PC Online 1997 April

home *** CD-ROM | disk | FTP | other *** search

/ PC Online 1997 April / PCO_04_97.ISO / filesbbs / os2 / dfs201.arj / DFS201.ZIP / dfs.DOC next >

Wrap

Text File | 1997-02-06 | 45.1 KB | 1,047 lines

Display File Systems; version 2.01 06-02-97 (c) 1994-1997; Jan van Wijk ════════════════════════════════════════════════════════════════════════════ CONTENTS -------- Introduction, purpose of the program 1 Status of the program and change history 2 Terminology used 3 Summary of commands 5 Command reference, general DFS commands 6 Command reference, HPFS specific commands 16 Diagram of an example HPFS structure 20 Examples of DHPFS usage 21 Known limitations 21 Considered improvements 22 Introduction, purpose of the program ------------------------------------ The DFS program as it is available now is a more general implementation of the DHPFS program. It supports partition-structures and it will support different file-systems besides HPFS in the near future. The DHPFS program has been built while studying the HPFS filesystem. It's main purpose is getting to understand the file-system as it occurs on the disk itself, in the data-structures laid down in disk-sectors. Over time, additional logic was implemented to allow analysis of all sorts of disk problems on HPFS volumes. The tool has been used a few times over the past year to analyse some real-life disk problems in a large systems-integration project. Also it has proven very usefull in teaching others the internals of HPFS Most of my knowledge of the file-system is based on the excelent lectures "HPFS Internals" at the 1994 ColoradOS/2 conference by Doug Azzarito and on peeking arround on a lot of HPFS volumes using DHPFS. Status of the program --------------------- This version of the program is free for anyone to use, it was written in my own time using my own equipment. Further development depends on my own needs and feedback I receive from other users, al work has to be done on spare time... Improved versions of the program might be in the form of SHAREWARE. Suggestions and other comments regarding DFS, HPFS and DHPFS are welcome. You can reach me at my userid at CompuServe: 100603,2437 or through the Internet: 100603.2437@compuserve.com or: janvw@ibm.net or: jan.van.wijk@cmg.nl Change History -------------- 1.00 27-11-94 DHPFS initial version, hex dump super+spare blocks 1.39 20-07-95 32-bit port; Sector Lookup table; bug-fixes 1.52 13-09-95 new '/' cmd shortcut; First released version! <== BBS 1.56 26-09-95 RUN cmd runs REXX dhpfs macro's 1.62 13-10-95 Added Free-space and inconsistency reporting 1.64 16-10-95 Cleanup for delivery on ColoradOS/2 CDROM 1.69 24-06-96 Fixed trap on non-HPFS volumes (open FAT, Enter ==> trap) 1.70 20-12-96 Update ColoradOS/2, DASD limits; REQUEST (OS2FISYS forum) 1.84 14-01-97 DFS first distributed version to include partitioning info 1.87 19-01-97 Fixed MBR/EBR walk; multiple cmds using #, BM-labels in part 1.90 20-01-97 New fixroot and saveto commands for recovery actions (KULVM) 1.91 21-01-97 New fixcp command to fix CodePage reference (KULVM) 1.96 27-01-97 Dynamic loading of REXX support 2.00 03-02-97 Removable media (NEWDASD); (part) D: cmd; invisible primary 2.01 06-02-97 CopyOutput command for REXX Terminology used ---------------- Sector 512 bytes of data This is the smallest amount of data manipulated by the disk subsystems and is also the basic allocation-unit for the HPFS file-system CHS Cylinder Head Sector (addressing) This is the classical way of addressing physical sectors on a disk. It is used in the PC's BIOS, in partition tables and in low-level disk-IO API's (IOCTL, INT-13). In most implementations the addressing ranges are limitted causing all sorts of problems with large disks/partitions. Example: maximum cylinder=1024 limit for BIOS/INT-13 PSN Physical Sector Number This is the zero-based, unsigned-LONG, number for a sector on a physical disk. Addressing on a disk using PSN's id often referred to as Relative Block Addressing (RBA) or