Introduction
Directory Snoop ™

Version 4.0

Copyright © 2002 Kent Briggs

Briggs Softworks

Introduction

Directory Snoop is a forensic data search, recover, and destroy utility for Windows 95 through XP that works with any uncompressed drive formatted with the FAT file system. This includes floppy disks, Zip disks, hard drives, and flash media devices that function as standalone volumes. CD and NTFS formatted drives are not currently supported. With Directory Snoop, you can do the following:

•	Recover erased files, including those emptied from the recycle bin

•	Locate sensitive data with the search, sort, and viewing functions

•	Destroy sensitive files with the secure wiping functions

•	Purge file names in the directory structure left behind after normal erasing

Other features include:

•	Display true drive contents by bypassing the operating system and reading the raw drive sectors directly

•	Locate and sort files by name and other attributes with blazing speed

•	Unerase files including those inside erased directories down multiple levels

•	Save raw cluster and sector data to standalone files

•	Dynamically link file tree with cluster chains and file allocation table

•	Examine the secondary FAT table

•	View raw directories, files, clusters, and system sectors

•	View low level BIOS parameter block attributes

•	View files through external applications

•	Print file lists and raw clusters

•	Search files and raw clusters for content

•	Securely wipe files, slack, clusters and free space up to 35 passes

•	Verify the effectiveness of other file and disk wiping programs

Software License

Directory Snoop is copyrighted software distributed as shareware.  You are granted a temporary license to try Directory Snoop to see if it will meet your needs.  If you wish to use the program past the 25-run evaluation period, you must purchase the fully-licensed, registered version from the author or an authorized dealer.  Failure to comply with the license agreement is a violation of federal and international copyright laws. Click the Order form option on Directory Snoop’s Help menu for ordering instructions or visit http://www.briggsoft.com/order.htm to order securely online.

Disclaimer

This software is provided as is and without warranty. The author assumes no liability for damages, either direct or consequential, which may result from the use of this product.

Briggs Softworks Contact Information

Kent Briggs

14314 Cashel Forest Dr.

Houston, TX  77069  U.S.A.

E-mail: kbriggs@briggsoft.com

Web site: http://www.briggsoft.com

Download other Briggs Softworks programs from the web site:

Calendar Commander - is a program for making great looking calendars that you can print out and place in a notebook or hang on the wall. Add your own personal events, holidays, and pictures. A variety of daily, weekly, monthly, and yearly calendars are included and ready to use. A scripting function is also available for advanced users to create custom calendars from scratch.

CryptaPix - is an image viewing program with a secure encryption option. Manage and view your JPG, GIF, PNG, PCX, TIF, and BMP image files with CryptaPix's advanced thumbnail and slideshow features. Print images with full control over output size and placement. Use the Blowfish encryption function to keep your private image collection away from prying eyes.

File Maven Pro - is a dual directory file manager that makes copying and moving files much easier than with Windows Explorer. You can jump to any subdirectory with a few keystrokes or find files with the advanced search feature. File Maven Pro also includes a universal file viewer, a text editor, a file splitter, a ZIP file handler, and more.

Link Maven - is a parallel port file transfer tool for Windows. Connect two PCs together with a parallel link cable and copy, move, and delete files and directories between them.  A dual list window displays a full directory tree and file lists. Synchronize your laptop files with your desktop PC.

Order Maven - is an order form creation program for online merchants. Produce standalone Windows EXE programs that customers can download and run from your site. With a few button clicks, products are selected, payment information is automatically secured with the built-in public key encryption function, and the data is then emailed directly back to you for processing.

Puffer - is a data file and email encryption utility for the protection of your most sensitive data. Exchange email with other Puffer users with the Diffie-Hellman public key encryption functions or just conventionally encrypt your data files with the Blowfish and CAST symmetric algorithms. Puffer can also make self-extracting archives and includes extensive file wiping options.

