *myproj*dialogs* based on your judgement of the "list -f" output. You can also recover them in several groups to make the files fit on more than one diskette ... Make sure the diskette has enough space to hold all the files to recover, a disk full situation will cause an ungraceful failure! Of course you can recover to any volume (driveletter, path) that you have access to when running DFSee. It could be another disk-partition or a network drive or whatever ... _______________________________________________________________________________ #350 Copy files using DIR info 35) Copy files from a damaged or inaccessible HPFS or FAT partition (DIRFIND) This is an alternative to scenario (34) that works on HPFS and FAT and could be a lot faster too because it searches the directory structures instead of the entire partition. It uses DIRFIND instead of FILEFIND. DFS.EXE -l:myimages part 15 dirfind s \ -l:*.jpg recover d:\images *.jpg q This will first find, then list and finally recover ALL .JPG files from partition 15 to the directory 'D:\images\' on driveletter D: Any paths (subdirectories) from the source partition 15 will be preserved when possible, or be replaced by unique numbers. Note: This requires DFSee version 4.27 or later. _______________________________________________________________________________ #360 Show disk geometry and MBR id 36) Show disk geometry and MBR id Some options of the 'PART' command can be used to display the disk geometry for all disks, without showing any warnings or the complete table. part -g -w- -t- -g = read disks (refresh) and show geo -w- = do NOT show any warnings -t- = do NOT show the partition table display So, from the command line, to display it and directly quit again: DFS.EXE -Q part -g -w- -t- That will display the geo and automatically quit. Or if you want it in a logfile: DFS.EXE -l:geometry -Q part -g -w- -t- Will put it in 'geometry.log' Another new option will include a one line description of the boot code found in the MBR for each disk: part -m -w- -t- -m = read disks (refresh) show geo AND show MBR description -w- = do NOT show any warnings -t- = do NOT show the partition table display So, from the command line, to display it and directly quit again: DFS.EXE -Q part -m -w- -t- _______________________________________________________________________________ #380 Show .PDn detailed info 38) Show detailed information from .PDn file saved with PSAVE Although a lot of useful information from the files saved with PSAVE can be shown just by typing them (like 'type mysystem.pd1') sometimes you need to see exactly what is inside, before restoring with PRESTORE. This can be done by restoring it to a VIRTUAL disk inside DFSee, and use the normal available display commands on that. DFS.EXE -d- ; start without real disks virtual mysystem.pd1 ; make disk just like the PD1 map -d ; show current disk as a map q Or to do the same using the [Expert] menu: File -> Attach/Detach/Display disks -> Attach to DFSee disk-list -> MemDisk from .PDx Template ... Then select the .PDn file from the Open-File dialog. After 'importing' the .PDn file and related other files this way, you can use any of the display commands to view that disk like PART, MAP, DISK, WALK, PL etc., but remember that the ONLY sectors present are the partition tables, LVM-info and bootsectors. So selecting a partition and looking inside will result in errors. This is also a good way for experimenting with DFSDISK results. Creating a VIRTUAL disk from one of the DFSDISK.PDx files is a great starting point for recovery tests without risking damaging your real disk. _______________________________________________________________________________ #390 Compare partitions 39) Show (minor) differences between (cloned, HPFS) partitions using COMP As an example for using the compare command I will show you how to use that combined with a few LIST commands to show difference between two HPFS partitions, clones made a few days apart. The original is an eCS boot partition that has been used for a few days after the first cloning. DFS.EXE -l:compeCS part 15 ; select first clone comp -p:19 -list ; compare to other, create list list +f list +fi q There was 2.5 MiB worth of differences, but removing all the lines with 'unidentified data' from the list output reduces that to just a few files. Changes between the two are updates to config.sys, replaced kernel and the DANI drivers. Rest listed are dynamic often changed files ... ========= Example output (edited logfile) for this scenario ============= DFSee-OS2 version : 5.00 executing: comp -p:19 -l Compare area from : alternate Store 2 : Partition (part) 19 = ' ' mode = HPFS TO current store : DEFAULT = Store 1 : Partition (part) 15 = ' ' mode = HPFS Sectors to handle : 003E8200 = 2000 MiB to start sect: 00000000 Compare to area on: same disk, buffer 8064 sect = 4032 KiB First sector todo : 00000000 Progress 4 MiB/. : 00000000 ....................................... 1920 MiB+ 4 MiB/. : 003BEC80 ..................... Last sector done : 003E81FF size 003E8200 = 2000 MiB Elapsed time is : 152 seconds, throughput 13.16 MiB/sec Different sectors : 000012E1 = 2417 KiB The compared areas are NOT identical DFSee-OS2 version : 5.00 executing: list -f (and -f:i, combined in log) .00006 = 0003012E : f 100% 1024 B \IBMCOM\LANTRAN.LOG .00007 = 0003012F : f 100% 2048 KiB \os2\system\SWAPPER.DAT .00010 = 00092D3D : z 100% 255 KiB \os2\OS2SYS.### .00012 = 00092D7A : z 100% 512 B \IBMLAN\LSSHARE.### .00014 = 000938C3 : f 100% 915 KiB \os2krnl.dbg .00016 = 00093A19 : z 100% 1024 B \os2\eCSClock\ALARM.### .00017 = 00093A58 : f 100% 67 KiB \os2\boot\DaniS506.ADD .00018 = 00093A59 : f 100% 26 KiB \os2\boot\DaniATAP.FLT .00019 = 00093A79 : z 100% 512 B \mptn\ETC\TCPOS2.