Logical Block Addressing (LBA) LSN Logical Sector Number This is the zero-based, unsigned-LONG, number for a sector on a logical partition. The partition can be seen as a linear sequence of sectors. SLT Sector Lookup Table An array of information about sectors or groups of sectors, containing the type of the sector(s) and the LSN of a directly related sector (usualy an Fnode). It is currently implemented for HPFS only. Partition An area on a physical disk that holds a single logical file-system like FAT, HPFS, Boot-manager, NTFS etc. There is an index to find partitions in the form of a set of partition-tables in the MBR/EBR chain. MBR Master Boot Record The first sector on the physical disk, located at PSN 0 = Cylinder 0, Head 0, Sector 1 It contains the initial boot code called from the BIOS and the main partition table that holds the primary partitions and the start of the chain of extended boot records (EBR). EBR Extended Boot Record It contains no boot code but only a partition table that holds the location of a single logical partitions. It usualy is located on the cylinder just before the actual logical partition itself, at Head 0, Sector 1. Each EBR will also point to the next EBR if more logical partitions exist on the same disk. Summary of commands ------------------- DFS takes commands from the keyboard and displays the results to the screen, scrolling text upward. It can also be copied to a file for later analysis. The commands are single words or (hexadecimal) numbers. Most commands have one or more parameters of wich some are optional. DFS keeps track of the current- and some other usefull SN's so they can be referenced faster, without having to type them in. They are: Name Cmd Description ---- --- ----------- next 'F' next in sequence prev 'B' previous in sequence up 'u' up in hierarchy down Enter down in hierarchy this 't' this (current) xtra 'x' Extra, alternative org 'o' original, usualy the ROOT directory LSN A logical partition needs to be opened first with the 'part' command. After opening an HPFS partition, using 'Enter' a few times will take you to the superblock, root-directory, possible sub-directories upto some file. Multiple commands can be chained if separated with the '#' character. An overview of the available commands is given below, it can also be referenced from within the program using the '?' command. xx = Analyse & display sector, SN xx; xx = 1 to 8 hexadecimals H,h xx [s] = Hex-dump sector of half-sector, SN xx, s sectors/bytes t a|e|h [s] = This SN, display in Ascii, Ea or Hex; s sectors/bytes .NNN = Display numbered directory- or allocation-entry marked .NNN a, M [xx] = Allocation bitmaps, compact or verbose format m = Directory allocation bitmap; usage of pre-allocated space \path-spec = find and show file/directory specified by path-spec findroot [n] = find the Root directory without using the superblock /hex-ascii = forward search mixed hex-ascii string in any sector f [type [s]] = forward search sector of [type]; containing string [s] b [type [s]] = backward search; sector types see doc: ──┬────────────────┐ walk [dsknr] = Select a disk and walk MBR/EBR chain │ u = Unidentif. │ part [id/dr] = Select partition with index #, or show │ a = AllocBlock │ d: = Open partition for drive-letter d: │ f = Fnode, any │ u, Enter = up / down in hierarchy (Enter = down) │ F = File fnode │ x, o = Extra / original LSN │ D = Dir. fnode │ log [file] = Log to 'file' ('log' = stop log) │ d = Dir. block │ I [type i s] = Show SLT for 'type', at index i, size s ─┤ ! = known type │ i [xx] = Identify, using sector lookup table, SLT │ * = any sector │ run macro = Run a DFS macro in a REXX .cmd file └────────────────┘ q = Quit FS display; 2.01 06-02-97 (c) 1994-1997; Jan van Wijk EXTERNALS Any command not recognized as a valid DFS internal command will be passed to the default command-processor (COMSPEC). Usefull commands: CHKDSK, CD, DIR, ... Note: FDISK, SETBOOT etc will not work if a physical disk is currently opened by DFS itself. Command reference, general