Space Quarry - is an asteroid blaster arcade game. Spin your space ship around and fire at the incoming asteroids from all directions. Each new round brings more rocks at a faster pace. Score extra points in the bonus rounds. A high score list keeps track of your best ten missions.

Credits

•	Directory Snoop was developed in Pascal with Borland Delphi 5

•	Virtual Treeview component developed by Mike Lischke. Source available at www.lischke-online.de

•	WISE installation package licensed from Great Lakes Business Solutions


Interface

The user interface for Directory Snoop consists of a window that contains a main menu, a main toolbar, a drive selection toolbar, a tabbed page control that holds a file tree and file bin, a cluster chain list, a cluster viewer, and a file allocation table (FAT) list.

Main Menu

The Main Menu contains all of Directory Snoop’s main functions, split into four areas: File, Cluster, Bin, and Help. Details for these commands are explained later in this help file.

Main Toolbar

The Main Toolbar contains buttons for the most often used commands. A short description of each button function will be displayed as you hover the cursor over the buttons.

Drive Selection Toolbar

The Drive Selection Toolbar displays all of the active drives on your computer. A short description of the drive types will be displayed as you hover the cursor over each drive button. Click a drive button to load the file tree for that drive (if it’s a local FAT drive). Click it again to unload the file tree. You can also load/unload drives from the File menu.

File Tree

The File Tree holds the entire directory/file hierarchy for the selected drive. The following keys on the numeric keypad are handy for navigating the file tree:

+	Expand selected directory (right arrow key also)

-	Collapse selected directory (left arrow key also)

*	Expand selected directory and all of its subdirectories

/	Collapse selected directory and all of its subdirectories

The File Tree contains these 11 columns:

Name – The name of the file or directory. Directories have a yellow folder icon and also have a "d" located in the Attr column. Subdirectories appear first in a directory followed by files, sorted by name.

FRec – The first record number belonging to the item. Records are 32-byte entries into the directory cluster. Except for the root directory, every directory contains a special "." and ".." record that occupy the first two slots. These represent the current and parent directories and are not displayed in the File Tree.

NRec – The number of 32-byte records occupied by the item. Files with longer names use more records than files with shorter names.

E – Contains an asterisk (*) if the item is erased. Erased items are also displayed in red, or the color specified for erased files in the File/Preferences area.

DOS Alias – Contains the DOS 8.3 format filename for backward compatibility with DOS and 16-bit Windows programs.

Attr – The list of attribute abbreviations: a=archive, d=directory, v=volume label, s=system, h=hidden, r=read-only.

Created – The date and time the item was created.

Accessed – The date the file was last opened. This never changes for directories. Windows does not keep a time setting for this field.

Modified – The date and time the file was last modified. This never changes for directories.

1st Cluster – The first cluster belonging to the item where its data is stored. Subsequent clusters (if any) are tracked in the File Allocation Table (FAT).

Size – The size of the file in bytes.  Always 0 for directories.

File Bin

The File Bin is used to isolate selected files and directories out of the File Tree so they can more easily be managed. See the File/Add command for details. You can sort the contents of the File Bin by clicking the header over any of the columns. Click the same header a second time to reverse the sort order.

Cluster Chain / Cluster Viewer / File Allocation Table

The bottom section of the Directory Snoop window contains the following three sections:

Cluster Chain – This is the list of clusters that belong to the item currently selected in the File Tree or File Bin. The first cluster number in the chain is stored in the item’s directory record along with its name, date stamps, and other attributes. The remaining clusters (if any) are tracked by the File Allocation Table. The number of clusters allocated depends on the size of the file and the size of the clusters on the drive.

Cluster Viewer – This viewer in the middle section contains the raw contents of the current cluster chain in hex format divided into 16-byte lines. The first column (FOfs) displays the file offset (in hex) of the currently selected line. The next column (COfs) displays the cluster offset (in hex) of the currently selected line. Decimal equivalents are displayed on the status line below the viewer. The last column displays the ASCII text characters for the preceding 16 bytes. A period is displayed if the byte has a value outside the normal range of viewable characters. You can also display the current cluster in a directory or text file format by selecting View on the Cluster Menu.