### .00020 = 000A295E : f 100% 12 KiB \IBMLAN\LOGS\NET.AUD .00027 = 000AC6EA : f 100% 830 KiB \os2krnl .00052 = 000AC9AF : z 50% 1024 B \os2\eCSClock\ALARM.### .00053 = 000AC9B0 : f 100% 512 B \mptn\ETC\TCPOS2.INI .00054 = 000AC9B1 : z 100% 1024 B \os2\eCSClock\ALARM.### .00055 = 000AC9B2 : f 100% 512 B \IBMLAN\LSSHARE.INI .00060 = 000AD253 : f 100% 1024 B \os2\eCSClock\ALARM.LST .00061 = 000AD254 : z 100% 0 B \os2\OS2.!!! .00062 = 000AD255 : z 100% 0 B \os2\OS2SYS.!!! .04525 = 000B0B6B : z 100% 1152 KiB \os2\OS2.### .04526 = 000B71D8 : f 100% 1152 KiB \os2\OS2.INI .04527 = 000CB3CA : f 100% 255 KiB \os2\OS2SYS.INI .04528 = 000D68B7 : f 100% 35 KiB \POPUPLOG.OS2 .04638 = 001F07A4 : D 100% 2048 B \Desktop\ .04639 = 001F07A5 : D 100% 2048 B \Nowhere\ .04644 = 001F08F9 : f 100% 9 KiB \Config.Sys ========= End output (edited logfile) for this scenario ============= _______________________________________________________________________________ #400 Setboot and change driveletters (OS/2 specific) 40) SETBOOT to other partition, changing LVM driveletters too (2 C: drives) On a system with two LVM-aware operating systems installed, both with assigned instead of calculated drive-letters it is not possible to have two separate C: drives, one visible, the other hidden, and switch between them using IBM BootManager (as often used before LVM)." It IS possible however, to assign the driveletter C: to the partition you want to boot to, after removing it from the current one and then reboot to that new C: drive using a SETBOOT. This can be automated in a single DFSee command (a so called multi-command) As an example, assume there are 3 primary partitions: 1 IBM BootManager 2 eCS-test partition, also installed as C: 3 eCS-GA, installed as primary C: The command to switch from eCS-GA to the eCS-test would be: DFS -w+ -Q lvm -B 3 -l- #lvm -B 2 -l:C #setboot -i:C And to switch back from eCS-test to the eCS-GA: DFS -w+ -Q lvm -B 2 -l- #lvm -B 3 -l:C #setboot -i:C In the example, the LVM will be executed without questions asked, and the setboot will ask a confirmation first. Note that if you decide NOT to boot at this point, that the C: driveletter has changed! This might cause problems with LVM or other disk-tooling. An example to switch without any questions asked: DFS -b -Q lvm 2 -l- #lvm 3 -l:C #setboot -i:C These commands can easily be put in a small batch file (.CMD) or even into the 'parameters' field of a program object on the Desktop. _______________________________________________________________________________ #410 Examine information in a .PDn file 41) Examine information in a .PDn file, interactively DFS -l- -d- -menu- virt DFSDISKo.pd1#part -w -t- In this example, there will be NO logfile, no internal disks will be visible, the menu is off, and it will display the contents of the 'disk' as a table. You could implement a commandline like this as default action on .PDn files in a filemanager like FC/2 to get a quick 'examine' functionality for them. _______________________________________________________________________________ #420 Create LVM info (VCU) 42) Convert all partitions of a system to LVM-volumes, no questions asked dfs -b vcu _______________________________________________________________________________ #430 Create LVM info for new partitions 43) Convert any new partitions to volumes, but keep existing ones the same dfs -b lvm * -V _______________________________________________________________________________ #440 Interactive LVM dialog 44) Examine (and possibly change) all LVM related values for the volumes using an interactive dialog window. dfs lvm q To run this directly from the OS command line, and quit the DFSee executable after the last volume is handled, use: dfs -w lvm Note: You can either use the key or the and keys in the dialog windows to get to the next (or previous) volume. Once the last volume has been done, the LVM dialog is ended. _______________________________________________________________________________ #450 LVM batch operations 45) Put ALL existing volumes on the IBM BootManager menu, with dialog window and confirmation for each one (allowing more manual changes) dfs lvm * -menu q _______________________________________________________________________________ #460 Partition new system using script 46) Use a native DFSee script to partition a new system (also see 20 & 21) In this case a BootManager image is installed as well, and this requires the file DFSIBMGR.IMG to be present. (created with DFSIBMGR cmd). It will also create the needed LVM-info on the fly using the new -L option for the create command and the new "LVM" functionality. dfs run makepart wsname This will be an 'interactive' run where you will be prompted for confirmations for each command, and can change any values using the LVM dialog as well. For an unattended run (no questions) use: dfs -b run makepart wsname In both cases the 'makepart.dfs' file contains: ;----------- start of script ;Workstation partitioning: BMGR, OS2, MAINT and Data partitions ; log ws$1 ; newmbr 1 clean cr pri bmgr 1 -d:1 -L:"-D -V" cr pri hpfs 800 -d:1 -L:"-D -v:'OS2' -l:C -menu" cr log hpfs 100 -d:1 -L:"-D -v:'MAINT' -l:M -menu" cr log hpfs -d:1 -L:"-D -v:'DATA' -l:D" startable 1 ; part -r ;----------- end of script Note: More complete examples can be found in the 'samples' script directory in the default DFSee distributions, for example the script aimed at partition recovery, called 'recparts.dfs' _______________________________________________________________________________ #470 Batch CHECK all partitions 47) Perform a CHECK on all partitions, creating a check.log file dfs -l:check part -c _______________________________________________________________________________ #480 Standard driveletter assignment LVM 48) Convert partitions to volumes, using industry-standard drive-letter assignments. This is useful if the boot OS is DOS and HPFS, FAT32 