DFS commands --------------------------------------- disk [nr] = Select specified physical disk for physical addressing Purpose: Select a physical disk Parameters: nr optional Physical disk number, default is 1 Output: Disk Geometry and default display of sector 0 (usualy MBR) The returncode (rc) will be zero for a valid disk number or equal to the number of disks otherwise. This can be usefull from REXX scripts. walk [nr] = Walk the MBR/EBR chain of partition-tables for specified disk Purpose: Show all partitioning information for the specified disk Parameters: nr optional Physical disk number, default is 1 Output: Disk Geometry, MBR and all linked EBR's in partition format lock = Lock physical disk, to allow writing to it (fixroot) Purpose: Lock a physical disk Parameters: none Output: none unlock = Unlock physical disk, after writing to it (fixroot) Purpose: Unlock a physical disk Parameters: none Output: none part [i][th] = Select specified partition Purpose: Select a disk partition for analysis Parameters: i optional Number specifying the partition as shown by the 'disks' or 'part' commands or d: Drive-letter for a partition (part C:) or + To get a verbose list or ! To force a new scan of physical disks If no parameter is specified the list of partitions will be displayed. th optional Start SLT thread automaticaly (HPFS) When not specified, the SLT will be build when the 'I' cmd is issued to show the SLT. Output: Either the list of partitions or the default display for the first sector of the partition (usualy a boot-sector). Remarks: The command "d:" where d is any existing drive-letter will be interpreted as a "part d:" command. This means that the C: partition can be opened just by typing "C:" The returncode (rc) will be zero for a valid partition id or equal to the number of partitions otherwise. This can be usefull from REXX scripts. An example of the list ouput in table form (default) is: Number of physical disks found: 1 Opened phys. disk : 1 Cyl: 155 H:255 S:63 Size: 1215.9 Mb Part 4 WARNING: Not formatted (or bootrecord corrupt) ┌──┬──┬──┬─────────────────┬────────┬────────┬───────────┬────────┬─────────┐ │id│PD│Dr│Type, description│Format │Creator │Label Info │BM-Name │ Size Mb │ ├──┼──┼──┼─────────────────┼────────┼────────┼───────────┼────────┼─────────┤ │01│ 1│ │Prim 0a Boot Mgr │FAT │ │«PLATO » │ │ 7.8 │ │02│ 1│C:│Prim 06 FAT >32Mb│FAT │IBM 20.0│NO NAME │Prim-31 │ 31.4 │ │03│ 1│c │Hide 17 Inst. FS │HPFS │OS2 20.0│OS2 │PLATO │ 604.0 │ │04│ 1│D:│Log 06 FAT >32Mb│--none--│ fdisk │ │ │ 533.4 │ └──┴──┴──┴─────────────────┴────────┴────────┴───────────┴────────┴─────────┘ Number of physical disks = The number of disks reported by the system Opened phys disk ... = opened disk with Cylinder, Head, Sector and Size Part nn WARNING: ... = Any informal, strange or alarming conditions Where: id = The selection-id used by DFS for this partition PD = Physical drive number; 1..max Dr = Drive letter, a capital plus a semicolon (C:), or a lowercase drive-letter for hidden partitions Type, description = Type-info and hex value of the type, type-info: Prim = Primary (active, accessible) Hide = Hidden (primary or special) Log = Logical volume in an extended partition Format = The filesystem format string found in the bootrecord for this partition or --none-- Creator = The OEM identification string from the bootrec of "fdisk" if no valid bootrecord is found Label Info = The volumelabel as found in the bootrecord, or the «BM-label» of the current Bootmgr selection Note: The FAT volume-label will not be shown here BM-Name = The name for this partition as registered in the OS/2 boot-manager information area's Size Mb = The gross size of the partition in megabytes PSN xx = Analyse & display sector using PSN xx Purpose: Display sector using Physical Sector Number addressing Parameters: xx = 1 to 8 hexadecimals Output: Sector display, format selected based on sector-contents Remarks: The SN is specified in hexadecimal format, however the first digit needs to be decimal to avoid misinterpretation. Prefixing the SN with '0' will avoid any conflicts. Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) CHS c h s = Analyse & display sector using CHS specication Purpose: Display sector using Cylinder, Head and Sector addressing Parameters: c mandatory The zero-based decimal Cylinder number Range 1 to disk-specific maximum and usualy below 1024. h mandatory The zero-based decimal Head number Range 0 to disk-specific maximum but never more than 255 s mandatory The one-based decimal Sector number Range 1 to disk-specific maximum but never more than 63 Output: Sector display, format selected based on sector-contents Remarks: Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) xx = Analyse & display sector, SN xx; xx = 1 to 8 hexadecimals Purpose: Display a sector in the most usefull format Parameters: none Output: Sector display, format selected based on sector-contents Remarks: The SN is specified in hexadecimal format, however the first digit needs to be decimal to avoid misinterpretation. Prefixing the SN with '0' will avoid any conflicts. Logical addressing (LSN) is actualy used, however when a physical disk is selected the offset for logical addressing is set to 0. The result is that LSN's equal PSN's. Output that scrolls of the screen can be repeated using the 't' command. (display 'this' sector) H,h [xx [s]] = Hex-dump sector or half-sector, LSN xx, s sectors/bytes Purpose: Display current or specified sector in hex-dump format Parameters: xx optional LSN of sector to dump s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 512 bytes for the 'H' command and 256 bytes for the 'h' command Output: Hex-dump of the sector On every line 16 bytes of data will be displayed, each line containing: - the relative offset in the record (4 hex digits) - 16 bytes in hexadecimal; separator after 8 bytes - the same 16 bytes represented as ASCII Remarks: The ASCII representation is filtered, non-printable characters are represented with a PERIOD character t a|e|h [s] = This LSN, display in Ascii, Ea or Hex; s sectors/bytes Purpose: Display current sector in ASCII, EA, HEX or default format Parameters: a|e|h optional Specifies display format as: a = ASCII e = EA h = HEX none = default (based on sector-contents) s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Output: Sector display in requested format Remarks: f [type [s]] = forward search sector of [type]; containing string [s] Purpose: Perform a forward search starting from the current LSN until a sector of the specified type and optionaly containing a specified ASCII/HEX string is found. Parameters: type optional Type of sector wanted, default is any KNOWN Sectortypes for searching are: u unidentified data sector I file data extent E EA data A ACL data b Boot sector s HPFS super-block p HPFS spare-block f Fnode, dir or file F Fnode, file D Fnode, directory a Allocation sector d Directory block c Codepage info t Codepage data table i UserId table (HPFS-386) m Bitmap indirect sector ! any KNOWN type $ HPFS system sector, non-data # Free space * any type s optional A string of bytes that have to be present in the wanted sector. It can be specified as a mix of ASCII and HEX. The starting mode is ASCII, switching to HEX and back is done with the ' character. Leading whitespace is skipped. In HEX mode spaces can be used to improve readability of the string. Example 1: last'0d0a'first This will search for the word "last" followed by a carriage-return line-feed combination and the word first Example 2: 'e9bd13 0d4023 49 42 4d 3a38 2e' This will search for a byte sequence, in this case the start of COMMAND.COM Output: Sector display, format selected based on sector-contents Remarks: This command is also very usefull to find a specific fragment of disassembled code anywhere on the disk, to resolve the name of an EXE, DLL or device driver causing traps or hangs. /hex-ascii = forward search mixed hex-ascii string in any sector Purpose: Like 'f' command, sector-type '*' direction FORWARD Parameters: hex-ascii mixed hex-ascii search-string with no intervening space after the '/' character Output: See 'f' command Remarks: b [type [s]] = backward search sector of [type]; containing string [s] Purpose: Like 'f' command with search-direction BACKWARD Parameters: See 'f' command Output: See 'f' command Remarks: Usefull to find the preceding fnode when looking at some random file-data. Note: the 'i' command will do this more reliably but depends on the sector-lookup-table to be filled. Enter = down in hierachy (Enter = down) Purpose: Display the next, most likely wanted, sector Parameters: none Output: Sector display, format selected based on sector-contents Remarks: u = up in hierachy Purpose: Display the sector that is higher in the hierarchy (parent) Parameters: none Output: Sector display, format selected based on sector-contents Remarks: F = forward in a sequence Purpose: Display the next sector Parameters: none Output: Sector display, format selected based on sector-contents Remarks: B = backward in a sequence Purpose: Display the previous sector Parameters: none Output: Sector display, format selected based on sector-contents Remarks: x = Extra LSN Purpose: Display the sector marked as eXtra Parameters: none Output: Sector display, format selected based on sector-contents Remarks: o = Original LSN Purpose: Display the sector marked as Original Parameters: none Output: Sector display, format selected based on sector-contents Remarks: Equals Root directory Fnode, most of the time log [file] = Log to 'file' ('log' without parameters = stop log) Purpose: Close current LOG, open new and capture DFS output in it Parameters: File specification If no parameter is specified, logging is stopped. Output: Concatenated output of DFS commands given after the 'log' command, upto next 'log' or 'q' command. ANSI control characters for colors and cursor-positioning are not written to the logfile. Remarks: There is no check on available space on the destination drive, file may end up empty if disk(ette) is full. The same logfile specification can be used more than once, output will be concatenated. On each 'log' command the current logfile will be closed. trace [lvl] = Set trace level for DHPFS internal functions Purpose: Investigate unexpected behaviour and debug DFS Parameters: lvl optional Trace level; 0 = no trace Output: The resulting trace-level, after this the output will be normal output mixed with extra trace information showing API return-codes and DFS internal variables Remarks: Only available in the special DFSTRACE.EXE version q = Quit FS display; 2.01 06-02-97 (c) 1994-1997; Jan van Wijk Purpose: Exit DFS program Remarks: Opened physical disk and logfile will be closed on exit Asynchronious running threads will be aborted. cd [path] = Change current Directory Purpose: Change both the current directory and the current drive Parameters: path optional Absolute or relative path specification Output: The resulting current drive and directory Remarks: '.' and '..' can be used in the relative path specification run mf [arg] = Run a REXX macro from DFS Purpose: Execute a REXX script using the 'DFS' environment Parameters: mf mandatory Macro file specification arg optional Arguments to the REXX macro Output: Any output from the REXX macro including (OS/2) commands executed from the macro. Remarks: DFS commands can be issued from within the macro, this is the default environment (Address DFS). Commands for CMD.EXE must be addressed using 'Address Cmd' The following REXX variables will be available after each executed DFS command from a macro: rc The returncode from the DFS command dfs_disknr Physical disk number currently open dfs_partid Partition-id for selection with "part" dfs_drive The opened drive letter, including a colon. dfs_afsys The attached filesystem, like "HPFS" or "FAT" dfs_sect The last retrieved sector(s), binary buffer dfs_type Type of last retrieved sector, this is a string starting with the type-character (see 'F' cmd) followed by a textual description. dfs_this