File Allocation Table – The FAT contains a list of every cluster on the selected drive. Cluster numbers 0 and 1 are reserved <res> so the actual data for the drive starts in Cluster 2. The "Next" column in the FAT contains the next cluster in the chain for the file that is currently using it. The last cluster in a file chain is mark as <eof> for end of file. An unallocated cluster is marked as <unused>. Damaged clusters are marked as <bad>. The FAT is dynamically linked to the File Tree. When you select an allocated cluster in the list, the item that owns it will be selected in the File Tree. Then the corresponding cluster and chain are also displayed in the cluster viewer and chain list.

You can also locate a particular cluster by typing its number into the Jump to box and pressing Enter. You can also enter the following special commands:

a	- locate the next allocated cluster

a-	- locate the previous allocated cluster

b	- locate the next <bad> cluster

b-	- locate the previous <bad> cluster

e	- locate the next <eof> cluster

e-	- locate the previous <eof> cluster

r	- locate the next <res> cluster

r-	- locate the previous <res> cluster

u	- locate the next <unused> cluster

u-	- locate the previous <unused> cluster


Main Menu

Directory Snoop’s Main Menu is divided into four basic sections:

File Menu

The File Menu contains commands that work with selected files in either the File Tree or File Bin.  Click on a file record to select it.  To select a range of files, click on the first one and then hold the Shift key down before clicking the last one.  To select or unselect individual files, hold the Ctrl key down while clicking.

Add to bin – add selected items to File Bin

Search – search contents of selected files

Unerase – recover selected erased file

Wipe – overwrite file contents, slack, or free space

Purge erased – blank out erased file names

View – load selected file into an external application

Select drive – load or unload a drive

Drive parameters- display various disk statistics

Preferences – set user preferences

Exit – quit program

Cluster Menu

The Cluster Menu contains commands that work with raw disk clusters and sectors.

Search – search contents of raw clusters

Wipe – overwrite unused clusters

Copy to file – save raw cluster contents to a file

Print – print raw clusters

View – display cluster in directory or text format

System sectors – display drive’s system sectors

Bin Menu

The Bin Menu contains commands that are only available when the File Bin page is displayed.

Select all – select all items

Remove selected items – remove selected items from bin

Clear all items – remove all items from bin

Print list – print the list of items in the bin

Help Menu

Contents – display this help file

Order form – displays ordering instructions

Hex converter – hex/decimal integer conversion

About – display program copyright info


Add to bin
(File) Add to bin

Use this function to add selected files and directories in the File Tree to the File Bin. A filter dialog will be displayed so that you can eliminate unwanted items from your selection.

The upper checkbox labeled Include contents of selected directories allows you to include all items inside a directory without having to physically select each item. For example, if the root directory was selected, every file and directory on the drive will be included. However, if this option was unchecked, only the root directory entry itself (i.e., one item) would be included.

The Selection Filter allows you to narrow the selection of items that will be added to the File Bin. To clear the filters so that all selected items are included, select <none> from the Filter Name list. Otherwise, click the applicable buttons on the left side and specify the search criteria. In the example above, of the 9971 items selected in the File Tree, only non-erased JPG files between the sizes of 100,000 and 200,000 bytes will be added to the File Bin.

If you would like to save the current filter settings, click the Save button and enter a descriptive name for the filter. You can then load that filter from the Filter Name selection list at a later time. Click the Delete button to delete a saved filter.

The bottom checkbox labeled Clear current File Bin contents allows you to clear out all items currently in the File Bin before these new items are added. Otherwise, new items are appended to the end of the existing contents. Warning: Directory Snoop does not check to see if the same item is included more than one time in the File Bin.


