home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Cream of the Crop 26
/
Cream of the Crop 26.iso
/
os2
/
dfs236s.zip
/
DFS.DOC
< prev
next >
Wrap
Text File
|
1997-08-20
|
62KB
|
1,333 lines
Display File Systems; version 2.36 20-08-97 (c) 1994-1997; Jan van Wijk
════════════════════════════════════════════════════════════════════════════
CONTENTS
--------
Introduction, purpose of the program 1
Status of the program and change history 2
Terminology used 3
Summary of commands 5
Command reference, general DFS commands 6
Command reference, HPFS specific commands 18
Diagram of an example HPFS structure 22
Examples of DFS usage 23
Known limitations 24
Considered improvements 24
Introduction, purpose of the program
------------------------------------
The DFS program is a disk and filesystem browser with an emphasis on the
HPFS filesystem and disk partitioning.
It will support different file-systems besides HPFS in the near future.
The program has been built while studying the HPFS filesystem.
It's main purpose is getting to understand the file-system as it resides
on the disk itself, in the data-structures laid down in disk-sectors.
Over time, additional logic was implemented to allow analysis of all
sorts of disk problems on HPFS volumes.
The tool has been used a few times over the past years to analyse some
real-life disk problems in a large systems-integration project.
Also it has proven very usefull in teaching others the internals of HPFS
Most of my knowledge of the file-system is based on the excellent lectures
"HPFS Internals" at the 1994, 95 and 96 ColoradOS/2 conferences by
Doug Azzarito and on peeking arround on a lot of HPFS volumes using DFS.
Further improvements will probably be in more advanced recovery commands
and other filesystems like FAT and NTFS.
Also a port to NT itself is finished and under test right now.
Availability
------------
1) IBM internal: REQUEST DFS FROM NLX0093 at EAMSVM1
2) Compuserve: GO OS2BVEN, open Filemanagers library section; DFS.ZIP
3) HOBBES (WWW): ftp://hobbes.nmsu.edu/pub/os2/util/diskutil/DFSxxxS.ZIP
or shadow: ftp://ftp.cdrom.com/pub/os2/util/diskutil/DFSxxxS.ZIP
You can also download this and some other software and information from
my homepage at Compuserve:
http://ourworld.compuserve.com/homepages/jvwijk
On special (e-mail) request a 16-bit OS/2 and tracing/debug versions and
the (beta) Win NT version are also available.
Status of the program
---------------------
This version of the program is free for anyone to use, it was written
in my own time using my own equipment.
However, I would very much appreciate any feedback by e-mail or a simple
postcard to:
┌───────────────────┐
│ Jan van Wijk │
│ Blekerstraat 83 │
│ 1315 AC Almere │
│ Netherlands │
└───────────────────┘
If you supply an e-mail address you will be put on the DFS mailing-list.
Further development depends on my own needs and feedback I receive from
other users, al work has to be done on spare time...
Improved versions of the program might be in the form of SHAREWARE.
Suggestions and other comments regarding DFS and filesystems are welcome.
You can reach me at my userid at CompuServe: 100603,2437 or jvwijk
or through the Internet: jan.van.wijk@cmg.nl
or: jvwijk@compuserve.com
or: janvw@ibm.net
Change History
--------------
1.00 27-11-94 DHPFS initial version, hex dump super+spare blocks
1.39 20-07-95 32-bit port; Sector Lookup table; bug-fixes
1.52 13-09-95 new '/' cmd shortcut; First released version! <== BBS
1.56 26-09-95 RUN cmd runs REXX dhpfs macro's
1.62 13-10-95 Added Free-space and inconsistency reporting
1.64 16-10-95 Cleanup for delivery on ColoradOS/2 CDROM
1.69 24-06-96 Fixed trap on non-HPFS volumes (open FAT, Enter ==> trap)
1.70 20-12-96 Update ColoradOS/2, DASD limits; REQUESTABLE (OS2FISYS forum)
1.84 14-01-97 DFS first distributed version to include partitioning info
1.87 19-01-97 Fixed MBR/EBR walk; multiple cmds using #, BM-labels in part
1.90 20-01-97 New fixroot and saveto commands for recovery actions (KULVM)
1.91 21-01-97 New fixcp command to fix CodePage reference (KULVM)
1.96 27-01-97 Dynamic loading of REXX support
2.00 03-02-97 Removable media (NEWDASD); (part) D: cmd; invisible primary
2.01 06-02-97 CopyOutput command for REXX
2.06 16-03-97 Updated ACL support on HPFS386; Scan badsectors
2.08 25-03-97 Added cluster/bytes-per-sector knowledge for partitions
2.12 06-04-97 Added logical volume support using "DASD" type access
2.20 19-05-97 Win NT beta version; Search speedup; prio command; cleanup
2.22 28-05-97 Final preparation for other file-system support; cleanup
2.24 10-06-97 Added Img and Sim commands; date/time on dirblocks;
2.25 15-06-97 Added Wrim command; Improved lock implementation (nested)
2.27 19-06-97 Base cmd; Fixed bug in HPFS "saveto" cmd
2.28 21-06-97 Added autobase command for HPFS (find HPFS partition start)
2.29 29-06-97 Fixed Bootmgr clustersize; added Deleted Fnode/Alloc support
2.30 06-07-97 Improved 'find' syntax and functionality; Undelete support
2.31 13-07-97 Fixed case-insensitive find, '+' option; fix dirmap % error
2.32 20-07-97 Reporting & ALBLK fixes to saveto; new "ca" cmd CheckAlloc
2.33 27-07-97 Fnode & Alloc display update; minor fixes
2.35 18-08-97 Path info in Fnode display and "list" output; MEM cmd
2.36 20-08-97 Path display on find Fnode;
Terminology used
----------------
Sector 512 bytes of data
This is the smallest amount of data manipulated by the
disk subsystems and is also the basic allocation-unit
for the HPFS file-system
CHS Cylinder Head Sector (addressing)
This is the classical way of addressing physical sectors
on a disk. It is used in the PC's BIOS, in partition tables
and in low-level disk-IO API's (IOCTL, INT-13).