or NTFS partitions need to be assigned driveletters too. In this example a logfile 'convert.log' will be created too, and the processing will be 'silent' (no output to the screen). dfsdos -b -q -Q -l:convert part -i#vcu _______________________________________________________________________________ #490 Delete file from NTFS 49) Delete a file from an NTFS filesystem that the normal NT/W2K/XP/W7/W10 programs cannot handle. (possibly due to filename problems) This is sometimes needed to get rid of a file that has 'illegal' characters in the name or has an extreme long filename. High-level: a) Select the NTFS volume in question based on drive-letter (VOL) b) Search for the file, using (part of) the filename (FILEFIND) c) Select the right one and show file-details as double-check (.NNN) d) Clear the 'MFT-record' for this file (WIPE) e) Have Windows perform a CHKDSK to update the directory information and allocation for the file. This will release the used space for the file and remove the name from the directory it was in. As an example, when the filename contains the unique "very-badguy" and there is only one such file on volume G:, the following DFSWIN.EXE -l:delfile vol g filefind "very-badguy" ;find the files .0 ;select the right one (or only) wipe z . 2 ;wipe MFT record clean (note . !) q Take good care with the WIPE command syntax, it has THREE parameters the second is a DOT and the third is the number TWO. When this is finished, the command: CHKDSK G: /f should be run from a command prompt. Make sure the volume (here G:) is not in use at that time by any program or the CHKDSK will complain ... In the output, you are likely to see references to the filename of the file you are removing since the directory entry will be removed, and you should also see some space being recovered for the file's data area. Note: The steps (a) through (c), where the file's MFT record is located, can also be done in a user-friendlier way using the BROWSE functionality. Navigate to the file in question, then EXIT the browser. The MFT-record will be set as the current sector (this) and can be displayed using the key, or erased using the same 'wipe z . 2' command. _______________________________________________________________________________ #500 Fix partition boundary error 50) Correct "does not start on cylinder boundary" error for the first primary partition on a disk that has been moved from the first cylinder to make space for something else. Partition-Magic will NOT align it properly in this case. It will stay aligned on head 1, sect 1 while it should be at head 0, sect 1. We need to move the whole partition towards the beginning of the disk, over one track distance (1 track, usually 63 sectors = 0x3f). As an example, to realign a 3000 MiB FAT32 partition that is PID 2 now: DFSDOS.EXE -l:align delete 2 ;delete current partition table entry cr pri fat32 size ;create it again, aligned part 2 ;select the recreated partition clone -p:2 -f:1,h -!- ;move by cloning, over 1 track (head) ;bypassing the CLONE dialog Note: This correction is mainly cosmetic, there are hardly any tools or operating systems that have a real problem with this misalignment. _______________________________________________________________________________ #510 Clone damaged disk 51) Clone a physically damaged disk to a new one, to allow recovery on that. This will cause minimal use of the damaged disk, and allows for a second chance if the recovery should fail for some reason. You need an extra disk as a destination for the clone, and it needs to be the same size or larger to make a complete copy of the original damaged disk. To CLONE a physically damaged disk for recovery, the following options are recommended for maximum reliability: -E:i to continue cloning after read errors (incl retries) -b:1 to force single sectors reads, this is very slow but will result in a minimum number of unreadable sectors Note: not needed anymore in DFSee version 7.09 and later since these automatically reduce buffer-size when bad-sectors are encountered. You might also want to change the number of retries on sector read errors from the default of 0 (no retries). To use retries to have a larger chance of recovering hard to read sectors after many retries ... To change this, you need to use the global -A: switch at startup, example: DFSOS2.EXE -A:3 Note: there have been a few reports of DFSDOS.EXE hanging after cloning many bad sectors using a retries (with -A:5). So assuming your damaged disk is placed as the 2nd disk in a system, and a new one is available as disk number 3, the cloning would be: DFSOS2.EXE -l:clone2 disk 3 ;select DESTINATION disk clone -E:i -b:1 -d:2 ;clone from DAMAGED disk q Of course you can use any of the DFSxxx.EXE versions ... The resulting logfile could become large if many read errors occur, but could be very useful afterwards to check where the bad spots have been. Immediately after the cloning has completed, it is advised to change the partition types on the new disk to types NOT recognized by the operating system, to avoid automatic CHKDSK/SCANDISK operations. If you don't do this, recovery might be made very difficult or even impossible ... You might even need to do this on the damaged disk too, if still possible. Note that unreadable sectors on the destination disk will have a content of all 0xFE bytes, easy to recognize as invalid ... _______________________________________________________________________________ #520 Find files on damaged FAT 52) Find files on a damaged FAT partition Since the FAT filesystem does not have a data structure for each file, like NTFS and HPFS do, it is harder to find files. There is a SUBFIND command however that will find all sectors that have ".." directory entry Together with the (new) -d option on the LIST command (implies -l-) this can be used