Search
(File) Search

New

Use this function to search for data inside the selected files.  If a directory is selected in the File Tree, then all the files inside that directory will be searched. Directories selected in the Fin Bin are ignored. A dialog box will prompt you for the string to search for.

Case sensitive:  Check this option to perform a case sensitive search.  For example, if a file contains the string "Snoop", and you enter a search string of "snoop", the search will fail if this option is checked because the uppercase "S" does not match the lowercase "s".

Hex bytes: Check this option to search for binary data instead of a text string.  Enter an even number of hexadecimal digits (0123456789ABCDEF) to form a whole number of bytes.  You may insert spaces between bytes for readability.

Find only first match in each file: Check this option if you want the search to jump to the next selected file after a match is found.  Otherwise, the entire file is searched and every match will be reported.

Previous results

Select this option to display the results from the previous search.

Click the Save to file button to save the search results to a file. To locate a match, select the applicable "Found at" line in the search results box and then click the Locate Item button. Directory Snoop will select that file in the File Tree (or File Bin) and will highlight the line in the Cluster Viewer that contains the start of the search string.


Unerase
(File) Unerase

Use this function to recover an erased file.  When Windows deletes a file (as opposed to just moving it to the recycle bin), the data in the file is not erased.  Instead, the clusters are marked as being unused in the file allocation table (FAT).  Eventually, newly created files will use those clusters so your odds of recovering an erased file decrease as time goes by.

The unerase function works by retrieving the 1st cluster number and the file size from the erased file's directory entry.  It then checks the FAT entry for the starting cluster to see if that cluster is currently being used by another file.  If it is, you are too late to recover the file. If the 1st cluster number happens to be less than 65536 and there are more than that many clusters on the drive, Directory Snoop will ask this question:

"Was this file erased under the Windows NT, 2000, or XP operating system? "

If the answer is "Yes", the following dialog is displayed:

You will have to manually find the true starting cluster as explained in the dialog. Fortunately, this is not a problem under Windows 95, 98, or ME and thus the 1st Cluster value stored in the directory entry is always correct.

It is important to realize that Directory Snoop never modifies the FAT directly so it does not recover the file in-place.  Instead, it prompts you for a target file name to which to save the recovered clusters.  After creating the target file in the directory that you specify, Directory Snoop will read the first cluster from the disk and save a copy of the data to the target file.  It then begins looking for unused clusters (skipping over used ones) until it has collected and saved enough data to match the original file size.

Warning: if you need to recover more than one file, you should save the recovered target file to a different drive if possible so that you will not overwrite any of the clusters from the files yet to be recovered.  If another drive is not available, start with the file that has the lowest numbered starting cluster to lessen the chance of overwriting clusters from subsequent recoveries.

You will need to load the recovered file in the applicable program to see if you were successful or not. You can also recover erased files manually by using the Copy to file function on the Cluster menu.


Wipe
(File) Wipe

File Contents

The wipe function is used to permanently erase the selected files so that their data can never be recovered.  Use this feature with caution!  It works by overwriting the data inside the file and then performing a normal erase.  A confirmation dialog will appear asking you to select one of four wipe methods.

Simple 1-pass: this will overwrite the file with one pass of binary zeros.

DoD 3-pass: this will overwrite the file with three passes per Department of Defense specification 5220.22-M.  Pass 1 uses hex byte 55 (01010101 binary).  Pass 2 uses hex byte AA (10101010).  Pass 3 uses a pseudo-random byte string, unique for each file.

DoD 7-pass: this will overwrite the file with seven passes. Pass 1, 3, and 5 use hex byte 00 (00000000 binary).  Pass 2, 4, and 6 use hex byte FF (11111111).  Pass 7 uses a pseudo-random byte string, unique for each file.