In most implementations the addressing ranges are limitted
causing all sorts of problems with large disks/partitions.
Example: maximum cylinder=1024 limit for BIOS/INT-13
PSN Physical Sector Number
This is the zero-based, unsigned-LONG, number for a
sector on a physical disk. Addressing on a disk using
PSN's id often referred to as Relative Block Addressing
(RBA) or Logical Block Addressing (LBA)
LSN Logical Sector Number
This is the zero-based, unsigned-LONG, number for a
sector on a logical partition. The partition can be seen
as a linear sequence of sectors.
SLT Sector/Cluster Lookup Table
An array of information about sectors or groups of sectors,
containing the type of the sector(s) and the LSN of a
directly related sector (usualy an Fnode).
It is currently implemented for HPFS only.
Cluster A (small) group of adjecent sectors that are handled by the
operating system as one allocation-unit.
It is used on FAT filesystems to allow large partitions at
the cost of more wasted "slack" space, and on NTFS to balance
performance, slack-space etc.
HPFS does not use sector-clustering (or a cluster-size of 1!)
DFS will try to account for clustering where needed, for
example in size calculations and where sector/cluster pointers
are used in the file-system internal structures.
Partition An area on a physical disk that holds a single logical
file-system like FAT, HPFS, Boot-manager, NTFS etc.
There is an index to find partitions in the form of a
set of partition-tables in the MBR/EBR chain.
MBR Master Boot Record
The first sector on the physical disk, located at PSN 0 =
Cylinder 0, Head 0, Sector 1
It contains the initial boot code called from the BIOS and
the main partition table that holds the primary partitions
and the start of the chain of extended boot records (EBR).
EBR Extended Boot Record
It contains no boot code but only a partition table that
holds the location of a single logical partitions.
It usualy is located on the cylinder just before the actual
logical partition itself, at Head 0, Sector 1.
Each EBR will also point to the next EBR if more logical
partitions exist on the same disk.
Volume A logical volume as seen by the active operating system,
with a logical drive-letter associated to it.
It can be either a hard-disk partition with a filesystem
recognized and mounted by the operating system, or some
other storage-medium like floppy disk or CD-Rom.
Note: Network drives or other "virtual" file-systems can also
be refered to as volumes. However, DFS will not be able
to access them because such devices usualy cannot be
accessed using "open volume" (DASD) methods.
Shortname The leading part of a filename, as contained in an HPFS fnode
and usefull for undelete. The maximum length is 15 characters
Summary of commands
-------------------
DFS takes commands from the keyboard and displays the results to the screen,
scrolling text upward. It can also be copied to a file for later analysis.
The commands are single words or (hexadecimal) numbers.
Most commands have one or more parameters of wich some are optional.
DFS keeps track of the current- and some other usefull SN's so they
can be referenced faster, without having to type them in. They are:
Name Cmd Description
---- --- -----------
up 'u' up in hierarchy
down Enter down in hierarchy
this 't' this (current)
xtra 'x' Extra, alternative
You can display and analyse either a physical disk, a partition or a volume.
A physical disk can be opened using the 'disk' command.
A logical-partition or volume needs to be opened first with the 'part' or
'vol' commands respectively. The following prompt will show some status info.
After opening an HPFS partition, using 'Enter' a few times will take you
to the superblock, root-directory, possible sub-directories upto some file.
