DFSee version 17.0 2022-10-22 (c) 1994-2022: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Terminology used Note: for command descriptions and usage examples see the other dfs*.txt files _______________________________________________________________________________ T E R M I N O L O G Y U S E D: _______________________________________________________________________________ #010 dot-number dot-number A numeric value, preceded with a period, which is used to .NNNNN select a sector number from the Sectorlist. The first sector in the list will be '.0' and the largest value depends on the DFSee version. (see "Sectorlist") Leading zeroes can be left out, so ".18" equals ".000018" It can have any number of digits, up to the maximum value. A .NNNNN number is a valid 'symbolic SN' as well ... _______________________________________________________________________________ #020 Attempts Attempts Attempts to read the contents of a sector from any store. When problems occur on reading, the read might be retried a number of times. The default for this is 0 (no retries), but it can be set to any number using the "-A:nnn" switch on startup The total number of retries that occurred on an open store will be displayed using the 'store' command. _______________________________________________________________________________ #030 Auto-quit Auto-quit A property that can be set explicitly using the -Q switch, or that is standard on selected commands like query. It results in DFSee quiting automatically after executing this command, if and only if the command was specified as a parameter to the program. This makes batch-procedures easier to read since no explicit '#q' command needs to be appended to the command line. _______________________________________________________________________________ #040 Base Base This is the base sector number (PSN) that equals LSN-0. When the current opened entity is a partition, it will be the PSN for the first sector of the partition being viewed. It is displayed at the end of the DFSee statusline and can also be displayed using the 'store' command. There is also a 'base' command that can be used to specify this base value manually, as well as the 'limit' value. It has options to set the BASE for various areas like freespace. The base and limit values will normally be set automatically when opening any entity like a partition. _______________________________________________________________________________ #045 BIOS-Geo BIOS-Geo BIOS geometry This is the geometry reported for a disk using the BIOS interface It is for reporting and anlysis usage only, DFSee does not use the BIOS-Geo in any way Currently, the BIOS geometry is retrieved and displayed by the DOS and OS2 versions of DFSee only. This is sometimes useful to analyse disk ordering problems between BIOS and operating system. _______________________________________________________________________________ #050 BootManager BootManager A program that controls booting one out of several bootable BMGR partitions on your harddisks. There are many implementations BM residing either in their own partition, using some space in a FAT partition or only a few 'reserved' sectors near the master boot record (MBR). Well known boot managers are the IBM one (with OS/2 or eCS), the one used with Windows-NT/2000/XP (NTLDR + BOOT.INI), the Linux-loader LILO, and System Commander. Within DFSee most references to it deal with the IBM version of the BootManager which has been shipped with OS/2 since the earliest 2.0 releases. The latest incarnation as used on eCS, WSeB and the Convenience Packs MCPx/ACPx is fully integrated with the LVM technology used in those versions and also has better support for booting beyond the 1024 cylinder limit and 2nd/3rd disks. DFSee will display the IBM BootManager in its normal partition overview, and will indicate the exact version using the creator and label columns as follows: Format Creator VolumeLabel comment ====== ======= =========== ============================ BMGR FDISK MaxCyl:1023 Classic BM up to Warp-4 FP-14 limited to 1023 cylinders or about 7.8 GiB on most disks BMGR FDISK I13X-aware New BM, not LVM aware but can address beyond cylinder 1023 BMGR LVM I13X-aware Latest BM, uses LVM and can address beyond cylinder 1023 In addition to this, there will be explicit warnings given if bootable partitions exist beyond cylinder 1023, and either the MBR-code or BMGR does NOT support the I13X convention. _______________________________________________________________________________ #060 BOOT.INI BOOT.INI Windows (NT, 2000, XP) INI file for the windows boot manager. BOOTINI This file is ASCII (readable) and contains several lines with BI operating systems/partitions to be booted. If more than the original Windows installation is present, the user will be presented a boot menu at startup of the Windows partition with one line for evey available boot system. Since the partitions to be booted are identified using an index like '...partition(2), the file needs maintenance when the order or number of partitions changes. For this reason the correct BOOT.INI index for each partition is calculated by DFSee, and displayed in several places like the detailed partition view, and the 'part -s' table overview. For the FAT(32) and NTFS filesystems, DFSee has commands to find the file, and display the correct index-value for that specific partition. When incorrect, it can be updated as well using the BOOTINI command or related menu items. _______________________________________________________________________________ #070 Boot Boot sector The very first sector of a filesystem that usually holds some Boot record critical information about it like: BR Boot code, used when the partition is bootable PBR Geometry and size info (boot parameter block) Location of filesystem tables (FAT, MFT, Superblock, RootDir) _______________________________________________________________________________ #080 CHS CHS Cylinder Head Sector (addressing) This is the classical way of addressing physical sectors on a disk. It is used in the PC's BIOS, in partition tables and in low-level disk I/O APIs (IOCTL, INT-13). In most implementations the addressing ranges are limited causing all sorts of problems with large disks/partitions. Inside partition tables they are stored in 3-byte combinations, see the description with 'HcSC' for the layout In partition tables, a second more important method of location specification is used, called 'LBA' Mismatches between the CHS and LBA values can cause warnings or errors from partitioning tools _______________________________________________________________________________ #090 CHS dummy CHS dummy CHS values used as placeholders when the 'real' values do not fit in the available space. (cylinder > 1023) There are several styles used in assigning these dummy values and some tools (OS/2 FDISK or LVM, PowerQuest Partition-Magic) give errors like 'partition table corrupt' when the 'wrong' style is used. DFSee accepts all the styles, and shows the the style used in the DISK and WALK displays (at end of line) The styles recognized and shown by DFSee are: Style: 0 = IBM 1 = PQ 2 = MS start-CHS: 1023 geo-1 geo 1023 real real 1023 255 63 example 1023 254 63 1023 0 1 1023 255 63 1023 254 63 1023 1 1 1023 255 63 end-CHS: 1023 geo-1 geo 1023 real real 1023 255 63 example 1023 254 63 1023 254 63 1023 255 63 used by: FDISK/LVM/DFSee PowerQuest tools Microsoft Note that the 'real' value is the corresponding C, H or S value as calculated from the linear LBA value using the current geometry, and 'geo' is the number of heads or sectors for that geometry. Values that do NOT conform to any of these styles will result in a CHS warning for that