Gutmann 35-pass: this will overwrite the file with 35 passes per the paper "Secure Deletion of Data from Magnetic and Solid-State Memory" by security specialist Peter Gutmann of the University of Auckland in New Zealand. This technique combines numerous static and random byte patterns specifically designed to thwart hardware recovery techniques for a variety of disk drive controllers.

Verify final pass: check this option to force Directory Snoop to go back and read the final wipe pass to ensure it was properly written to the disk before the file is finally erased.  The DoD specs require this step in the 5220.22-M protocol.

Wipe read-only files: check this option to wipe files even if they are marked as read-only (i.e., they have an "r" in the Attr column).

Purge directory entry: check this option to blank out the directory entry after the file’s contents are wiped.  This is equivalent to the File/Purge command.

The 1-pass wipe method is sufficient for most people and will stop all software-based systems from recovering the file.  The other options are only needed to help thwart forensic hardware systems that can recover data from magnetic residue laid down during previous writes.

You can test the effectiveness of Directory Snoop's wipe function (or any program's wipe function) by making a note of the cluster numbers belonging to a file prior to wiping. Then view those same clusters directly after wiping and confirm they have been wiped.

File slack

Windows always allocates a whole number of clusters to a file. If the number of bytes in a file is not an exact multiple of the disk’s cluster size, there will be some unused space at the end of the file’s last cluster. This space is often referred to as "slack" and is never displayed by the file’s native application. However, Directory Snoop’s Cluster Viewer will display the slack area in a light gray color (or the color specified in File/Preferences) if you scroll the viewer to the end. The data in the slack area is not necessarily zeroed out. In fact, it may contain sensitive information that was left behind in the drive’s read/write hardware buffer. Use the Wipe File Slack function to wipe this slack data. The file’s normal data will not be modified. See the Wipe / File Contents command for an explanation of the available wipe methods.

Free disk space

Use this function to wipe all the unused clusters on the selected drive so that no erased files can be recovered. The free space wipe function works by creating one or more temporary files ($$dsnoop.0, $$dsnoop.1, etc.) in the root directory and fills them with a wipe stream (up to 4 GB each) until there is no more space available on the drive. The temp files are then deleted. See the Wipe / File Contents command for an explanation of the available wipe methods.

Windows will likely display a "disk full" message at the end of each pass. Simply cancel those messages as they pop up since that condition is only temporary. If you would like to purge the temp files from the root directory structure after the wipe is complete, you will need to reload the drive to see them.


Purge
(File) Purge erased

This option will blank out erased records (including file names) so that no one will know they ever existed.  When you erase a file in Windows, the operating system simply marks its directory entry with a special character (overwriting the first character in the DOS Alias name) and then frees up its data clusters in the file allocation table (FAT) by marking them as "unused".  Eventually, the directory record may get overwritten when new files are added to the directory but you can use the Purge function to overwrite them now.

Only erased records can be purged.  Erased records are displayed in red and have an "*" in the "E" column. You can find and purge all the erased records on the selected drive by performing the following steps:

1.  Select the top (root) entry in the File Tree.

2.  Click the Add button on the toolbar (or File/Add from the menu).

3.  Click the Type button and set the filter to Erased.

4.  Click Ok and then select the File Bin tab.

5.  Pick "Select all" on the Bin Menu and then click the Purge button on the toolbar.

After purging, you will see the items with question marks in the Name and DOS Alias fields and other fields filled with zeroes. Directory Snoop will ignore these entries the next time the drive is loaded. You can pack your directories and eliminate these blank spots by running the Windows Defrag Utility. However, they may eventually get filled when new files are created in the directory.


View
(File) View

Select View (or double click the file) to load the current selected file into an external file viewer.  You will be given the choice of loading the file into:

1.  The default Windows application associated with the file extension.

2.  Directory Snoop’s internal text file viewer.

3.  A specific external application that you can add to the selection list.

To add an external application, click the + button. You will be prompted for the location of the program executable and a description that will appear in the selection list. Click the – button to remove the selected application from the list. Click the ? button to edit the selected application’s location or description.