to create a listing of all files in those subdirectories. DFSDOS.EXE -l:fnames part 1 ;select a FAT partition subfind ;find subdirectory sectors list -d ;list contents, but keep list. The resulting 'fnames.log' can be used to find missing files by name, and they can be recovered by redisplaying the directory in question and then use the .NNN command plus a SAVETO command to copy the filedata. Note: On older versions this was impossible because listing a directory would destroy the search result list, replacing it with the files in the displayed directory. _______________________________________________________________________________ #530 Fix extends-beyond eror 53) Fix a "WARNING : Logical partition extends beyond EBR extended-container" This warning will be given together with the partition ID (PID). There are two ways to fix this problem: You can change it interactively using the PTE command, type the command: PTE -p:PID on the DFSee command line, where PID is the DFSee partition ID for the partition (taken from the warning or left column in "part" display). Now you will see a display of the partition table for that partition. Note the value that it shows (in blue text) in the "end cyl" field. The value in yellow on green is the same or exactly 1023. (int13 limited). Using the key, you will see the previous partition table, with the extended-container for the partition in question. On this display it should show the same value for the "end cylinder" but in this case it will be LESS (that is what the warning is about). If you type the correct value over the displayed value in the input field (yellow on green) and to the next field, it will be updated. The related fields will be updated as well to keep everything consistent. If the shown values seem OK, press to write the changes to disk. The second method is simply deleting the partition with "DELETE PID" and create it again using the right type, size and so on ... This will recreate it without damaging any data. _______________________________________________________________________________ #540 Repair multiple partition JFS volume 54) Make a multiple partition JFS LVM-volume accessible again Sometimes LVM information gets damaged by disk-tools or by system crashes. For multiple partition JFS volumes, this often results in OS/2 or eCS not assigning a drive-letter anymore because the LVM info is not consistent. To recover this, you need to update the LVM-information on EACH of the involved partitions, making them consistent again. The most important requirements for such a volume are: - The LVM partition names for each partition in the set must be different - The LVM volume name recorded with each one must be exactly equal - The assigned drive-letter recorded with each one must be identical As an example, if you have a large JFS volume that has 3 partitions residing on DFSee partition IDs (PID) 03, 05 and 14, you can create consistent LVM information using: DFSDOS.EXE -l:jfsmulti lvm 03 -v:"jfs 3 part multi" -p:"disk1-multipart-1" -l:K lvm 05 -v:"jfs 3 part multi" -p:"disk1-multipart-2" -l:K lvm 14 -v:"jfs 3 part multi" -p:"disk2-multipart-3" -l:K Note: Recovering LVM-info this way will only work if the LVM-signature sectors and related information, which resides at the END of each partition is still intact. If that is damaged too, it will be nearly impossible to recover the JFS volume. You might be able to use LVM.EXE with a "create from existing partition" selecting each of the partitions in turn, but that should be done in the exact same order as originally. _______________________________________________________________________________ #550 Shorten LVM names 55) Shorten LVM disk-, Volume- and Partition names to 19 positions maximum This may be needed when long names have been created using LVM.EXE, it can cause display problems with 'lvm /query' and it causes all sorts of problems for tools using the LVM-API (like eCS 1.1 install) To avoid problems, these names should not have more than 19 characters. DFSee will give a warning on the 'PART' command for each disk and partition with a name longer than 19 characters. To shorten all volume names and partition names for all partitions use: lvm -P- * ;shorten volume+partition names lvm -P- -n ;shorten disk names Or, if you want to have the chance to edit the disknames: lvm -n ;shorten disk names, with prompt To edit the volume and partition names, just start the lvm dialog interactively and edit each name as appropriate and use the key to get to each partition in turn: lvm ;start interactive lvm dialog _______________________________________________________________________________ #560 Display compact partition overview 56) Create a compact partition listing, suitable for email and newsgroups This may be needed when you want to post an overview of the most important partition information to a newsgroup or email it. Typical DFSee output is 80 characters wide and might contain special characters so it easily causes all sorts of formatting problems like line-wrapping when displayed or handled by an email or news program. The simplest way to get such a list is: DFS query and to get it into a file: DFS query > filename or, even better DFS -l query You can also reduce the output more by leaving out the copyright: DFS -B- -l:filename query Finally, since the "query" command is just a synonym for "part -C -m" you can also add other "part" options to the command, examples: DFS query -v ;verbose list all partitions DFS query -m- -d:2 ;just disk 2 DFS query -C- -m- ;the standard 'framed' table DFS query -t- -m- -w ;list warnings only DFS query 3 ;show partition 3 DFS query -d:2 1,r ;show 1st partition on disk 2 In all cases, the 'DFS' program can be either DFSDOS, DFSOS2 or DFSWIN _______________________________________________________________________________ #570 Set IBM BM default 57) Set the default selection on the IBM BootManager menu With this you can force the IBM BootManager menu to always come up with the specified name/partition being selected, causing that to boot after the timeout even if you booted something else the last time. DFS.EXE setboot -0:"sysname" ;to set default selection to "sysname" q You can also reset it to always default to the 'last booted' system. DFS.EXE setboot -0- ;to set default to 'last booted' q You can do it directly from the command line too: DFS setboot -0- Note that the option is a ZERO not the letter O! _______________________________________________________________________________ #580 Update MBR code 58) Updating the boot code in the MBR sector, NEWMBR This will replace the boot code called by the BIOS (first disk usually) by generic code from DFSee. Doing this will get rid of any unwanted code there like boot managers or even worse virii. DFS.EXE newmbr 1 ;refresh boot code in MBR on disk 1 q You can also erase ALL partitions by clearing the partition table: DFS.EXE newmbr 1 -c ;refresh code and clean table q From the DFSee menu you can do the same using: Mode=FDISK -> New MBR Code KEEP tables -> 1 .. select disk or, to erase the partition table too: Mode=FDISK -> New MBR Code Erase tables -> 1 .. select disk That menu entry both REPLACES the boot code called by BIOS to startup your system (mostly important for the first disk) and it completely erases the partition table in that same MBR sector. And although it does not really are the other partition tables in any extended boot records (EBR) for you logical partitions, it does make all of those invisible since the reference to them in the MBR-table is gone. It does NOT erase any LVM or other information though, the command is limited to the very first sector on the disk only (MBR). _______________________________________________________________________________ #590 Remove LVM info 59) Remove LVM information from existing partition(s) You can't completely remove the LVM info from ONE partition using DFSee, but there are two methods that come close: A) Remove all RELEVANT info from the LVM info for a partition This will delete everything that is normally used or displayed for an LVM volume. As an example, for partition 06: lvm 06 -D -v- -p- -l- -m- -i- After applying it will NOT be considered a volume anymore. However, the LVM sector for the partition will still contain the disk name, the partition size, and LVM signature and a valid CRC. Using this partition with DFSee, LVM.EXE or LVMGUI would look the same as using a freshly created partition without any LVM info. B) Remove (erase!) all LVM sectors for a disk This will set the LVM-info and LVM-signature sectors to ZERO! pclear ls -d:n Where 'n' is the disk-number or '*' for all disks. Both commands are documented in DFSFDISK.TXT. _______________________________________________________________________________ #600 Recover single file 60) Find and recover a SINGLE deleted file (NTFS or HPFS) Command Explanation DFSee ;Start DFSee and scan physical disks part 01 ;select the right partition delfind document ;find file with 'document' in name delshow *document* ;optional check, list files ... recover x:\tmp ;recover all files to X:\tmp\ dir When there are more than one file listed, you can use a selection wildcard on the recover as well, as in: recover x:\tmp *mydoc* ;recover only files matching 'mydoc' Notes: - It's best to use a different drive to avoid overwriting - The wildcard used on 'delshow' and 'recover' can contain multiple wildcard characters, and deals with the FULL PATH and filename, so you can include (parts of) the directory too. - You can also undelete a single file using the 'saveto' command and specifying the files sequence number: .NNNNN shown at the left of the 'list' output. _______________________________________________________________________________ #610 Compressed backup from RAW file 61) Create a compressed backup of a RAW imagefile (like SVISTA .HDD) ==> to be refined, redo using the RAW2IMZ command Command Explanation DFS -d- ;start DFS, no physical disk scan raw2imz warp4.hdd ;open RAW, create compressed image ;using the same (base) filename A faster way to do that fom the OS2 commandline using dialogs is: dfs -d- raw2imz warp4.hdd _______________________________________________________________________________ #620 Restore compressed backup 62) Restore a compressed backup to a RAW imagefile (like SVISTA .HDD) ==> to be refined, redo using the IMZ2RAW command Command Explanation echo whatever > warp4.hdd ;create (nearly) empty file DFS -d- ;start DFS, no physical disk scan imz2raw warp4.imz warp4.hdd ;open nearly empty image _______________________________________________________________________________ #630 Edit JFS filename (low level) 63) Edit a filename in a JFS directory structure, using the HEX-editor Note: With the later DFSee versions (15.x and newer) it is MUCH easier to use the standard functionilty in BROWSE to do the rename (see #320) It is not very easy, but doable. The way it works is navigate from the root directory towards the offending filename, using DFSee display commands and each time selecting the next level by using a '.NNN' command to pick a specific entry (file/directory). When the directory containing the incorrect filename is shown you start the HEX-editor on the directory structure. (use ) and carefully edit the offending filename. You must be aware that this are BTREE structures, so finding any filename depends on the sort-order. This means you should NOT change the alphabetic sort order of the entries, which may happen easily when changing the first letter in a filename ... If you DO happen to change the order, the file will still NOT be accessible later (although it will probably not trap either). It