Multiple commands can be chained if separated with the '#' character.
An overview of the available commands is given below, it can also be
referenced from within the program using the '?' command.
?? = Show active filesystem name, commands and help info
??? = Show all recognized sector-types for current filesystem
part [dr/nr][No] = Show partitions, or select one using nr or drive-letter
vol [drive][No] = Show all volumes, or select one using drive-letter
im img = Open a file with a FS-image (.img) for display & analysis
sim img [f [s]] = Save to FS-image, starting from LSN [f], size [s] sectors
wrim img [f [s]] = Write FS-image to disk-sectors start at LSN [f], size [s]
xx = Analyse & display sector, SN xx; xx = 1 to 8 hexadecimals
H,h xx [size] = Hex-dump sector or half-sector, SN xx, s sectors or bytes
t a|h [size] = This SN, display in Ascii/Hexadecimal, s sectors or bytes
.NNN [listid] = Display numbered FS-entity marked .NNN from a sector list
list [listid][+] = Display LSN's in sector list, id = Dir, Alloc, Bad or Find
SLT [type i ln] = Display SLT for sectors of 'type' at index i, ln lines
id [xx] = Identify current or specified sector, using the SLT
f[op] [t] [str]] = Find [options] sectors of [t]ypes containing [str]
options are : * = repeat; - = backward; $ = Ign-case; @[pos] = position
Enter, u, x = Show next with <Enter>, up with 'u' or extra LSN with 'x'
walk [disknr] = Select a physical disk and walk the MBR/EBR chain
scan [wr [NoId]] = Scan bad-sectors; use read/Write verify; No automatic id
log [file] = Log (append) to 'file' (.log); (No file => stop logging)
run macro = Run a DFS macro in a REXX .cmd file
q = Quit FS display; 2.36 20-08-97 (c) 1994-1997; Jan van Wijk
EXTERNALS Any command not recognized as a valid DFS internal command
will be passed to the default command-processor (COMSPEC).
Usefull commands: CHKDSK, CD, DIR, ...
Note: FDISK, SETBOOT etc will not work if a physical disk
is currently opened by DFS itself.
Command reference, general DFS commands
---------------------------------------
disk [nr] = Select specified physical disk for physical addressing
Purpose: Select a physical disk
Parameters: nr optional Physical disk number, default is 1
Output: Disk Geometry and default display of sector 0 (usualy MBR)
The returncode (rc) will be zero for a valid disk number
or equal to the number of disks otherwise.
This can be usefull from REXX scripts.
walk [nr] = Walk the MBR/EBR chain of partition-tables for specified disk
Purpose: Show all partitioning information for the specified disk
Parameters: nr optional Physical disk number, default is 1
Output: Disk Geometry, MBR and all linked EBR's in partition format
lock = Lock physical disk, to allow writing to it (fixroot)
Purpose: Lock a physical disk
Parameters: none
Output: none
unlock = Unlock physical disk, after writing to it (fixroot)
Purpose: Unlock a physical disk
Parameters: none
Output: none
part [i][ns] = Select specified partition, or show the list of partitions
Purpose: Select a disk partition for analysis
Parameters: i optional Number specifying the partition as shown
by the 'disks' or 'part' commands
or d: Drive-letter for a partition (part C:)
or + To get a verbose list
or ! To force a new scan of physical disks
If no parameter is specified the list of
partitions will be displayed.
ns optional Do not start SLT thread automaticaly (HPFS)
When specified, the SLT will be build later
when the 'SLT' cmd is issued to display it.
Output: Either the list of partitions or the default display for the
first sector of the partition (usualy a boot-sector).
Remarks: The command "d:" where d is any existing drive-letter will
be interpreted as a "part d:" command. This means that the
C: partition can be opened just by typing "C:"
The returncode (rc) will be zero for a valid partition id
or equal to the number of partitions otherwise.
This can be usefull from REXX scripts.