Select drive
(File) Select drive

This function is equivalent to selecting (or unselecting) a drive on the drive toolbar.

Warning: once the file tree is loaded, changes in the drive structure made by other running programs (or Windows itself) will not be reflected in the list until you manually reload it. Therefore, it’s always best to shut down all other applications before starting Directory Snoop, including low level anti virus utilities that may interfere with Directory Snoop’s ability to read and write to raw disk sectors. This is especially true for Windows NT/2000/XP systems because they do not have the same drive locking capabilities that exist on Windows 95/98/ME systems.


Drive parameters
(File) Drive parameters

This function displays various statistics for the selected drive including boot sector values, the BIOS Parameter Block (BPB), and a sector to cluster map.


Preferences
(File) Preferences

This function displays the following dialog.

You can set the colors used for erased items and file slack and the size of the text in file and cluster areas.

FAT Selection – Most drives have a backup file allocation table in case the first one gets damaged. Here you can tell Directory Snoop to always load the first FAT table or to give you a choice each time a drive is selected.

User Tips – These are dialogs that pop up on with various commands that include some useful information. They can be disabled any time they are displayed but you can always turn them back on from this dialog.


Exit
(File) Exit

Select Exit to shut down and quit Directory Snoop.


Search
(Cluster) Search

New

Use this function to search for a string inside raw clusters. A dialog box will prompt you for the string to search for.

First cluster: the first cluster to be searched.

Number of clusters: the number of clusters to search through, starting with the first cluster specified.

Advance cluster to: the method of cluster advancement when searching through more than 1 cluster:

Next in FAT: the cluster number is incremented by 1.

Next in Chain: the cluster number is advanced to the next cluster in the file chain.

Next Unused: the cluster number is advanced to the next unused cluster found in the FAT.  This option is handy for searching erased file data.

Note that the number of actual clusters searched might not equal the number selected if the clusters cannot be advance any further due to end of chain, end of FAT, or no more unused clusters (depending on the Advance Cluster option).

Case sensitive:  Check this option to perform a case sensitive search.  For example, if a cluster contains the string "Snoop", and you enter a search string of "snoop", the search will fail if this option is checked because the uppercase "S" does not match the lowercase "s".

Hex bytes: Check this option to search for binary data instead of a text string.  Enter an even number of hexadecimal digits (0123456789ABCDEF) to form a whole number of bytes.  You may insert spaces between bytes for readability.

Find only first match in each cluster: Check this option if you want the search to advance to the next cluster after a match is found.  Otherwise, the entire cluster is searched and every match will be reported.

Allow string to cross cluster boundaries: Check this option if you want the search to find strings that start near the end of a cluster and continue into the next one to be searched.

Previous results

Select this option to display the results from the previous search.

Click the Save to file button to save the search results to a file. To locate a match, select the applicable "Found at" line in the search results box and then click the Locate Item button. Directory Snoop will display that cluster in the Cluster Viewer and will highlight the line that contains the start of the search string.


Wipe
(Cluster) Wipe

Use this command to overwrite one or more unused clusters so that their current contents are destroyed.  Directory Snoop will not allow allocated clusters to be wiped directly. Use the File/Wipe function for that purpose. The following dialog is displayed:

Cluster Range – use these controls to set a range of clusters to wipe. The number of unused clusters in that range will be displayed in the upper panel. Allocated clusters in the range will not be wiped.  Check the Use entire drive option to automatically set the range for the entire drive. Use this option with caution. Under Windows 95, 98, and ME, the drive has to be placed in an exclusive lock. This may interfere with other programs (or Windows itself) when the drive is locked for an extended period of time. In that case use the File / Wipe Free Space function instead.

Wipe Method - See the Wipe / File Contents command for an explanation of the available wipe methods.


Copy to file
(Cluster) Copy to file

This command allows you to copy the contents of specified clusters to a data file of your choice, including one on a different drive.  It is similar to the File / Unerase command except that it gives you full manual control on the selection of clusters.