might be removed by CHKDSK in that case ... The easiest way to get to the correct directory is using the DFSee commandline that you get to using from the menu. I will show an example below, to navigate to the file: j:\toolkit\h\pmwp.h That is on a JFS partition of mine. I will show each command to be entered to get there, and (part of) the screen output that generates ... You start with a command to select the partition, followed by a few 's to get to the ROOT directory display: DFS part 13 Eventually resulting in a display like this: ++++++++++ DFSee OS/2 8.14 : Executing: FAT style Attrib. : D Inode Links : Parent Inode nr : 0x00000002 1st link Filename : Filename fullpath : \ File size (exact) : 0x00001000 = 4096 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 00029F18 0x000053e3 ++++++++++ The last line is the link to the real contents of the directory. For a directory with many files there may be more than one line, each with its own '.NNN. number (see later example). So now we select that one link: .0 And get a complete directory listed: +++++++++++++ DFSee OS/2 8.14 : Executing: .0 CRC=96fb7246; LSN : 0x00029F18 = Dir Btree+ Page Cyl 6119 H: 87 S: Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00B40008 07-12-2002 20:36:56 A 4096 ÄÄÄÁ D770 @home .001Ú00B62E83 08-04-2007 11:10:20 08-04-2007 11:10:27 256 ÄÄÄÁ D770 @info .013Ú00952988 11-09-2002 12:55:18 A 02-03-2007 16:58:50 8192 ÄÄÄÁ D770 pkg .014Ú00AC8E40 11-09-2002 13:08:46 A 4096 ÄÄÄÁ D770 toolkit .015Ú00AF85E0 11-09-2002 13:09:26 A 4096 ÄÄÄÁ D770 toolkt13 === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our directory 'toolkit' listed as number .014 Selecting that, using: .14 Results in the next level directory INODE: +++++++++++++ DFSee OS/2 8.14 : Executing: .14 CRC=f6eaef7e; LSN : 0x00AC8E40 = Directory Inode Cyl 6855 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 0048DFF0 0x00091bfe +++++++++++++ And another gets the actual contents: +++++++++++++ CRC=c92ab0c2; LSN : 0x0048DFF0 = Dir Btree+ Page Cyl 6423 H:209 S: Dtree Pg Self @Bl : 0x00091BFE Size: 0x0001 blocks = 0x00000008 = Next page @Bl : 0x00000000 sector LSN : 0x00000000 Previous page @Bl : 0x00000000 sector LSN : 0x00000000 Dtree page flags : 0x02 0x09 Reserved-2 : 0xa67c entries: 19 Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00AC8E41 15-08-2005 19:18:30 A 364 ÄÄÄÁaccessed 11-03-2007 15:50:42 660 -README- .001Ú00AC64E9 11-09-2002 13:08:46 A 4096 ÄÄÄÁ D770 bin .004Ú00AC9FB0 11-09-2002 13:08:54 A 4096 ÄÄÄÁ D770 dll .005Ú00ACA6C0 11-09-2002 13:08:54 A 12288 ÄÄÄÁ D770 h .006Ú00ADEDD8 11-09-2002 13:08:58 A 4096 ÄÄÄÁ D770 help === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our next level directory 'h' listed as number .005 Selecting that, using: .5 Results in the next level directory INODE: +++++++++++++ DFSee OS/2 8.14 : Executing: .5 CRC=a64710d3; LSN : 0x00ACA6C0 = Directory Inode Cyl 6856 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 004895F8 0x000912bf .001 004898F8 0x0009131f PMSEI.H .002 0048DDE8 0x00091bbd WPKEYBD.X +++++++++++++ This is a bit more complicated than before, the INODE contains a few 'splitpoints' that each link to a directory data structure. You need to find the correct branch to follow by comparing your filename (here 'pmwp.h') alphabetically with each entry, until this entry is 'smaller' and the next entry is 'larger' In our case that is between 'PMSEI.H' and 'WPKEYBD.X' so our pmwp.h must be in the .001 branch ... So selecting the correct 'branch' in the tree gets the actual contents: .1 +++++++++++++ CRC=7f563cb2; LSN : 0x004898F8 = Dir Btree+ Page Cyl 6422 H:160 S:5 Dtree Pg Self @Bl : 0x0009131F Size: 0x0001 blocks = 0x00000008 = Next page @Bl : 0x00091bbd sector LSN : 0x0048dde8 Previous page @Bl : 0x000912bf sector LSN : 0x004895f8 Dtree page flags : 0x02 0x01 Reserved-2 : 0x0a23 entries: 123 Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00ACFAEC 20-10-2000 00:19:00 A R 2723 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmsei.h .001Ú00ACFAED 20-10-2000 00:18:00 A R 21594 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmshl.h .002Ú00ACFAEE 20-10-2000 00:18:00 A R 51114 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmspl.h .003Ú00ACFAEF 20-10-2000 00:18:00 A R 117836 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmstddlg.h .004Ú00ACFAF0 20-10-2000 00:19:00 A R 11021 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmtypes.h .005Ú00ACFAF1 20-10-2000 00:18:00 A R 176052 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwin.h .006Ú00ACFAF2 20-10-2000 00:18:00 A R 11131 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwp.h .007Ú00ACFAF3 16-10-2000 20:27:00 A R 29453 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwsock.h .121Ú00AD3FD6 29-12-1999 02:25:00 A R 12671 ÄÄÄÁaccessed 11-03-2007 15:50:50 660 wpjob.xh .122Ú00AD3FD7 29-12-1999 02:19:00 A R 29067 ÄÄÄÁaccessed 11-03-2007 15:50:50 660 wpkeybd.h === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our next level, the wanted file 'pmwp.h' listed as number .006 We do NOT want to select that (would show file INODE) but instead want to EDIT this directory structure to change the name. Either use at this point to edit it sector-by-sector, or to edit the whole 4096 byte structure as one object, use: edit -s:8 It will pick up the sector-number to edit from the structure that has just been displayed (last used, or 'this' value) The HEX-editor will start and show a display like: +++++++++++++++ [PgUp] 0 1 2 3 4 5 6 7 8 9 a b c d e f [ItemUp] [LineUp] 000000 bd 1b 09 00 00 00 00 00 bf 12 09 00 00 00 00 00 [................] 000010 02 7b 00 ff 80 01 23 0a 01 00 00 00 1f 13 09 00 [.{....#.........] 000020 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 [................] 000030 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 [........... !"