An example of the list ouput in table form (default) is:
Opened phys. disk : 1 Cyl: 327 H: 64 S:32 Size: 327.0 Mb
Number of physical disks found: 1
┌──┬──┬──┬─────────────────┬────────┬────────┬───────────┬────────┬─────────┐
│id│PD│Dr│Type, description│Format │Creator │Label Info │BM-Name │ Size Mb │
├──┼──┼──┼─────────────────┼────────┼────────┼───────────┼────────┼─────────┤
│01│ 1│--│Prim 0a Boot Mgr │FAT │ │«OS/2 » │ │ 1.0 │
│02│ 1│C:│Prim 07 Inst. FS │HPFS │OS2 20.0│OS2 │OS/2 │ 170.0 │
│03│ 1│D:│Log 07 Inst. FS │HPFS │OS2 20.0│OS2 │STARTUP │ 5.0 │
│04│ 1│E:│Log 07 Inst. FS │HPFS │OS2 20.0│OS2 │ │ 145.0 │
│05│ 1│--│Hide fe PS/2 syst│FAT16 │IBM 5.y│6M OPEN 525│ │ 6.0 │
└──┴──┴──┴─────────────────┴────────┴────────┴───────────┴────────┴─────────┘
Number of physical disks = The number of disks reported by the system
Opened phys disk ... = opened disk with Cylinder, Head, Sector and Size
Part nn WARNING: ... = Any informal, strange or alarming conditions
Where: id = The selection-id used by DFS for this partition
PD = Physical drive number; 1..max
Dr = Drive letter, a capital plus a semicolon (C:),
or a lowercase drive-letter for hidden partitions
Type, description = Type-info and hex value of the type, type-info:
Prim = Primary (active, accessible)
Hide = Hidden (primary or special)
Log = Logical volume in an extended partition
Format = The filesystem format string found in the
bootrecord for this partition or --none--
Creator = The OEM identification string from the bootrec
of "fdisk" if no valid bootrecord is found
Label Info = The volumelabel as found in the bootrecord, or
the «BM-label» of the current Bootmgr selection
Note: The FAT volume-label will not be shown here
BM-Name = The name for this partition as registered in
the OS/2 boot-manager information area's
Size Mb = The gross size of the partition in megabytes
vol [letter] = Select specified logical volume, or show the list of volumes
Purpose: Work with logical volumes including floppies and CD-rom
Parameters: Drive-letter for the volume
Output: Either the list of volumes or the default display for the
first sector of the volume (usualy a boot-sector).
Remarks: Network or other "virtual" file-systems are not supported.
im img = Open a file with a FS-image (.img) for analysis
Purpose: Work with a saved binary image
Parameters: img Filename for the image, default extention is '.img'
Output: The default display for the first sector of the image
Remarks: File-system type is derived from first (boot) sector
sim img [f [s]] = Save FS-image (.img) start from LSN [f], size [s] sectors
Purpose: Save specified sectors as a binary image for use with 'IM'
Parameters: img Filename for the image, default extention is '.img'
f Start LSN for save, default is 0
s Size of the saved image in sectors, default is 256
'$' can be used to save all sectors of the disk/volume
Output: none
Remarks: When '.' is specified for s, sector 'f' upto 'this' is saved
When '.' is specified for f, the start-sector is 'this'
When '.' is specified for both, only the 'this' sector is saved
wrim img [f [s]] = Write FS-image to disk-sectors start at LSN [f], size [s]
Purpose: Write sectors back from an image to opened partition or volume
Parameters: img Filename for the image, default extention is '.img'
f Start LSN for write, default is 0
s Size of the written sector area, default size of image
Output: none
Remarks: '.' can be specified for the f and s parameters, see 'sim' cmd
fs fs-name [No] = Force analysis using specified file-system knowledge
Purpose: Use specific FS knowledge if the default is not correct
Parameters: fs-name File-system name, like FAT or HPFS
No Do not try to build SLT automatically
Output: none
Remarks: Only HPFS is realy supported at the moment, and depending on
disk or image contents DFS might behave strangely or even trap
base [sn [sl]] = Set base limits start and end values, defining partition
Purpose: Force a different partition start sector-nr
Parameters: sn Sector-number to use as start for partition ==> LSN 0
sl Sector-number to use as end for partition (optional)
Output: none
Remarks: Can be used if start of partition / partition-tables are bad
Try to find the PSN for the first sector of the partition
and use the "base" cmd followed by an "FS xxxx" command
PSN xx = Analyse & display sector using PSN xx
Purpose: Display sector using Physical Sector Number addressing
Parameters: xx = 1 to 8 hexadecimals
Output: Sector display, format selected based on sector-contents
Remarks: The SN is specified in hexadecimal format, however the first
digit needs to be decimal to avoid misinterpretation.
Prefixing the SN with '0' will avoid any conflicts.
Output that scrolls of the screen can be repeated using
the 't' command. (display 'this' sector)
CHS c h s = Analyse & display sector using CHS specication
Purpose: Display sector using Cylinder, Head and Sector addressing
Parameters: c mandatory The zero-based decimal Cylinder number
Range 1 to disk-specific maximum and
usualy below 1024.
h mandatory The zero-based decimal Head number
Range 0 to disk-specific maximum but
never more than 255
s mandatory The one-based decimal Sector number
Range 1 to disk-specific maximum but
never more than 63
Output: Sector display, format selected based on sector-contents
Remarks: Output that scrolls of the screen can be repeated using
the 't' command. (display 'this' sector)
xx = Analyse & display sector, SN xx; xx = 1 to 8 hexadecimals
Purpose: Display a sector in the most usefull format
Parameters: none
Output: Sector display, format selected based on sector-contents
Remarks: The SN is specified in hexadecimal format, however the first
digit needs to be decimal to avoid misinterpretation.