First Cluster – set the first cluster to copy.

Number of clusters – set the number of clusters to copy.

Maximum total bytes – adjust this value if you want to copy less than a whole number of clusters.

Advance cluster to: set the method of cluster advancement when copying more than 1 cluster:

Next in FAT: the cluster number is incremented by 1.

Next in Chain: the cluster number is advanced to the next cluster in the file chain.

Next Unused: the cluster number is advanced to the next unused cluster found in the FAT.

Select target file – click this button to select the output file and start the copy process. If you select an existing file, Directory Snoop asks you if you want to replace the file or append the data to the end.


Print
(Cluster) Print

This command prints the contents of raw clusters in the same hex format that is displayed by the Cluster Viewer.

First Cluster – set the first cluster to print.

Number of clusters – set the number of clusters to print.

Maximum total bytes – adjust this value if you want to print less than a whole number of clusters.

Advance cluster to: set the method of cluster advancement when printing more than 1 cluster:

Next in FAT: the cluster number is incremented by 1.

Next in Chain: the cluster number is advanced to the next cluster in the file chain.

Next Unused: the cluster number is advanced to the next unused cluster found in the FAT.

Print – click this button to select the print device and start the print process.


View
(Cluster) View

Directory format

Select this command to display the current cluster in a raw directory format. The data displayed only has meaning if a directory cluster is currently selected.

Text format

Select this command to display the current cluster in an all-text format. The data displayed only has meaning if the cluster contains only ASCII text. A word wrap option is available on the viewer’s menu.


System sectors
(Cluster) System Sectors

Select this command to view the disk sectors that appear on the current drive before the data clusters. These include the reserved sectors, FAT tables, and the root directory for FAT12 and FAT16 drives. The root directory on FAT32 drives is contained in the regular data cluster area. The first sector (sector 0) in the reserved area is also known as the boot sector.

The File menu on this window contains a Copy sector data to file command that allows you to copy the data in these sectors to a regular data file in a similar manner as the Cluster / Copy to file command mentioned earlier in this section.


Select all
(Bin) Select all

This command selects all items in the File Bin. Note that the same search, wipe, and purge commands that can be performed in the File Tree can also be used in the File Bin.


Remove selected items
(Bin) Remove selected items

This command removes the selected files from the File Bin.  Note that this command does not erase files or alter them in any way.


Clear all items
(Bin) Clear all items

This command empties the File Bin.  Note that this command does not erase files or alter them in any way.


Print list
(Bin) Print List

Use this function to print the list in the File Bin. A dialog box will appear allowing you to select or unselect specific columns to print.

The printed text is automatically scaled to the page width so that all selected columns are sized in roughly the same proportion as they appear on the screen.  Use the Landscape orientation or uncheck one or more columns to increase the font size (12 point maximum).

You may also send the output to a text file in either an aligned format or a delimited format where each column is separated by double quotation marks and a comma. You are prompted for a file name when selecting these options.


Contents
(Help) Contents

Displays the Contents dialog for the online help system.


Order form
(Help) Order form

Displays instructions for ordering a license for Directory Snoop.  The shareware version is free to try during the 25-run trial period.  If you wish to use Directory Snoop beyond the trial period, you must purchase a license from Briggs Softworks or an authorized dealer.


Hex converter
(Help) Hex Converter

This is a handy tool for converting between hexadecimal and decimal integers.


About
(Help) About

Displays a dialog showing the program title, version number, and copyright notice.


Technical Information
(Misc) Technical Information

FAT File System

Windows uses a File Allocation Table (FAT) type file system.  This same system has been used since the early versions of DOS. The FAT file system comes in three basic formats: FAT12 for 12-bit cluster numbers on disks with less than 4087 clusters (e.g., floppy disks), FAT16 for 16-bit cluster numbers on disks with 4087 to 65526 clusters (e.g., zip disks, flash media, small hard drives), and FAT32 for 32-bit cluster numbers on disks with more than 65526 clusters (e.g., large hard drives). Note: Windows NT/2000/XP also supports a different file system called NTFS.  Directory Snoop does not currently support NTFS drives.