partition, and the style will be shown as "BAD" in bright red with the DISK or WALK command. _______________________________________________________________________________ #100 Clone Clone Make a sector by-sector copy of a disk, partition or volume to another. In DFSee this will be a store to store copy, where a store represents any disk, partition or volume. This allows large copy operations, like whole physical disks, without the need for intermediate image files. There are also COPY and MOVE menu items, and a MOVE command, that use the clone function but also update the partition tables automatically for the moved or copied partition. _______________________________________________________________________________ #110 Cluster Cluster A (small) group of adjacent sectors that are handled by the operating system as one allocation unit. It is used on FAT filesystems to allow large partitions at the cost of more wasted "slack" space, and on NTFS to balance performance, slack space etc. HPFS does not use sector clustering (or a cluster size of 1!) DFS will try to account for clustering where needed, for example in size calculations and where sector/cluster pointers are used in the filesystem internal structures. _______________________________________________________________________________ #120 Compatibility Compatibility An LVM volume that can also be used/seen by older operating volume systems, and that can be made bootable. The partition type for the partitions associated with this volume (always ONLY one!) has the usual values like 0x07 for HPFS and 0x06 for FAT16. Note: If you want to create a compatibility volume using LVM.EXE choose to create a volume that "can be made bootable" _______________________________________________________________________________ #130 DFSCHECK DFSCHECK A DFSee procedure to collect information about filesystems present in partitions defined on disks. It is implemented as internal command 'dfscheck' as well as an external script for various operating systems (.CMD/.BAT etc). There is a menu-items as well that will run this procedure: Actions -> DFSCHECK, Check filesystems -> ... select part ... The resulting files (DFSC*.p*) are REQUIRED by DFSee support for some recovery support requests by users of DFSee. _______________________________________________________________________________ #140 DFSDISK DFSDISK A DFSee procedure to collect information about disk partitions that are still present, or HAVE BEEN present at some time on a disk. The information can be used to recover the partitions. It is implemented as internal command 'dfsdisk' as well as an external script for various operating systems (.CMD/.BAT etc). There are also two menu-items that will run this procedure: Actions -> DFSDISK, Find partitions -> ... select disk ... Actions -> Find partitions, try harder -> ... select disk ... Where the first one is the default one to use, and the second one will search ALL sectors on a disk to find partitions and will be VERY SLOW for that reason. The resulting files (DFSDISKI.*) are REQUIRED by DFSee support for most recovery support requests by users of DFSee. _______________________________________________________________________________ #150 DFSxxx DFSxxx A generic term used as 'any of the available DFSee executables' DFSxxx.EXE DFSDOS.EXE, DFSOS2.EXE, DFSWIN.EXE, dfsee _______________________________________________________________________________ #160 Disk Disk A (physical) disk, usually containing one or more partitions. These are usually fixed disks in a computer system, driven by EIDE or SCSI controllers, but they can also be removable or external to the computer itself. _______________________________________________________________________________ #170 Disk-list Disk-list DFSee specific list of media that are accessible as a 'disk' using the 'disk-id' inside DFSee. Media that can be 'attached' to this list are physical disks, virtual disks, RAW or IMZ compressed images and Linux devices. By default, DFSee will attach all physical disks to this list at startup. The list can be displayed and maintained using the menu: 'File -> Media management' Note that attaching/detaching from this list does NOT have any effect on the media or operating system, it just makes them available within DFSee ... _______________________________________________________________________________ #180 DLAT DLAT Drive Letter Assignment Table, the term used by IBM to refer to the basic LVM information about volumes, kept in the LVM information sector near the corresponding MBR or EBR sector. (in the last sector of the same track). _______________________________________________________________________________ #190 DLAT-entry DLAT-entry A single entry in the DLAT, containing information about one partition. Just like the partition table, the DLAT contains exactly four entries, unused ones should be ALL ZEROES. If obsolete (non zero) entries are present, this can result in the "The partition table on this disk may be corrupt" message from the LVM program. _______________________________________________________________________________ #200 EBR EBR Extended Boot Record It contains no boot code like an MBR but only a partition table that holds the location of a single logical partition. It usually is located on the cylinder just before the actual logical partition itself, at Head-0, Sector 1. Each EBR will also point to the next EBR if more logical partitions exist on the same disk. _______________________________________________________________________________ #210 EBR-base EBR-base Location of the very first EBR sector, which is also the start of the complete 'Ext-container', and used as a base reference point for the location of all the following EBR sectors that are present _______________________________________________________________________________ #220 eCS eCS eComStation, the client version of the latest OS/2 release as marketed by Serenity Systems. This is the OS/2 4.5x kernel delivered with a lot of additional Desktop enhancements and applications as well as an easier installation procedure. _______________________________________________________________________________ #230 EFI EFI Extensible Firmware Interface EFI is a new standard for the interface provided by the firmware that boots PCs, based on the Extensible Firmware Interface Specification, Version 1.02 (Intel Corporation). It replaces many of the existing (BIOS, APM) standards. Microsoft supports EFI as the only firmware interface for booting 64-bit Windows operating systems. The new Apple MAC (iMAC, MacBook) computers introduced early 2006 and based on Intel chips will also use this. See GPT for the associated new partitioning style _______________________________________________________________________________ #240 Ext-chain Ext-chain Extended partition chain, this is the list of all extended boot records (EBR) each [except last] holding a partition table with two entries: 1) An entry for the logical partition involved, with partition types like FAT (0x06), HPFS (0x07) or any other defined type 2) An entry pointing to the next EBR in the chain, with partition type 0x05 (standard) or 0x0f for Windows-partitions beyond 1024 cylinders. The last EBR lacks item (2), by definition. There is an entry in the partition table in the MBR that points to the first EBR, this also has type 0x05 or 0x0f. (also see Ext-container) If an EBR lacks item (1), it is called an EMPTY container, which may cause problems with other partitioning tools! DFSee will never create an empty container, and you can remove them using the CLEANUP command. You cannot create any primary partition in a freespace area that contains such an empty container, and can not COPY/MOVE