Prefixing the SN with '0' will avoid any conflicts.
Logical addressing (LSN) is actualy used, however when a
physical disk is selected the offset for logical addressing
is set to 0. The result is that LSN's equal PSN's.
Output that scrolls of the screen can be repeated using
the 't' command. (display 'this' sector)
H,h [xx [s]] = Hex-dump sector or half-sector, LSN xx, s sectors/bytes
Purpose: Display current or specified sector in hex-dump format
Parameters: xx optional LSN of sector to dump
s optional size to dump: 1..63 specifies sectors
64..xxx specifies bytes
Default is 512 bytes for the 'H' command
and 256 bytes for the 'h' command
Output: Hex-dump of the sector
On every line 16 bytes of data will be displayed, each line
containing:
- the relative offset in the record (4 hex digits)
- 16 bytes in hexadecimal; separator after 8 bytes
- the same 16 bytes represented as ASCII
Remarks: The ASCII representation is filtered, non-printable
characters are represented with a PERIOD character
t a|h [s] = This LSN, display in Ascii or Hex; s sectors/bytes
Purpose: Display current sector in ASCII, EA, HEX or default format
Parameters: a|h optional Specifies display format as:
a = ASCII
h = HEX
none = default (based on sector-contents)
s optional size to dump: 1..63 specifies sectors
64..xxx specifies bytes
Output: Sector display in requested format
Remarks:
f[op] [t] [str]] = Find [options] sectors of [t]ypes containing [str]
Purpose: Perform a sector search starting from the current LSN
until a sector of the specified type and optionaly
containing a specified ASCII/HEX string is found.
Parameters: op optional Search options, default is '+'
* = automatic repeat (find all ...)
+ = verbose output even when repeating
- = search towards lower sector numbers
! = force LSN/PSN display, no file-paths
$ = Use case-insensitive string compare
@[pos] = compare at one sector position [pos]
(with type dependant defaults)
Note: Use no spaces betwee 'f' and options!
t optional Types of sector wanted, default is any KNOWN
specify multiple types in a single string
DFS generic sector types
'*' = any sector
'r' = Master Boot Rec 'e' = Extended Boot Rec
'b' = Fsys boot sector 'R' = Fsys reserved sec
'!' = any known type 'u' = Unidentified data
'$' = Free space '.' = <Past-partition!>
HPFS specific sector types
'I' = File data 'E' = EA data
'A' = ACL data 'B' = Boot area
's' = HPFS superblock 'p' = HPFS spareblock
'H' = Hotfix table 'h' = Hotfix data
'x' = Bad sector-list 'X' = Bad sector
'S' = Spare dirblocks 'D' = Directory fnode
'f' = Fnode for a file 'z' = Fnode deleted
'a' = Allocation block 'Z' = All-block deleted
'd' = Directory block 'P' = Dir-band (free)
'Q' = Dir-band bitmap 'c' = Codepage info
't' = Codepage data 'i' = HPFS386 User-id
'm' = Bitmap Tables 'M' = Bitmap data
For an up-to-date list, use the '???" command
str optional A string of bytes that have to be present
in the wanted sector.
When the '$' string option is not given, it
can be specified as a mix of ASCII and HEX.
The starting mode is ASCII, switching to
HEX and back is done with the ' character.
Leading whitespace is skipped, in HEX mode
spaces can be used to improve readability.
Example 1: last'0d0a'first
This will search for the word "last"
followed by a carriage-return line-feed
combination and the word first
Example 2: 'e9bd13 0d4023 49 42 4d 3a38 2e'
This will search for a byte sequence,
in this case the start of COMMAND.COM
Output: Sector display, format selected based on sector-contents,
or a single line with position and type info when repeating
Remarks: This command is also very usefull to find a specific fragment
of disassembled code anywhere on the disk, to resolve the
name of an EXE, DLL or device driver causing traps or hangs.
Backward search can be usefull on HPFS to find the preceding
fnode when looking at some random file-data.
Note: the 'id' command will do this more reliably but depends
on the sector-lookup-table to be filled.
list [id][opts] = Display LSN's in sector list, id = Dir, Alloc, Bad or Find
Purpose: Display one of the sector-number lists maintained by DFS
Parameters id optional Identifier for LSN list, valid values are:
d = Dir, result or dir-block display
b = Bad, result of 'scan' command
f = Find, result of 'f' command
m = Mem, result of 'mem' commands
opts optional + = Use verbose output, one line per LSN
f = Incluse PATH info on Fnode LSN's on
verbose output (requires + too)
Output: List of sector numbers in compact or verbose format
Remarks: The default list-identifier will be set to a specific list
each-time one of the lists is modified or listed.