SN of the last retrieved sector dfs_down SN of most likely sector to retrieve now dfs_up SN of sector up in hierarchy dfs_next SN of next in sequence dfs_prev SN of previous in sequence dfs_down SN of up in hierarchy dfs_sn.0 Number of sector-numbers in the SN stem variable dfs_sn.n nth sector-number in the SN stem variable, coming from DFS output for directories and allocation. They correspond to the '.NNN' command Note: SN's are in an 8-digit Hexadecimal format The number of disks and partitions can be resolved using the returncode (rc) from the commands "disk 0" and "part 0" or "part" respectively. REXX is dynamically loaded, when the run-command is exectuted It requires REXX.DLL and REXXAPI.DLL in the libpath. copyoutput [stem-name] Copy output from last-command to REXX stem-var Purpose: Allow output to be captured and processed from REXX Parameters: stem optional name of stem variable, ending in a '.' default: "dfs_output." Output: none Remarks: The <stem>.0 will hold the number of lines <stem>.1 through <stem>.n the actual cmd-output screen [arg] = Switch output to the screen on or off Purpose: Allow output to logfile only Parameters: arg optional 'on' or 'off' to switch mode Output: none Remarks: The returncode (rc from REXX) will indicate the setting for screen output: 0 indicates screen switched on 1 indicates screen switched off EXTERNALS Any command not recognized as a valid DFS internal command will be passed to the default command-processor (COMSPEC). Purpose: Allow execution of external commands like CHKDSK, DIR etc. Parameters: As required by the external command Output: Any output by the command Remarks: Output on stdout and stderr will be redirected to the logfile Command reference, HPFS specific commands ----------------------------------------- .NNN = Display numbered directory- or allocation-entry marked .NNN Purpose: Display one of the entries from the list last shown It can be applied on Directory- as well as Allocation-lists The number (NNN) to use is displayed to the left of the list Parameters: NNN The zero-based decimal entry number to show Output: Sector display, format selected based on sector-contents a = Allocation bitmaps, compact format Purpose: Show usage of the volume and the distribution of data over the volume. Parameters: none Output: A single bitmap-graphic for the entire volume Remarks: System-reserved and Directory-band are indicated with 'S' and 'R' respectively. Other area's are filled in according to the degree of usage (allocation) M [xx [s]] = Allocation bitmaps, verbose format Purpose: Show usage of the volume and the distribution of data over the volume for each allocation band. Parameters: xx optional LSN of a bitmap sector s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 4 sectors (default bitmap size) Output: A bitmap-graphic for every allocation-band of 8Mb when no parameters are specified, or one bitmap-graphic for the specified bitmap LSN. Remarks: Specifying an LSN that is not a bitmap-LSN will result in a garbage bitmap display. m = Directory allocation bitmap; usage of pre-allocated space Purpose: Show usage of the pre-allocated directory-band Parameters: none Output: A single bitmap-graphic showing the allocationof the pre-allocated directory band. Remarks: If 100% is allocated more directory information will be allocated elsewhere on the volume. \path-spec = find and show file/directory specified by path-spec Purpose: Locate the fnode for a known file- or directory Parameters: path-spec full path specification with no intervening space after the '\' command character or absolute- or relative path specification with an intervening space. If the path does not start with a '\' it is relative to the current directory (see CD cmd). Output: Searchlist starting at the ROOT directory upto the requested file or directory. It is either followed by an error message if the path-spec was not found or by the display of the corresponding fnode information. Remarks: The search algorithm depends on the ROOT