primary partitions there. _______________________________________________________________________________ #250 Ext-container Ext-container The extended container is the area of the disk that includes all logical partitions (and NO primaries). It has an entry in the partition table in the MBR, and counts towards the limit of 4 entries total. This leads to the following two practical limits: - 4 primary partitions, and NO logicals, or - 3 primary partitions plus an unlimited number of logicals _______________________________________________________________________________ #260 Extended-X Extended-X Extended container type 0x0f, as used by Microsoft Win9x. See also: Part-tables explanation _______________________________________________________________________________ #270 Ext-Int-13 Ext-Int-13 Extended INT-13, a new BIOS interface that breaks the 1024 cylinder limit. Implemented on recent (EIDE/ATA) BIOS'es (DFSDOS) and some operating system drivers (like Win9x Dosbox) Due to several problems with different implementations, DFSee will recognize the existence, but only use Ext-Int-13 on disks really larger than the limit (1024 cylinders) Support for extended int13 by the IBM BootManager and the related MBR-code and OS/2 bootsectors is called "I13X" _______________________________________________________________________________ #280 FAT FAT File Allocation Table, the most important structure in the classic DOS filesystem that also gave it its name. It is a table of cluster numbers that indicates the cluster that holds the next part of the current file or directory, or indicates that this was the last cluster. The first cluster of a file is pointed to by the directory entry that also has the filename, size and the flags. This way the location of each cluster of a file can be easily found by following this "allocation-chain". The size of one entry in this FAT is usually 2 bytes (16bit), and clusters of maximum 32KiB, resulting in the largest FAT16 filesystem of 2GiB. (4GiB on Win-NT with 64KiB clusters) On small disks (and diskettes) a 12-bit FAT is used, and for really large disks the FAT32 filesystem was introduced. DFSee supports 12, 16 and 32-bit FAT filesystems. The FAT has no redundancy and is sensitive to errors like: - "lost clusters" where no directory entry points to the chain - "cross links" where two allocation chains point to the same cluster at some point. _______________________________________________________________________________ #290 FAT32 FAT32 Version of the FAT filesystem that uses 4-byte = 32-bit FAT entries. This makes the maximum size of a FAT32 filesystem nearly unlimited. The FAT structure itself does take up a lot of space on the disk, and in memory when using the filesystem. FAT32 was introduced with Windows95, and is also supported on the other newer Windows versions (98, ME, 2000 and XP). OS/2 and eCS also support it through the 3rd-party installable filesystem FAT32.IFS made by Henk Kelder. _______________________________________________________________________________ #300 fid fid Freespace ID, the number that uniquely identifies a specific area of freespace on a disk, as indicated in the leftmost column in the standard DFSee partition table display. _______________________________________________________________________________ #310 FNODE FNODE File-Node in HPFS filesystem A descriptive sector that holds the most critical information about a file in the filesystem like Shortname, size information and allocation information. (date & time are in the directory) It is usually located just before the actual filedata, so just like files FNODES are scattered all over the HPFS volume. DFSee uses remaining FNODE information to find deleted files. Note that the filenode numbers that may be displayed are really just the SECTORNUMBER where the Fnode is located. It can be used directly to display the Fnode from a DFSee commandline. _______________________________________________________________________________ #320 Freespace Freespace An area on a partitionable disk that is NOT taken up by a defined primary or logical partition. Depending on the size and location of the freespace, it can be used to create new primary and/or logical partitions. DFSee classifies the available freespace areas to indicate what you can do: f0 = Wasted : Freespace that can NOT be used at all, Freespace Wasted because it is not in the ext-container and the partition table in the MBR is full. (max 4 primaries including ext-container) f1 = Primary : Freespace where only a PRIMARY partition Freespace Primary can be created because there is a primary partition between it and the ext-container. Also, the first track of the disk can never contain any logical partitions. If a disk has only logical partitions the first track (1 cylinder, typical 7.8MiB) will be empty. It CAN be used to put a primary partition of 1 cylinder (like IBM BootManager). f2 = Logical : Freespace where only a LOGICAL partition Freespace Logical can be created because the partition table in the MBR is FULL, or because the area is inside the ext-container. f6 = H-Logic : Logical freespace that is just before the Freespace Logical current ext-container. Creating a logical here will cause the ext-container to grow A primary partition can NOT be created here fa = T-Logic : Logical freespace that is just after the Freespace Logical current ext-container. Creating a logical here will cause the ext-container to grow. A primary partition can NOT be created here f3 = N-P/Log : Freespace where you can create a logical or Freespace Pri/Log a primary. The logical would be the first one, so the ext-container will be created at the same time too. f7 = H-P/Log : Freespace that is just before the current Freespace Pri/Log ext-container. Creating a logical here will cause the ext-container to grow. You can also create a primary partition here. fb = T-P/Log : Freespace that is just after the current Freespace Pri/Log ext-container. Creating a logical here will cause the ext-container to grow. You can also create a primary partition here. fc = EXT/Log : Freespace containing an EMPTY ext-container Freespace EXT/Log Creating a logical causes the ext-container to be updated correctly. However, before a primary can be created you should run the CLEANUP command to remove the empty container from the EBR chain! ff = Track-0 : This is a (small) area of space in the first Mbr + Track-0 Area track of the disk where NO partition can be created, but that is sometimes used to install a boot manager or put special information (like LVM info). You will get these codes/descriptions with the 'pl f' command that lists all freespace areas in the greatest detail. _______________________________________________________________________________ #330 FS FS A filesystem is the structuring of data on a storage medium File System that allows easy access to that data by creating directory information and ways to search, read and write data. A filesystem also may have provisions aiding in data recovery, security, compression and more ... There are dozens of implementations of filesystems with many different strategies to achieve the desired goals. In the PC (Intel) world the most used are FAT and FAT32, NTFS, HPFS, EXT2 and JFS. These are also the filesystems that are supported (more or less) by DFSee. _______________________________________________________________________________ #340 FS-administration FS-administration Filesystem data structures describing its contents The term may be seen used in DFSee CHECK output with allocation errors (error value 000002): - Allocation set but area is not in FS-administration The 'Allocation' is derived from information like the FAT or an explicit allocation