List also available for REXX in the dfs_sn. stem variable
mem [c|lsn][#] = Memory list of LSN's clear or update
Purpose: Add an LSN to the LSN memory list for later use with .NNN
Parameters: c optional Clear command, limit list-size to # entries
lsn optional LSN to add to the list, special values are:
x, u, d, t for Xtra, Up, Down and This
# optional memory location to store lsn, or limit
Output: none
Remarks: The LSN memory can be listed using "list m" [+f]
.NNN [id] = Display numbered FS-entity marked .NNN from a sector list
Purpose: Display one of the entries from the list last shown
It can be applied on Directory- as well as Allocation-lists
The number (NNN) to use is displayed to the left of the list
Parameters: NNN The zero-based decimal entry number to show
id optional Identifier for LSN list (see list command)
Output: Sector display, format selected based on sector-contents
Enter = down in hierachy (Enter = down)
Purpose: Display the next, most likely wanted, sector
Parameters: none
Output: Sector display, format selected based on sector-contents
Remarks:
u = up in hierachy
Purpose: Display the sector that is higher in the hierarchy (parent)
Parameters: none
Output: Sector display, format selected based on sector-contents
x = Extra LSN
Purpose: Display the sector marked as eXtra
Parameters: none
Output: Sector display, format selected based on sector-contents
Remarks:
SLT [t i s m] = Show SLT for 'type', at index i, size s, error-mask m
Purpose: Display (selection of) the Sector Lookup Table
Parameters: t optional Sector-types to include in the displayed
list. Default is all types ('*')
Types are same as specified for 'f' cmd
i optional Start index in the SLT to display
s optional Number of entries to display, default
will result in one screen-full
m optional Error filtering mask, * = all errors
4-digit Hexadecimal value, each set bit
will include a specific error value.
Output: One line for each entry in the SLT, containing:
LSN Start LSN for a range of sectors
size Number of sectors in the range
ref Other sector refering to this range (fnode)
type Type of the sectors in the range
error 4-digit Hexadecimal error value:
0x0001 Linked to some structure, but not in bitmap
0x0002 Allocated in bitmap, but not linked
0x0008 Fnode is a directory but DirFlag is not set
0x0010 Fnode datalength greater than Dir-entry size
0x0020 Fnode datalength smaller than Dir-entry size
0x0040 Fnode datalength greater than allocated size
0x0080 Fnode datalength smaller than allocated size
Remarks: Sector ranges might overlap, the smallest matching range will
hold the best identification for a specific sector.
The start-index will default to the position of the sector
last searched using the 'i' cmd.
If needed the SLT will be built in a background thread.
id [xx] = Identify, using sector lookup table
Purpose: Display the type for a specific sector and one major reference
Parameters: xx optional LSN of sector to identify, default is
the current sector
Output: One line specifying corresponding SLT entry, followed by
a line specifying the type of the sector itself and a
sector display of the 'ref' sector, in a format based
on sector-contents
Remarks: Sector ranges might overlap, the smallest matching range will
be considered best.
This function is extremely usefull to relate file-data sectors
from fragmented files to the Fnode for the file.
It will tell you exactly to wich file a certain sector belongs.
log [file] = Log (append) to 'file' (.log); (No file => stop logging)
Purpose: Close current LOG, open new and capture DFS output in it
Parameters: File specification
If no parameter is specified, logging is stopped.
Output: Concatenated output of DFS commands given after the
'log' command, upto next 'log' or 'q' command.
ANSI control characters for colors and cursor-positioning
are not written to the logfile.
Remarks: There is no check on available space on the destination
drive, file may end up empty if disk(ette) is full.
The same logfile specification can be used more than once,
output will be concatenated.
On each 'log' command the current logfile will be closed.
trace [lvl] = Set trace level for DFS internal functions
Purpose: Investigate unexpected behaviour and debug DFS
Parameters: lvl optional Trace level; 0 = no trace
Output: The resulting trace-level, after this the output will be
normal output mixed with extra trace information showing
API return-codes and DFS internal variables
Remarks: Only available in the special DFSTRACE.EXE version
prio [lvl] = Set relative priority of the DFS main thread
Purpose: Increase (search) speed with +, or decrease system impact
Parameters: lvl optional Prority level; + and ++ = high(est),
- and -- = low(est)
Output: The resulting prio-level
Remarks: When running on low(est) priority in the background, DFS
will almost come to a halt.
q = Quit FS display; 2.36 20-08-97 (c) 1994-1997; Jan van Wijk
Purpose: Exit DFS program
Remarks: Opened physical disk and logfile will be closed on exit
Asynchronious running threads will be aborted.
cd [path] = Change current Directory
Purpose: Change both the current directory and the current drive
Parameters: path optional Absolute or relative path specification
Output: The resulting current drive and directory
Remarks: '.' and '..' can be used in the relative path specification
run mf [arg] = Run a REXX macro from DFS
Purpose: Execute a REXX script using the 'DFS' environment
Parameters: mf mandatory Macro file specification
arg optional Arguments to the REXX macro
Output: Any output from the REXX macro including (OS/2) commands
executed from the macro.