Each logical drive volume is divided into small sections called sectors. Most drives use sectors that are 512 bytes in length. There are three or four major sections on a FAT file system volume: the reserved region, the FAT region, the root directory region, and the file data region. FAT32 drives do not have a fixed root directory region. Instead, the root directory is dynamically allocated by the FAT table in the regular file data region.

The first sector in the reserved area is the boot sector. It contains vital statistics about the drive format in a structure known as the BIOS Parameter Block (BPB).

The FAT region contains the main file allocation table and normally one backup. The root directory region contains a fixed size area to hold the root directory entries on FAT12 and FAT16 drives.

The file data region covers the remainder of the drive and contains all the other directories and files, divided into allocation units called clusters. Clusters consist of one or more sectors, up to 32,768 bytes in size. There is one entry in the FAT table for every cluster on the drive, indicating the cluster’s current status (i.e., unused, part of a chain, end of a chain, or damaged). A file’s first cluster number is stored in the directory entry for the file. The remaining clusters (if any) are tracked by the FAT table.

Directory Entries

Windows stores the names of files and associated attributes in a 32-byte directory entry.  This directory system has been used since the early days of DOS.  This DIRENTRY structure is mapped as follows:

Offset	Field	Notes

0	DOS Name	8 chars max, padded with spaces

8	DOS Extension	3 chars max, padded with spaces

11	Attributes	r,h,s,v,d,a (see below)

12	Reserved	not used

13	CentiSeconds	.01 second intervals added to creation time

14	Create Time	time file was created

16	Create Date	date file was created

18	Access Date	date file was last accessed

20	Cluster-High	starting cluster high word (FAT32 only)

22	Mod Time	time file was last modified

24	Mod Date	date file was last modified

26	Cluster-Low	starting cluster low word

28	Size	file size (4 bytes)

The 16-bit time and date fields are coded as follows:

bits	field

0..4	second divided by 2 (0..29)

5..10	minute (0..59)

11-15	hour (0..23)

0..4	day (1..31)

5..8	month (1..12)

9..15	year minus 1980 (0..127)

The 8-bit attributes field is coded as follows:

bit	attribute (0=off, 1=on)

0	read-only

1	hidden

2	system

3	volume

4	directory

5	archive

6	(unused)

7	(unused)

With the release of Windows 95, Microsoft wanted to implement support for long file names but still remain compatible with 16-bit software.  Basically, how it works is that each file still has a short name entry but in addition may have multiple long name entries stored immediately in front of the short name entry.  To keep 16-bit software from becoming confused with these new long name entries, the attribute byte in them is always set to 0f hex, which makes it look like a read-only, hidden, system, volume label.  16-bit software will just skip over these entries since they are usually not concerned with volume labels when looking for files.  Most of the remaining bytes in the directory entry were then available to store the long names.

Long file names are stored in 16-bit Unicode format instead of the usual 8-bit ASCII format.  This leaves only enough room to store 13 characters in each 32-byte entry.  Longer names simply span across multiple directory entries, in reverse order.  The first byte in a long file name entry is a sequence byte.  The next 10 bytes contain five characters of the name.  The next byte is the attribute byte (always 0f).  Then comes a 1 byte type indicator (always 0) followed by a 1 byte checksum.  The next 12 bytes contain the next 6 characters.  Following this is 2 bytes for the cluster number field (always 0) and the final 4 bytes contain 2 more characters in the name.


FAQ
(Misc) FAQ – Frequently Asked Questions

An updated FAQ file is maintained on the Briggs Softworks web site:

http://www.briggsoft.com/dsfaq.htm