bitmap, while the FS-administration is all the rest like the directory and file hierarchical tree. _______________________________________________________________________________ #350 GB GB Gigabytes, 10^9 = 1 000 000 000 bytes (decimal gigabyte) GiB GibiBytes, 2^30 = 1 073 741 824 bytes (binary gigabyte) For an explanation of the units see "IEC units" _______________________________________________________________________________ #360 Geometry Geometry The division of harddisk space in separate cylinders, heads and sectors per track, often referred to as CHS addressing. C ==> cylinder or number of cylinders the position of R/W heads on the platters, each position has access to a single track on each of the platters H ==> head or number of heads, or tracks per cylinder the active head-number for a single platter S ==> sector or number of sectors per track each track consists of a number of sectors (usually 63) The total number of available sectors is C * H * S Now all of this is based on the physical layout of a traditional harddisk, and does not very often reflect the physical reality. Modern harddisks have just a few platters, and a high number of cylinders and sectors per track. This can even vary on different areas of the disk. For the external interface it is translated to a 'normalized' CHS geometry called 'physical geo' or a simpler linear addressing scheme is used where the sectors are simply numbered starting with 0 called logical block addressing or LBA. PC systems however carry the legacy of BIOS interfaces that use CHS type addressing on those interfaces. For capacity reasons that is often NOT the physical geometry as used by the disk itself, but a more convenient logical-geometry. Within DFSee three different geometries are used, see the corresponding descriptions for: BIOS-Geo, L-Geo and S-Geo _______________________________________________________________________________ #370 GPT GPT GUID partition table The new partitioning style used in EFI compatible systems. This has been an optional style ever since windows 2000, besides the classical MBR/EBR style of partition tables called 'basic' disks in those Windows versions. The new Intel based Apple iMAC and MacBook systems are said to use this partitioning scheme (and EFI) as well. A partition is a contiguous space of storage on a physical or logical disk that functions as though it were a physically separate disk. Partitions are visible to the system firmware and the installed operating system. Access to a partition is controlled by the system firmware and the operating system that is currently active. For 64-bit Windows, bootable hard drives must be partitioned using the GPT mechanism defined in EFI 1.0. GPT is also the default partitioning scheme used by 64-bit Windows for all non-removable storage media. GPT complements the older MBR partitioning scheme that has been common to PCs. - Well defined and fully self-identifying. Data that is critical to platform operation is located in partitions and not in unpartitioned or "hidden" sectors. - Uses primary and backup partition tables and CRC fields - Each partition has a unique GUID and a partition content type - Each GPT partition also has a 36-character Unicode name To protect GPT-partitioned disks from tools that only understand MBR such as Windows Disk Administrator or Fdisk, which do not know how to properly access a GPT disk each GPT disk has a Protective MBR, beginning in sector 0. This sector precedes the GPT partition table and contains one type 0xEE partition that spans the disk. DFSee will correctly identify such 0xEE partitions but does NOT support further analysis or display of the real partition information inside a GPT partitioned disk. See also: EFI _______________________________________________________________________________ #380 HcSC HcSC A combined (3-byte) value representing a CHS value, coded with the (H) head in the first byte, then 2 high-order bits from the (c) cylinder and 6 bits for the (S) sectors/track in the second, and the 8 remaining low-order (C) cylinder bits in the third byte. So, showing each bit: hhhhhhhh ccssssss cccccccc Example: HcSC: fe 81 c5 = C: 1305 H: 254 S: 1 The 'C' value is the 0xc5 combined with the highest 2 bits of 0x81 which is 0x2, yielding 0x2c5 or in decimal, 1305 _______________________________________________________________________________ #390 HiddenSectors HiddenSectors A field in most partition bootsectors (PBR) that most often and/or contains the number of sectors between the PBR and the sector LBA-offset that contain the partition table entry for it (MBR or EBR) This value is related to the "LBA offset" value that is in the partition tables, and in the DFSee display it is actually called the "LBA offset value". When incorrect, the partition might be ignored or fail to mount properly by an operating system. This is know to be the case for FAT filesystem under OS/2 and some others. DFSee has a specific fix command 'fixhs' to correct this value which is also available in most FS specific menus as: "Fix HiddenSectors/GEO value" _______________________________________________________________________________ #400 HPFS HPFS High Performance FileSystem Offered as a real improvement over the classic FAT filesystems with the OS/2 1.2 Operating System. Its main advantages were faster access, more reliable error recovery and better handling of large disks. There is also a (server) version called HPFS386 that adds native security information to the filesystem. _______________________________________________________________________________ #410 I13X I13X Extended Int-13 support as used by the IBM BootManager and MBR _______________________________________________________________________________ #420 IEC IEC units This describes a fairly new standard (IEC 60027-2, 1999) that attempts to create an unambiguous naming system for quantities used in (computer) systems that use the binary number system. In the International Standard Units (SI) the prefixes K, M and G are defined as powers of 10. Because the binary value 2^10 = 1024 is roughly the same as 10^3 = 1000, these same prefixes were hijacked by the computer community for their binary multiples as well. Now that more people are starting to use computers, this causes more and more confusion. In the disk-storage field this is most visible with the capacity of harddisks. Disk manufacturers love to use the decimal kind of Megabyte, because that gives them the largest number to show for capacity ... However, most software tends to use the 'binary' form of these units and calculates a slightly lower number. Example: If you buy a "30 GB" harddisk, and format that as one big partition, your software will probably tell you that you got a 27.9 GB partition. So where did those 2 GB go ? Answer: Nowhere, 30GB is 30 000 000 000 bytes which is the equivalent of 27.9 times 1 073 741 824 (2^30). Now this will get easier once all software starts using the new prefixes. In the above example the "GiB" prefix should be used. An overview of the proposed prefixes and their values: Analogous Short prefix Factor Name Symbol Value SI prefix Relationship ====== ==== ====== ============== ============ =============== 2^10 kibi Ki 1 024 kilo (10^3) KiB = 1024 byte 2^20 mebi Mi 1 048 576 mega (10^6) MiB = 1024 KiB 2^30 gibi Gi 1 073 741 824 giga (10^9) GiB = 1024 MiB 2^40 tebi Ti 1 099 511 627 776 tera (10^12) TiB = 1024 GiB b = bit B = BYTE DFSee, starting with version 5.21 will uses the new prefixes in all possible places and add a full-decimal value in bytes in some selected places. KB, MB and GB values will be avoided. For more info see: http://www.pcguide.com/intro/fun/bindec.htm or http://physics.nist.gov/cuu/Units/binary.html _______________________________________________________________________________ #430 INODE INODE Information-Node in JFS (and other unix-like) filesystems A descriptive sector that holds the most critical information about a file in the filesystem like size information, data and time, extended-attributes and allocation information. It is located in allocated 'inode-extents' in groups of 32 that are physically near the files they refer to. DFSee uses remaining INODE information to find deleted files. _______________________________________________________________________________ #440 INT-13 INT-13 DOS Interrupt-13, the classical way to interface to physical disks in DOS. Limited by design to 1024 cylinders. (DFSDOS) Maximum disksize, when using BIOS disk-translation like LBA is just below 8GiB (1024 cylinders, 255 heads, 63 sectors) _______________________________________________________________________________ #450 JFS JFS Journaling File System A filesystem originally developed by IBM for the AIX operating system sharing a lot of features with other UNIX filesystems and adding journaling on all filesystem metadata operations. This greatly reduces the time to check and repair any damage after crashes or other disasters (CHKDSK). First offered for OS/2 with WSeB and now also available in eCS and the Convenience Packs 1 & 2 for the Desktop. The OS/2 implementation requires LVM, and is not bootable (yet) _______________________________________________________________________________ #460 KB KB Kilobytes, 10^3 = 1 000 bytes (decimal kilobyte) KiB KibiBytes, 2^10 = 1 024 bytes (binary kilobyte) For an explanation of the units see "IEC units" _______________________________________________________________________________ #470 Large-disk Large-disk Use of extended container type 0x0f, as used by Microsoft Win9x support See also: Part-tables explanation _______________________________________________________________________________ #480 LBA LBA Linear Block Addressing The most simple way to describe a position by using the number of sectors from some reference point to a sector. The default reference point is 0 (start of disk, MBR) but the EBR-base or location of current EBR are used too LBA style partition table fields define this offset plus the total size in sectors, as opposed to the absolute positions specified by their CHS counterparts. _______________________________________________________________________________ #490 LBA offset LBA offset A field in the partition table entry that specifies the position of the defined partition as an offset. The 'base' for this offset is either 0 (MBR position) or the position of the first EBR in the chain (the 'EBR-base') or the position of the current EBR sector (the 'thisEBR' value) For a primary partition: The offset from the partition table-sector (MBR so always 0) to the location of the partition bootsector. For the first extended-container (type 05 or 0f) in the MBR: The offset from MBR = 0 to the first EBR in the chain. This position is reused in other logical offsets, and DFSee calls it the "EBR-base". For a logical partition: The offset from this EBR to the partition bootsector. Normally this is equal to the nr of sectors/track (0x3f = 63) For all other extended-containers (type 05 or 0f in an EBR): The offset from the EBR-base to this target EBR. Note: The HiddenSectors field in most bootsectors (PBR) is related to this value, and in almost al cases should have exactly the same value. _______________________________________________________________________________ #500 LCN LCN Logical Cluster Number, used in filesystems that store cluster numbers internally (and in their bootsectors) like NTFS does. _______________________________________________________________________________ #510 LFN LFN The long version of the file/directory name that is kept in a (VFAT) VFAT directory. This name is using UNICODE (not ASCII). It is used on Win9x and Win-2000/XP FAT filesystems (16/32 bit) _______________________________________________________________________________ #520 Limit Limit This is the largest LSN (Logical Sector Number) that can be used with the currently opened store. For a partition, that will be the last sector in the partition. The limit value can be displayed using the 'store' command. The 'base' command can be used to specify a 'limit' value manually when desired. The base and limit values will normally be set automatically when opening any entity like a partition. _______________________________________________________________________________ #530 L-Geo L-Geo Logical geometry This is the most important geometry within DFSee since ALL the translations between Logical Block Address (LBA), or Physical Sector Numbers (PSN) as they are called within DFSee, and any CHS (Cylinder Head, Sector) values are done using this L-Geo. The initial values are retrieved from the Operating System, but this CAN be changed using the GEO command. The GEO command, without any parameters lists the L-Geo for the current disk. _______________________________________________________________________________ #540 Logical Logical A partition listed in a partition table in an extended boot partition record (EBR) inside the extended-container. By convention, the EBR is located at the start of a cylinder, at Head-0, sector 1 and the actual partition (bootsector) starts at Head-1, sector 1. _______________________________________________________________________________ #550 LSN LSN Logical Sector Number This is the zero-based, unsigned 32-bit, number for a sector on a logical partition. The partition can be seen as a linear sequence of sectors. Note: when accessing a whole disk, the LSN equals the PSN _______________________________________________________________________________ #560 LsnInfo LsnInfo A value combining an LSN and a (small) informational value in a single 32-bit number. It can be kept in the Sectorlist and the sector lookup table, and most operations will recognize and handle it correctly. One example of usage is the directory sector LSN plus the index of a directory entry for (V)FAT directories. LsnInfo 78000345 combines LSN 00000345 with index 7 and a single bit to mark it as an LsnInfo value (flag 0x08000000) So this points to the 8th directory entry in the directory sector at LSN 0345. (entry-numbers start counting at 0 :-) _______________________________________________________________________________ #570 LVM LVM Logical Volume Manager, an 'FDISK-like' program plus related Operating System drivers on OS/2 Warp Server for e-Business, the Convenience Pack (client) and the new eComStation client. LVM allows more flexible naming and usage of partitions and drive-letters, including joining multiple partitions on more than one disk into a single volume. DFSee respects the drive-letters as assigned with LVM and has special display options like the 'PLIST LVM' command in FDISK mode. Also the 'part' display will show volume and partition names as well. (TIP: use a display-size wider than 80 columns) The SETBOOT command is also compatible with the newer LVM-type IBM BootManager. This allows setboot to be used from NT/DOS too. Note: Creating new partitions will NOT (yet) also create the required LVM info, unless the -L option is specified. _______________________________________________________________________________ #580 LVM info LVM info The basic LVM information like partition name, volume name, drive-letter, bootable flag and some more stuff, that is kept (IBM: DLAT) in the LVM-information sector, near the MBR or EBR for the partition in question. For primaries, it will contain info on ALL primaries in a single sector, each partition using one DLAT-entry. LVM info is transparant to