Remarks: DFS commands can be issued from within the macro, this
is the default environment (Address DFS).
Commands for CMD.EXE must be addressed using 'Address Cmd'
The following REXX variables will be available after
each executed DFS command from a macro:
rc The returncode from the DFS command
dfs_disknr Physical disk number currently open
dfs_partid Partition-id for selection with "part"
dfs_drive The opened drive letter, including a colon.
dfs_afsys The attached filesystem, like "HPFS" or "FAT"
dfs_sect The last retrieved sector(s), binary buffer
dfs_type Type of last retrieved sector, this is a string
starting with the type-character (see 'F' cmd)
followed by a textual description.
dfs_this SN of the last retrieved sector
dfs_down SN of most likely sector to retrieve now
dfs_up SN of sector up in hierarchy
dfs_next SN of next in sequence
dfs_prev SN of previous in sequence
dfs_down SN of up in hierarchy
dfs_sn.0 Number of sector-numbers in the SN stem variable
dfs_sn.n nth sector-number in the SN stem variable, coming
from DFS output for directories and allocation.
They correspond to the '.NNN' command
Note: SN's are in an 8-digit Hexadecimal format
The number of disks and partitions can be resolved using the
returncode (rc) from the commands "disk 0" and "part 0" or
"part" respectively.
REXX is dynamically loaded, when the run-command is exectuted
It requires REXX.DLL and REXXAPI.DLL in the libpath.
copyoutput [stem-name] Copy output from last-command to REXX stem-var
Purpose: Allow output to be captured and processed from REXX
Parameters: stem optional name of stem variable, ending in a '.'
default: "dfs_output."
Output: none
Remarks: The <stem>.0 will hold the number of lines
<stem>.1 through <stem>.n the actual cmd-output
scan [wr [NoId]] = Scan bad-sectors; use read/Write verify; No automatic id
Purpose: Identify bad sectors on a physical disk or logical volume
Parameters: write optional 'w' to use full read/write/verify sequence
NoId optional 'n' to disable automatic SLT lookup
Output: Progress indication based on sector-numbers, and one line for
each bad-sector found, plus an SLT display of a related sector
like the fnode, if automatic SLT display is enabled.
Remarks: For REXX, the dfs_sn.0 stem variable will hold the number of
bad-sectors found and dfs_sn.1 through dfs_sn.n the actual
bad sector numbers (can be shown with the 'list' command)
Without the write option, only a single 'read' will be done
for each sector, this can be executed on a running system
with open files on the disk/volume to be checked.
With the write option a "read/write-inverse/read/write-normal"
sequence is done for each sector with contents checking.
The contents of each sector will stay the same, so the function
can be safely executed on formatted disks with live data.
This sequence takes at least 4 times more time to complete
and also, for safety, the disk will be locked. This means that
the write option can only be used when the complete physical
disk is not being used.
Remarks: Also available for REXX in the dfs_sn. stem variable
screen [arg] = Switch output to the screen on or off
Purpose: Allow output to logfile only
Parameters: arg optional 'on' or 'off' to switch mode
Output: none
Remarks: The returncode (rc from REXX) will indicate the setting for
screen output: 0 indicates screen switched on
1 indicates screen switched off
Command reference, HPFS specific commands
-----------------------------------------
Active filesystem : HPFS, specific commands are:
alloc [+] = Show data-band allocation bitmaps, compact or [+] verbose
dirmap = Show directory band allocation and usage map
bitmap [xx,s,D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format
find path-spec = Find and show file/directory specified by path-spec,
relative to current dir, or root if starting with '\'
\path-spec = find and show file/directory relative to root
path [n] = Show all path-components for current fnode, upto root
autobase [t][l] = find the start of an HPFS partition by searching sectors
of types [t], default 'spad'; [l] is last valid sector
findroot [n] = find the Root directory without using the superblock
starting the search at LSN [n]
fixroot = Update superblock with found LSN for root-directory
fixcp = Update superblock with found LSN for codepage info
saveto [dir][l] = Save filedata connected to (current) fnode to a file
ca [lsn][opt] = Check Allocation for (current) fnode lsn
For an up-to-date list of commands, use the '??' command
autobase [t][l] = find the start of an HPFS partition by searching sectors
Purpose: Force a different partition start sector-nr for HPFS partition
Parameters: t One or more sector-types to use in the search
default is "spad", Super, Spare, Alloc and Dirblock
f for fnode can also be used but is less reliable
sl Sector-number to use as end for partition (optional)
Output: Search progress and finel result when HPFS partition found
Remarks: Can be used if start of partition / partition-tables are bad
Use the "fs hpfs" command first!
alloc [+] = Show data-band allocation bitmaps, compact or [+] verbose
Purpose: Show usage and the distribution of data over the volume.