fnode being known. When the superblock is corrupt this fnode can be resolved using the 'findroot' command. findroot [n] = find the Root directory without using the superblock Purpose: Find the fnode for the ROOT directory, even if parts of the volume, including the superblock, are damaged. Parameters: n optional Start LSN for the search Output: Search-list starting at the first fnode encountered upto the fnode for the ROOT directory when found. Remarks: Specifying a startlsn might be needed if reading at the start of the volume results in device errors, or if some fnodes in the sequence are corrupted. fixroot = Write the root-LSN found with the 'findroot' command back Purpose: Fix bad Root-LSN pointer, caused by CHKDSK bugs or other corruption Parameters: none Output: none Remarks: It is better to lock the physical before writing to it See 'lock' and 'unlock' commands fixcp = Write the CodePage-LSN found with the '0#f c' command back Purpose: Fix bad CodePage-LSN pointer, caused by CHKDSK bugs or other corruption Parameters: none Output: none Remarks: It is better to lock the physical before writing to it See 'lock' and 'unlock' commands saveto p [n] = Save contents of a file to a safe-copy on another disk Purpose: Recover a file if the fnode can still be found, by making a low-level sector-by-sector copy of its data to a new file. Parameters: p mandatory Path to save the file copy (existing!) n optional LSN of the fnode of the file to recover default is the current LSN (This) Output: none Remarks: Only the file contents is recovered, date&time, attributes and extended attributes are lost. I [t i s m] = Show SLT for 'type', at index i, size s, error-mask m Purpose: Display (selection of) the Sector Lookup Table Parameters: t optional Sector-types to include in the displayed list. Default is all types ('*') Types are same as specified for 'f' cmd i optional Start index in the SLT to display s optional Number of entries to display, default will result in one screen-full m optional Error filtering mask, * = all errors 4-digit Hexadecimal value, each set bit will include a specific error value. Output: One line for each entry in the SLT, containing: LSN Start LSN for a range of sectors size Number of sectors in the range ref Other sector refering to this range (fnode) type Type of the sectors in the range error 4-digit Hexadecimal error value: 0x0001 Linked to some structure, but not in bitmap 0x0002 Allocated in bitmap, but not linked 0x0008 Fnode is a directory but DirFlag is not set 0x0010 Fnode datalength greater than Dir-entry size 0x0020 Fnode datalength smaller than Dir-entry size 0x0040 Fnode datalength greater than allocated size 0x0080 Fnode datalength smaller than allocated size Remarks: Sector ranges might overlap, the smallest matching range will hold the best identification for a specific sector. The start-index will default to the position of the sector last searched using the 'i' cmd. i [xx] = Identify, using sector lookup table Purpose: Display the type for a specific sector and one major reference Parameters: xx optional LSN of sector to identify, default is the current sector Output: One line specifying corresponding SLT entry, followed by a line specifying the type of the sector itself and a sector display of the 'ref' sector, in a format based on sector-contents Remarks: Sector ranges might overlap, the smallest matching range will be considered best. This function is extremely usefull to relate file-data sectors from fragmented files to the Fnode for the file. It will tell you exactly to wich file a certain sector belongs. Diagram of an example HPFS structure Basic HPFS data-structure for Root-directory with AUTOEXEC.BAT, README file, an OS2 subdirectory and lots of other files. The README file has it's data allocated in 2 alloc-chunks. ╔═════════╗ ╔══════════════════╗ ╔═══════╗ ║SUPER ║ ┌──>║ DIR block ║ ┌──>║ FNODE ║ ║ ║ │ ║ ║ │ ║ ║ ║ ║ ╔═══════╗ │ ║┌────────────────┐║ │ ║ ║ ╔══════════ ║Root LSN ────>║ FNODE ║ │ ║│*Special**Start*│║ │ ║ ALLOC ──>║ DIR block ╚═════════╝ ║ ║ │ ║│entry FNODE LSN│║ │ ╚═══════╝ ║ ║ ║ │ ║│BtreeDownPtr LSN│║ │ ║┌───────── ║ ALLOC ──┘ ║└────────────────┘║ │ ║│8514.RC ╚═══════╝ ║┌────────────────┐║ │ ║│entry FNO ║│OS2 (subdir) │║ │ ║│BtreeDown ║│entry FNODE LSN├────┘ ║└───────── ┌─────────────────────────────┤BtreeDownPtr LSN│║ ║┌───────── │ ║└────────────────┘║ ║│ANSI.EXE │ ║┌────────────────┐║ │ ║│Special-end │║ │ ╔══════════════════╗ ║│entry FNODE LSN│║ ╔══════════════════╗ └─>║ DIR block ║ ║│BtreeDownPtr LSN├───────>║ DIR block ║ ║┌────────────────┐║ ║└────────────────┘║ ║┌────────────────┐║ ║│*Special**Start*│║ ╚══════════════════╝ ║│*Special**Start*│║ ║│entry FNODE LSN│║ ║│entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ ╔═══════╗ ║│BtreeDownPtr LSN│║ ║└────────────────┘║ ┌─>║ FNODE ║ ║└────────────────┘║ ║┌────────────────┐║ │ ║ ║ ║┌────────────────┐║ ║│AUTOEXEC.BAT │║ │ ║ ║ ╔═══════════ ║│PP... filename │║ ║│entry FNODE LSN├───┘ ║ ALLOC ──>║┌────────── ║│entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ ╚═══════╝ ║│ 1st data- ║│BtreeDownPtr LSN│║ ║└────────────────┘║ ║└────────── ║└────────────────┘║ ║┌────────────────┐║ ║┌────────────────┐║ ║│OS1.. filename │║ ║│README filename │║ ║│entry FNODE LSN│║ ┌───────────────────────────┤entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ │ ║│BtreeDownPtr LSN│║ ║└────────────────┘║ │ ║└────────────────┘║ ║┌────────────────┐║ │ ║┌────────────────┐║ ║│**Special**End**│║ │ ║│XXX... filename │║ ║│entry FNODE LSN│║ │ ║│entry FNODE LSN│║ ║│BtreeDownPtr LSN│║ │ ║│BtreeDownPtr LSN│║ ║└────────────────┘║ │ ║└────────────────┘║ ╚══════════════════╝ │ ║┌────────────────┐║ │ ║│**Special**End**│║ │ ║│entry FNODE LSN│║ │ ║│BtreeDownPtr LSN│║ │ ║└────────────────┘║ │ ╚══════════════════╝ │ │ ╔════════════════════════╗ │ ┌───>║┌──────────────────────┐║ │ │ ║│ 1st data-sector │║ │ │ ║└──────────────────────┘║ │ │ ║┌──────────────────────┐║ │ ╔═══════╗ │ ║│ 2nd data-sector │║ └─>║ FNODE ║ │ ║└──────────────────────┘║ ║ ║ │ ╚════════════════════════╝ ║ ─────┘ ║ ALLOC ║ ╔════════════════════════╗ ║ ─────────>║┌──────────────────────┐║ ╚═══════╝ ║│ 3rd data-sector │║ ║└──────────────────────┘║ (c) 1995 ║┌──────────────────────┐║ J. v. Wijk ║│ 4th data- Examples of DFS usage --------------------- 1) Resolve original name of FILExxxx.CHK files (created by CHKDSK) When CHKDSK recovers files it will place in a FOUND.xxx directory in the root-directory. This directory contains one or more recovered files with names like FILE0001.CHK The original name of the file is still in the Fnode, it can be shown using the following dhpfs commands (assuming drive c:) : Command Explanation DFS disks Start DFS and scan physical disks part id Select partition 'id' (must be HPFS) \found.000\file0001.chk Search and display Fnode for .CHK Now 15 characters of the original name are shown as "Fnode Name String" Known limitations ----------------- To be refined Considered improvements ----------------------- Automatic detection of inconsistencies (like CHKDSK, HVA and CHKPART) This will show HPFS problems like CHKDSK does, but in more detail and maybe some more types of inconsistencies. Note: Basic HPFS functionality implemented in version 1.62 Some partitioning errors implemented in version 1.82 Better coverage of HPFS386 specific structures and fields This should allow full-coverage of the Access-control lists and other HPFS386 specific information. Coverage of other file-systems besides HPFS like FAT, LINUX, NTFS ... Graphical User Interface, using IBM Class Library This could make the program easier to use, however it also makes the program requirements less attractive becaus it uses PM/WPS. A command-line version will allways be available to allow operation from a minimal (diskette) system. Write capability, This will allow recovery operations without using other (third-party) utilities. This will require locking the entire disk so usage is often limited to diskette BOOT. Recovery for deleted files (undelete) Recovery for a 'quick format' on HPFS (unformat)