other operating systems If you think of the partition-tables as the Table-Of-Contents for a disk, think of the LVM-info as a footnote with that TOC. _______________________________________________________________________________ #590 LVM signature LVM signature Extended LVM information like disk-spanning and bad sector administration that is kept for LVM partitions (type 0x35) (IBM: BBR) only. It is located at the very last sector of a partition and the related information usually takes up the entire last cylinder of the partition. _______________________________________________________________________________ #600 LVM volume LVM volume A confusing term used by LVM for extended compatibility volumes. It has a fixed type value of 0x35, and can have more than one partition associated with it. It is most often used for JFS filesystems, but HPFS or FAT is also possible. An LVM-volume allows disk-spanning and multiple partitions, but it is currently NOT possible to boot from it. Note: Working (non-IBM) bootable JFS appeared in 2004 With a JFS filesystem in an LVM-volume you can expand the volume to make it bigger (by adding partitions). An HPFS or FAT filesystem in an LVM-volume will only be seen by an LVM-aware operating system, so it is HIDDEN for other operating systems. (can be used to manipulate drive-letters) _______________________________________________________________________________ #610 Magic Magic A term used with the DFSee specific filename/path recovery recovery when recovering (or undeleting) files on a JFS filesystem. filename This is also used to display this info in various places. Since JFS, as most Unix-like filesystems does NOT have any filename information with its files (Inodes), and the actual name in the directories is lost when deleting a file, some mechanism is needed to provide a meaningful name on recovery. In DFSee there are FOUR methods to get such a name: 1) Use a file/dir name cache built by scanning the tree (SLT) 2) Use previously saved name info from the Inode (SLT -M) 3) Use the .LONGFILENAME extanded attribute if it exists 4) Use a name derived from Inode and sector number _______________________________________________________________________________ #620 MB MB Megabytes, 10^6 = 1 000 000 bytes (decimal megabyte) MiB MebiBytes, 2^20 = 1 048 576 bytes (binary megabyte) For an explanation of the units see "IEC units" _______________________________________________________________________________ #630 MBR MBR Master Boot Record The first sector on the physical disk, located at PSN 0 = Cylinder 0, Head 0, Sector 1. It contains the initial boot code loaded by the BIOS into RAM for execution, and the main partition table that holds the primary partitions and the start of the chain of extended boot records (EBR). _______________________________________________________________________________ #640 mcs-number mcs-number A value that can be specified as decimal, octal or hexadecimal MCS using units of Gigabytes (g), Megabytes (m), Kilobytes (k), Cylinders (c), Heads (h) or Sectors (s) The syntax specification for such a number is: [0x|0X|0o|0O|0t|0T]nnnnnn[,d|o|x|g|m|k|c|h|s] A 0x prefix indicates hexadecimal format, 0o is octal and 0t is decimal. Any other or no prefix at all indicates that the default number base will be used, which is decimal for most values, and hexadecimal for sectornumbers and sizes specified using the 'Sectors' unit 's' The 'nnnnnn' shown above are the actual number digts. The number can have any number of digits, but should fit in a 64 bit unsigned value. The default unit often is 'm' for MiB. Heads and Tracks are exact synonyms and lead to the same value. Notes: Specified units may not be useful in some contexts and might be ignored. The k,m and g unit will cause incorrect multipliers when used with non sector based values, for example: The value "1,k" results in "2" (sectors) and NOT 1024! The geometry related units will use the geometry for the object in question (store, usually the current object). While MOST values use the DECIMAL format by default, SECTOR (and CLUSTER/BLOCK) values use HEXADECIMAL by default! For flexibility and (backward) compatibility the numberbase can be set using a prefix (0x, 0o or 0t) or a postfix (,d ,o ,x) _______________________________________________________________________________ #650 Medium Medium Partionable medium Media Any device or object that can be accessed by DFSee and that may Attach be subdivided using industry-standard partitioning schemes. Detach The most common media found are the physical disks in a system, but virtual (in memory) disks or RAW imagefiles can be used as partionable media in DFSee as well, making them available as 'disks' and allowing all DFSee operations on these disks and the partitions on them. By default, DFSee will 'attach' all physical disks present at startup, and you can use the ATTACH and DETACH commands or corresponding menu-items to change that. The MEDIA command and corresponding menu item displays all attached media. _______________________________________________________________________________ #660 MFT MFT Master File Table The master index in an NTFS filesystem that has one (or more) descriptive records for every file in the filesystem, including the MFT itself and other system areas like the boot record. When the NTFS volume holds a lot of files, this MFT can become very large (like 20MiB on a 4GiB system partition). _______________________________________________________________________________ #670 MFT copy MFT copy A copy of the first 16 (most important) MFT records describing all the NTFS system files including Root directory. DFSee will attempt to use that copy if the base MFT file seems to be damaged. _______________________________________________________________________________ #680 MFT record MFT record A record (typically 2 sectors) holding the key information about a file in NTFS. It has filename, size, date and time information, security info and allocation information about the file in question. _______________________________________________________________________________ #690 Mixed string Mixed string A string, usually a parameter for a command, that may contain mixed ASCII, HEXADECIMAL and UNICODE parts. Without quoting the contents will be interpreted as ASCII, with single quotes it will be hexadecimal digit pairs and text within double- quotes will be translated to UNICODE. A complex example: string'09'with tab'20 20 20'spaces" and some unicode" ASCII ASCII ASCII HEX HEX UNICODE Usage examples, see the FIND and EDIT command (DFSCMDS.TXT) _______________________________________________________________________________ #700 NTFS NTFS New Technology File System The new (journaling) filesystem introduced with Windows-NT. It has many of the same improvements over FAT as HPFS, but has a totally different internal structure. It also adds security information and compression and is expandable by defining new stream-types. Several versions exist that added specific features to the original implementations. _______________________________________________________________________________ #710 Partition Partition An area on a physical disk that holds a single logical filesystem like FAT, HPFS, IBM BootManager, NTFS etc. There is an index to find partitions in the form of a set of partition tables in the MBR/EBR chain. _______________________________________________________________________________ #720 Part-tables Part-tables When dividing your harddisk space into partitions, the Operating explanation Systems can use different filesystems within the partitions. These filesystems are FAT, FAT32, HPFS, NTFS and so on ... To make it a little easier to find out which filesystem is