#$] 000040 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 [%&'()*+,-./01234] 000050 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 [56789:;<=>?@ABCD] 000060 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 [EFGHIJKLMNOPQRST] 000070 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 [UVWXYZ[\]^_`abcd] 000080 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 [efghijklmnopqrst] 000090 75 76 77 78 79 7a 7b 7c 7d 7e 7f 24 15 fc 18 fc [uvwxyz{|}~.$....] 0000A0 4c 73 04 00 ff 07 70 00 6d 00 73 00 65 00 69 00 [Ls....p.m.s.e.i.] 0000B0 2e 00 68 00 38 0c ff 04 05 7b 04 fc 1d 49 fc 1f [..h.8....{...I..] 0000C0 4d 73 04 00 ff 07 70 00 6d 00 73 00 68 00 6c 00 [Ms....p.m.s.h.l.] 0000D0 2e 00 68 00 fc 0f 49 fc 31 30 fc 0f 49 fc 29 0e [..h...I.10..I.).] 0000E0 4e 73 04 00 ff 07 70 00 6d 00 73 00 70 00 6c 00 [Ns....p.m.s.p.l.] 0000F0 2e 00 68 00 3f fc 2a fc 09 fc 3e fc 09 30 1c fc [..h.?.*...>..0..] 000100 4f 73 04 00 ff 0a 70 00 6d 00 73 00 74 00 64 00 [Os....p.m.s.t.d.] 000110 64 00 6c 00 67 00 2e 00 68 00 04 02 21 ff 02 08 [d.l.g...h...!...] 000120 50 73 04 00 ff 09 70 00 6d 00 74 00 79 00 70 00 [Ps....p.m.t.y.p.] 000130 65 00 73 00 2e 00 68 00 08 04 ff 06 05 aa 01 04 [e.s...h.........] 000140 51 73 04 00 ff 07 70 00 6d 00 77 00 69 00 6e 00 [Qs....p.m.w.i.n.] 000150 2e 00 68 00 34 fd 03 ff 04 1d d1 c7 36 ff 02 08 [..h.4.......6...] 000160 52 73 04 00 ff 06 70 00 6d 00 77 00 70 00 2e 00 [Rs....p.m.w.p...] 000170 68 00 41 00 0c 00 ff 04 1d d1 c7 11 ff 02 08 00 [h.A.............] 000180 53 73 04 00 ff 09 70 00 6d 00 77 00 73 00 6f 00 [Ss....p.m.w.s.o.] 000190 63 00 6b 00 2e 00 68 00 01 04 02 43 ff 02 08 04 [c.k...h....C....] +++++++++++++++ Where our 'pmwp.h' filename is shown as UNICODE characters in the lines marked 000160 and 000170. You can change the name now either typing new hexadecimal values on the left side of the edit-window, or using ASCII values on the right. You switch between the two using the key. The edit position is where the normal cursor is, and the same position in the other pane will be highlighted in purple ... For changing the 'funny' characters to regular ASCII ones, it may be the easiest to edit in HEX, making sure every other byte in the filename is a zero (00). make sure you do not modify any of the 'non-filename' bytes, and that the sort-order remains the same when possible. Changed bytes will be painted in yellow for convenience. When done, hitting will get you a confirmation dialog to write the sector/object back to the disk ... _______________________________________________________________________________ #640 Delete file from JFS (low level) 64) Delete a file from a JFS filesystem (undeletable, strange characters etc) To find the files INODE, just type the complete path (without driveletter): DFSee OS/2 10.2 : Executing: \toolkit\h\pmwp.h RootDir Inode nr : 00000002 find path: 'toolkit\h\pmwp.h' Directory Inode @ : 0x00001232 Dtree - Page LSN : 0x000555F8 - Inode 00036455 for 'toolkit' Directory Inode @ : 0x00D1EC45 Dtree - Page LSN : 0x005CE3F0 - Inode 00037020 for 'h' Directory Inode @ : 0x00D800E0 Dtree - Page LSN : 0x005CE2F8 - Inode 000370D5 for 'pmwp.h' CRC=e288228f; LSN : 0x00D813F5 = File Inode Cyl 9318 H:136 S:61 0865EA14 Fileset InoStamp : 0x47a4a349 = 02-02-2008 17:07:21 Inode self number : 0x000370d5 = 225493 FileSet : 0x10 Generation : 172433 Owning User (Uid) : 0x00000000 = 0 (root) Group : 0x06 6 (disk) File Mode (660) : 0x420481b0 = -rw-rw---- FAT style Attrib. : A R Inode Links : 1 File size (exact) : 0x00002B7B = 11131 Allocated size : 0x00003000 = 12288 Inode extent @Bl : 0x001B027C Size: 0x0004 blocks = 0x00000020 = 16.0 KiB Last Access time : 20-09-2009 18:29:25 Last Status : 02-02-2008 12:36:05 Last Modify time : 20-10-2000 00:18:00 Creation : 20-10-2000 00:18:00 Description for a : Regular File Btree Root + Leaf nodes Allocation Check : OK Saveto/Recover/Undelete of filedata is possible RelBlock Extent-size Data-LSN ========== ================== ======== B 00000000 000018 = 12.0 KiB 00D81DC8 Now WIPE this INODE structure (one sector) using the command: wipe z . 1 After this you should reboot, and after that BEFORE accessing this driveletter in any other way execute a CHKDSK: chkdsk j: /f Where j: is the driveletter of the JFS filesystem in question. As is often the case, this description looks a lot more complicated that executing the actual procedure :-) _______________________________________________________________________________ #650 Rename JFS file (low level) 65) Rename a file on a JFS filesystem (strange characters etc) As an alternative for #64, which may be a bit drastic, you can often RENAME such a mis-behaving file at a low level, using the sector editor. Note: With the later DFSee versions (15.x and newer) it is MUCH easier to use the standard functionilty in BROWSE to do the rename (see #320) Instead of the full path, you just type the path to the directory, like: DFSee OS/2 10.2 : Executing: \toolkit\h\ Command timestamp : Saturday 2010-02-27 16:51:53 RootDir Inode nr : 00000002 find path: 'toolkit\h\' Directory Inode @ : 0x00001232 Dtree - Page LSN : 0x000555F8 - Inode 00036455 for 'toolkit' Directory Inode @ : 0x00D1EC45 Dtree - Page LSN : 0x005CE3F0 - Inode 00037020 for 'h' CRC=b5c9cbf5; LSN : 0x00D800E0 = Directory Inode Cyl 9318 H: 59 S:27 0865D6FF Fileset InoStamp : 0x47a4a349 = 02-02-2008 17:07:21 Inode self number : 0x00037020 = 225312 FileSet : 0x10 Generation : 172231 Owning User (Uid) : 0x00000000 = 0 (root) Group : 0x06 6 (disk) File Mode (770) : 0x200141f8 = drwxrwx--- FAT style Attrib. : D Inode Links : 13 File size (exact) : 0x00003000 = 12288 Allocated size : 0x00003000 = 12288 Inode extent @Bl : 0x001B001C Size: 0x0004 blocks = 0x00000020 = 16.0 KiB Last Access time : 02-02-2008 12:36:04 Last Status : 02-02-2008 12:36:06 Last Modify time : 02-02-2008 12:36:06 