being used, there is an additional TYPE value in the partition table. This 'system-type' or 'partition type' or whatever it is called is a numeric value 0..255 often written in hexadecimal format so the range is 0x00 through 0xff. Some well-known and often used types are: 0x06 FAT 0x0b FAT32 0x07 HPFS or NTFS 0x0a IBM BootManager 0x83 Linux EXT2 Partitions that are directly defined in the first partition table (in the Master Boot Record = MBR) are called PRIMARY-PARTITIONS. So far it sounds rather simple, but there is another complication: Because a partition table can only hold information for FOUR partitions, you need something special if you want to have more. To do this, a special TYPE called EXTENDED-PARTITION is used that has the system-type value 0x05. So: 0x05 Extended-partition The extended partition is really just a primary partition, of type 0x05 that can be further divided into small chunks called LOGICAL-PARTITIONS. The first type 0x05 (or 0x0f) partition defined in the MBR is often called the EXTENDED-CONTAINER. The extended partition itself contains another partition table, and that describes the TWO partitions inside this extended. ONE is a 'logical-partition' with any of the types mentioned above, like FAT, HPFS etc., and the other is again an EXTENDED-PARTITION. In this way the original EXTENDED-PARTITION can be subdivided into many smaller areas where each has a partition type such as 0x06, 0x07 and so on. (the logical-partition) This is often called the 'chain' of extended partitions, because each one 'points' to the next one. Because the tables are in MBR and EBR sectors, the term MBR/EBR chain is used too. Another way of saying this, is that every LOGICAL-PARTITION is really made up of an enclosing EXTENDED-PARTITION of type 0x05 and the real (smaller) partition inside it with any of the filesystem related types like 0x06, 0x07 and so on. In most partitioning tools (like DFSee) these EXTENDED-PARTITIONS with type 0x05 are not shown in the normal partition list, which makes it more readable. Using "part -e -p-" will show ONLY the EXTENDED-PARTITIONS and using "part -e" will show them all. This will clearly show you that each logical really has two definitions with slightly differing sizes. Now, after understanding all this, here is the next complication (thanks to Microsoft): Starting with Windows95 OSR2, logical partitions can also use an EXTENDED-PARTITION with type 0x0f instead of 0x05! It serves the same purpose, and the main reason for Microsoft to use it is to know that this is a LARGE (larger than 8GiB or so) partition that requires a different disk device driver ... I consider this a prime example of bad design! These partitions of type 0x0f are sometimes called "Extended-X" or "ExtendedBig" or, in MS FDISK terms "large disk support" Apart from the LARGE version of 0x05 being 0x0f, there is also a LARGE version of 0x0b being 0x0c for large FAT32 partitions. _______________________________________________________________________________ #730 PDn PDn Partitionable Disk (number), or disk-id did A numbering of partitionable media in a system, starting with 1. It is listed as the second column 'PD' in the 'part' display. This numbering in DFSee is also used for the virtual disks that can be created. The PD is often used as a parameter in the DFSee commands to explicitly choose a disk to work on. _______________________________________________________________________________ #750 pid pid Partition id A numbering of all the partitions (and freespace) areas on all the physical disks recognized by DFSee. It is listed as the first column 'id' in the 'part' display. This is an ongoing numbering over all disks, the same number also identifies any freespace that might be just BEFORE the partition with this pid. A freespace area after the last partition will have its own unique number (fid). _______________________________________________________________________________ #760 Primary Primary A partition that is listed is the partition table in the MBR. partition By convention these partitions start at the beginning of a disk cylinder (Head-0, sector 1) except for the very first partition that starts at Head-1, sector 1 to leave room for the MBR itself (and possibly other stuff, see Track-0 area) _______________________________________________________________________________ #770 PSN PSN Physical Sector Number This is the zero-based, unsigned 32-bit, number for a sector on a physical disk. Addressing on a disk using PSNs is often referred to as Relative Block Addressing (RBA) or Logical Block Addressing (LBA) _______________________________________________________________________________ #780 Radix Radix (mask) This is a configuration value that can be set using the -H switch or the "set radix" command, and controls the default number radix being HEX or decimal for specific classes of input values. (Displayed output is NOT affected by the radix) A "1" bit in the RADIX mask indicates HEX, and "0" is Decimal. Classes defined for DFSee, and defaults: 1 = Standard class (DEC) 2 = mcs-numbers ,s unit specified (HEX) 4 = mcs-numbers any other units (DEC) 8 = DFSee sector number, no unit (HEX) 16 = DFSee size values, no unit (DEC) 32 = DFSee partition type, no unit (HEX) For the RADIX value adding the numbers results in a Radix value of 42 (or 0x2a) _______________________________________________________________________________ #790 Recursion Recursion See 'Recursion' _______________________________________________________________________________ #800 Retries Retries Retries to read the contents of a sector from a store. Displayed using the 'store' command. (see 'Attempts') _______________________________________________________________________________ #810 Sector Sector 512 bytes of data (although other sizes exist!) This is the smallest amount of data manipulated by the disk subsystems and is also the basic allocation unit for the HPFS filesystem _______________________________________________________________________________ #820 Sector type Sector type A single-character designation in DFSee to describe or select sectors with a specific meaning or specific contents. Many display and several search functions use these types. They can be listed using the '???' command in DFSee, or from the "Help -> Sector Types recognized" menu item. The generic ones used in all DFSee analysis modes are: '*' = any sector '+' = any known type '.' = End of Part/Disk! '2' = FAT32 2nd BootSec '3' = FAT32 3rd BootSec '6' = FDISK xF6 cleared '@' = Free space 'H' = Unidentified data 'I' = File data 'L' = LVM BBR signature 'P' = LVM BBR drv-table 'Q' = LVM BBR bad-table 'R' = Fsys reserved sec 'T' = DFSee compressed 'V' = LVM BBR V-deleted 'X' = Bad sector area 'b' = Fsys boot sector 'e' = Extended Boot Rec 'h' = Hex format data 'l' = LVM DLAT info sec 'n' = Non-std Boot Rec 'p' = LVM BBR drivelink 'q' = LVM BBR badblocks 'r' = Master Boot Rec 't' = Text format data '~' = No contents shown A complete list can also be found in DFSCMDS.TXT, it includes the mode specific types as well. _______________________________________________________________________________ #830 Sectorlist Sectorlist A list of sector numbers (LSN) or LsnInfo values that can be manipulated as a whole with commands like list, export, import, getbs, fixbs, dirfind, delfind, recover etc. The size of the list is 25000000 entries (2.5 million) when enough memory is available, or about 300000 otherwise. _______________________________________________________________________________ #840 Shortname Shortname The leading part of a filename, as contained in an HPFS fnode (hpfs) and useful for undelete. The maximum length is 15 characters _______________________________________________________________________________ #850 Shortname Shortname The classical 8.3 version of a file/directory name that is (VFAT) kept in a VFAT directory, alongside the long filename (LFN) _______________________________________________________________________________ #860 SLT SLT Sector/Cluster Lookup Table An array of information about sectors or groups of sectors, containing the type of the sector(s) and the LSN of a directly related sector like an Fnode/Inode/MFT-record or FAT DIR-entry. _______________________________________________________________________________ #870 Store Store A collection of numbered sectors, being the basis for ALL DFSee commands to work on. A store can be representing: - A partitionable medium, usually in FDISK mode (cmd DISK/WALK) - A partition on a disk, with a FS mode like HPFS (cmd PART ) - A volume opened directly, with a mode like HPFS (cmd VOL ) - An image file opened for analysis (cmd IM ) DFSee currently uses 3 stores (display with "store" cmd): 0 or S: The system store, used by DFSee internally 1 or A: User store number 1 (the CURRENT store at startup) 2 or B: User store number 2 (the alternate store at startup) The STORE command will take both the numeric and the 'letter' variant of the store identification for selection, while the displays and messages use the letter form, to avoid confusion with actual disk or partition numbers. The '$_store' script variable holds the NUMERIC value. The CURRENT store is the one almost ALL commands work on. The alternate store can be used as the second store to work with for commands like CLONE and COMP where one store is the FROM object and the other the TO object for the operation. Note: The concept of the stores, and their usage is mostly hidden from the end-user experience by the commands and menu-items that use them ... _______________________________________________________________________________ #880 Superblock Superblock Usually the most important data structure in a filesystem, with the information to find the rest of the data. There may be more of them, usually exact duplicates in other location to improve redundancy and recoverability. Known under this name in HPFS, JFS, EXT2/3 and various UNIX FS _______________________________________________________________________________ #890 Spareblock Spareblock A secondary superblock used by the HPFS filesystem. HPFS All 'static' information, that does not normally change during a normal session, is kept in the real 'Superblock' which is only written by FORMAT, CHKDSK and perhaps DFSee :-) Information that may change during a session is stored in the 'Spareblock', read and written by the HPFS.IFS driver. _______________________________________________________________________________ #900 Symbolic SN Symbolic SN Symbolic sector number or 'SSN' Used by many DFSee commands as a parameter representing a sector number in one of several forms: - A hexadecimal value with 1 upto 8 HEX digits - A value from the Sectorlist addressed as '.NNN' - 'this' or '.' representing the current sector - 'up' representing the 'up in hierarchy' sector - 'down' representing the 'down in hierarchy' sector - 'xtra' representing the 'extra' sector number _______________________________________________________________________________ #910 S-Geo S-Geo System Geometry Used by the DFSee low-level DISK read and write routines. It is usually the same as the logical geometry, but does NOT change when the logical geometry is changed with the GEO cmd _______________________________________________________________________________ #920 Track-0 Track-0 area A small, normally unused, area at the beginning of the disk, between the MBR and the first primary partition. _______________________________________________________________________________ #930 Track size Track size The number of sectors that are in one 'track' on the disk, using a specific geometry. Also called 'sectors per track'. Most geometries used have a value of 63 sector per track. _______________________________________________________________________________ #940 Truncate Truncate Make a filesystem in a partition on a disk smaller, usually to allow creation of another partition. Typical use: create freespace to install a new operating system _______________________________________________________________________________ #950 Type Type The system- or partition-type is a number specifying the TYPE (partition) of a partition, hinting at the contents (filesystem) that may (system) be present inside that partition. Inside DFSee it is often displayed as a hexadecimal number, often with a descriptive name for that type as well. For commands like SETTYPE and CR you can also use short symbolic names for certain types: hex symbolic 0x01 FAT12 = FAT12 0x04 FAT16 = FAT16 < 32 MiB 0x05 EXT = Extended partition (chain) 0x06 FAT = FAT16 > 32 MiB 0x07 IFS = Installable File system 0x07 HPFS = IFS, HPFS (alias) 0x07 NTFS = IFS, NTFS (alias) 0x0a BMGR = IBM BootManager 0x0b FAT32 = FAT32 small and below cyl 1024 0x0c FAT32X = FAT32 large or beyond cyl 1024 0x0f BIGX = Large extended (Windows, PQMagic) 0x82 SWAP = Linux swap partition 0x83 EXT2 = Linux EXT2 data partition 0xeb BEOS = BeOS filesystem 0xfe PS2S = PS/2 system partition _______________________________________________________________________________ #960 VCU VCU Volume Conversion Utility A program used with (the installation of) the LVM enabled versions of the OS/2 Operating System like eCS and WSeB. It will create default LVM information-sectors for all the existing partitions on all physical disks. The partitions will all be "LVM compatibility volumes" that have default volume, partition and disk names like [A1] and [D1]. This can be maintained later using the LVM/LVMgui programs. _______________________________________________________________________________ #970 VFAT VFAT An extension to the regular FAT directory entries that allows storage of long-filenames (LFNs) as well as the classic 8.3 short version of those names. Used mainly by newer Windows versions, beginning with Windows95. It can be used on any FAT filesystem, FAT12 (diskette), FAT16 and FAT32. _______________________________________________________________________________ #980 Virtual disk Virtual disk A disk that can be used just like other partitionable medium (DFSee) in DFSee but that only exists within DFSee memory. It can be created using the 'ATTACH' command, and is intended for experimenting and complex recovery scenarios. Note: This is not the same as a 'RAMDISK' used with DOS _______________________________________________________________________________ #990 Volume Volume A logical volume as seen by the active Operating System, with an associated logical drive-letter. It can be either a hard-disk partition with a filesystem recognized and mounted by the Operating System, or some other storage-medium like a Floppy disk or CDROM. Note: Network drives or other "virtual" filesystems can also be referred to as volumes. However, DFSee can not access them because such devices usually cannot be accessed using low-level "open volume" (DASD) methods. Note: The term "Volume" is also used by WSeB, eCS and new OS/2 systems that use the Logical Volume Manager (LVM). In this case the above still applies, but there is more to LVM-volumes than this, like disk-spanning etc. For LVM systems think of a volume as another abstraction layer, on top of the bare 'partitions'. There is usually a one to one relationship between a volume and a partition, but a volume CAN be associated with more than one. _______________________________________________________________________________ ----------------------------[ www.dfsee.com ]-------------------------------