Creation : 02-02-2008 12:36:04 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 005CE2E0 0x000b9c5c .001 005CE2F8 0x000b9c5f PMSEI.H .002 005CE3D8 0x000b9c7b WPKEYBD.X ReadWrite Store A : PhysDisk : 1 PartId 11 = J: mode=JFS 270210-165154 RC:0 : 005CE2E0 u=00D800E0 x=00000078 this=00D800E0 Base=078DD61F DFSee OS/2 10.2 : Executing: .1 Command timestamp : Saturday 2010-02-27 16:51:57 CRC=030dc9c5; LSN : 0x005CE2F8 = Dir Btree+ Page Cyl 8784 H:146 S:42 07EAB917 Dtree Pg Self @Bl : 0x000B9C5F Size: 0x0001 blocks = 0x00000008 = 4.0 KiB Next page @Bl : 0x000b9c7b sector LSN : 0x005ce3d8 Previous page @Bl : 0x000b9c5c sector LSN : 0x005ce2e0 Dtree page flags : 0x02 0x01 Reserved-2 : 0x7573 entries: 123 Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize Inode EA's === ======== =================== ==== =================== ======== ====== ===== .000+00D813EF 20-10-2000 00:19:00 A R 2723 370cf ---+accessed 20-09-2009 18:29:25 660 pmsei.h .001+00D813F0 20-10-2000 00:18:00 A R 21594 370d0 ---+accessed 20-09-2009 18:29:25 660 pmshl.h .002+00D813F1 20-10-2000 00:18:00 A R 51114 370d1 ---+accessed 20-09-2009 18:29:25 660 pmspl.h .003+00D813F2 20-10-2000 00:18:00 A R 117836 370d2 ---+accessed 20-09-2009 18:29:25 660 pmstddlg.h .004+00D813F3 20-10-2000 00:19:00 A R 11021 370d3 ---+accessed 20-09-2009 18:29:25 660 pmtypes.h .005+00D813F4 20-10-2000 00:18:00 A R 176052 370d4 ---+accessed 20-09-2009 18:29:30 660 pmwin.h .006+00D813F5 20-10-2000 00:18:00 A R 11131 370d5 ---+accessed 20-09-2009 18:29:25 660 pmwp.h .007+00D813F6 16-10-2000 20:27:00 A R 29453 370d6 ---+accessed 20-09-2009 18:29:25 660 pmwsock.h .008+00D81DE0 02-02-2008 12:36:05 256 37100 Starting the Hex-editor at that point () will show the Unicode representation of the filename: ++++++ Hex editor screen fragment 000140 d4 70 03 00 ff 07 70 00 6d 00 77 00 69 00 6e 00 [.p....p.m.w.i.n.] 000150 2e 00 68 00 63 68 61 72 73 65 74 3d 22 75 73 2d [..h.charset="us-] 000160 d5 70 03 00 ff 06 70 00 6d 00 77 00 70 00 2e 00 [.p....p.m.w.p...] 000170 68 00 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e [h.ansfer-Encodin] 000180 d6 70 03 00 ff 09 70 00 6d 00 77 00 73 00 6f 00 [.p....p.m.w.s.o.] 000190 63 00 6b 00 2e 00 68 00 3a 20 59 6f 75 72 20 4d [c.k...h.: Your M] ++++++ And you can edit at the left side (hex) or TAB to the right side to change the filename. Note: Avoid to edit the first few letters of a filename, since that may cause JFS-directory errors. This is because JFS (like HPFS) uses a B-tree ordering in the directories for quick access. Real life example of renaming a file on JFS: ============================================ As an example, the following steps take you to a file called 'testfile' in the H:\tmp directory (which is JFS): part h: ;select the H: partition \tmp ;locate Inode for \tmp d ;display 'next' level (dir contents) This will result is a (long) list of filename information, and if you are lucky your file is amongst them (1 block of DIR info shown). The DFSee dir list after '\tmp' and 'd' shows: +++++++++++ .061?00E5F331 15-02-2010 12:48:46 A 7 40819 ???? 660 testfile.txt +++++++++++ When listed, you start the hex-editor at that point with and locate the filename in there, page down until you find it. The tricky part here is that this is all UNICODE, so each character takes two bytes (with the upper one usually being zero). Still it is not too hard to locate the filenames. My testfile.dat looks like: +++++++++++++ 19 08 04 00 ff 0c 74 00 65 00 73 00 74 00 66 00 [......t.e.s.t.f.] 69 00 6c 00 65 00 2e 00 74 00 78 00 74 00 72 00 [i.l.e...t.x.t.r.] 6f 01 5f 00 73 00 72 00 63 00 2e 00 7a 00 69 00 [o._.s.r.c...z.i.] +++++++++++++ The DFSee dir list after '\tmp' and 'd' now shows: +++++++++++ .061?00E5F331 15-02-2010 12:48:46 A 7 40819 ???? 660 testdata.txt +++++++++++ Which is displayed with a regular OS/2 DIR command as: ============= Directory of H:\tmp 9-02-09 21:34 35.840 0 a--- test1.pd1 15-02-10 12:48 7 0 a--- testfile.txt ============= And after changing the bytes for 'file' to 'data' it looks like: +++++++++++ 19 08 04 00 ff 0c 74 00 65 00 73 00 74 00 64 00 [......t.e.s.t.d.] 61 00 74 00 61 00 2e 00 74 00 78 00 74 00 72 00 [a.t.a...t.x.t.r.] 6f 01 5f 00 73 00 72 00 63 00 2e 00 7a 00 69 00 [o._.s.r.c...z.i.] +++++++++++ Note that you can change between the left (HEX) side of the editor to the right (ASCII) side by using the TAB key. One thing to note is that when possible, you should NOT change the start of the filename, since that is crucial in finding it in the directory by JFS itself. It is a B-tree which relies on a certain sort-order for the name to work ... So in your case, keep the 'COTHR' part of the name the same and just change the pentagon shaped funny character after it. You may be able to do that in the ASCII part of the display, or if it is a Unicode value (with the first byte being non-zero) you can make that byte zero in the left (HEX) side, just type zeroes of whatever value is displayed there. (for example change '07 3d' to '00 41' to make it a capital 'A') After this change the DFSee dir list after '\tmp' and 'd' now shows: +++++++++++ .061?00E5F331 15-02-2010 12:48:46 A 7 40819 ???? 660 testdata.txt +++++++++++ And the 'DIR h:\tmp\test*' now shows: =========== Directory of H:\tmp 9-02-09 21:34 35.840 0 a--- test1.pd1 15-02-10 12:48 7 0 a--- testfile.txt =========== So nothing changed there, this is because of directory caching by the JFS.IFS. The easiest way to flush the cache is by rebooting ... After that it should show: =========== Directory of H:\tmp 9-02-09 21:34 35.840 0 a--- test1.pd1 15-02-10 12:48 7 0 a--- testdata.txt =========== And it did :-) Confirmed that after rebooting ... _______________________________________________________________________________ ----------------------------[ www.dfsee.com ]-------------------------------