Parameters: none
Output: A single bitmap-graphic for the entire volume or for each
allocation-band when verbose format is selected
Remarks: System-reserved and Directory-band are indicated with 'S'
and 'R' respectively. Other area's are filled in according
to the degree of usage (allocation)
dirmap = Show directory band allocation and usage map
Purpose: Show usage of the pre-allocated directory-band
Parameters: none
Output: A single bitmap-graphic showing the allocation of the
pre-allocated directory band.
Remarks: If 100% is allocated more directory information will be
allocated elsewhere on the volume.
bitmap [xx s D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format
Purpose: Show a bitmape located at specified LSN, alloc or DIR format
Parameters: xx mandatory LSN of a bitmap sector
s optional size to dump: 1..63 specifies sectors
64..xxx specifies bytes
Default is 4 sectors (default bitmap size)
D optional Directory-format flag
Output: One bitmap-graphic for the specified bitmap LSN.
Remarks: Specifying an LSN that is not a bitmap-LSN will result in
a garbage bitmap display.
\path-spec = find and show file/directory specified by path-spec
Purpose: Locate the fnode for a known file- or directory
Parameters: path-spec full path specification with no intervening
space after the '\' command character
or absolute- or relative path specification
with an intervening space. If the path
does not start with a '\' it is relative
to the current directory (see CD cmd).
Output: Searchlist starting at the ROOT directory upto the requested
file or directory. It is either followed by an error message
if the path-spec was not found or by the display of the
corresponding fnode information.
Remarks: The search algorithm depends on the ROOT fnode being known.
When the superblock is corrupt this fnode can be resolved
using the 'findroot' command.
path [n] = Show all path-components for current fnode, upto root
Purpose: Show the directory-branch that contains current file/dir
Parameters: n optional Start LSN for the search
Output: One line for each found 'parent' directory, upto the root
Remarks:
ca [lsn][opt] = Check Allocation for (current) fnode lsn
Purpose: Check allocation integrity for current fnode
Parameters: lsn optional LSN of the fnode
opt optional Options: v = Verbose, show progress
Output: Σ Start of an allocation-sector (heavily fragmented)
» Start of one file-extent (fragmented file)
· One sector, green small dot is allocation OK
■ One sector, red big dot is allocation error
Also a summary is given with the number of (failed) sectors
Remarks: Fnode maybe for a regular file (sectors must be ALLOCATED)
or for a deleted file (sectors must be FREE)
findroot [n] = find the Root directory without using the superblock
Purpose: Find the fnode for the ROOT directory, even if parts of
the volume, including the superblock, are damaged.
Parameters: n optional Start LSN for the search
Output: Search-list starting at the first fnode encountered upto
the fnode for the ROOT directory when found.
Remarks: Specifying a startlsn might be needed if reading at the
start of the volume results in device errors, or if some
fnodes in the sequence are corrupted.
fixroot = Write the root-LSN found with the 'findroot' command back
Purpose: Fix bad Root-LSN pointer, caused by CHKDSK bugs or
other corruption
Parameters: none
Output: none
Remarks: It is better to lock the physical before writing to it
See 'lock' and 'unlock' commands
fixcp = Write the CodePage-LSN found with the '0#f c' command back
Purpose: Fix bad CodePage-LSN pointer, caused by CHKDSK bugs or
other corruption
Parameters: none
Output: none
Remarks: It is better to lock the physical before writing to it
See 'lock' and 'unlock' commands
saveto [dir][l] = Save filedata connected to (current) fnode to a file
Purpose: Recover a file if the fnode can still be found, by making
a low-level sector-by-sector copy of its data to a new file.
(basic functionality to be used for undelete operations)
Parameters: dir optional Path to save the file copy (existing!)
l optional LSN of the fnode of the file to recover
default is the current LSN (This)
Output: Progress is reported with output like the "ca" command,
error messages will be given as appropriate
Remarks: Only the file contents is recovered, date&time, attributes
and extended attributes are lost.
If no directory is specified it will default to the last
directory given, or "A:" when it is the first time
Diagram of an example HPFS structure
Basic HPFS data-structure for Root-directory with AUTOEXEC.BAT, README file,
an OS2 subdirectory and lots of other files. The README file has it's data
allocated in 2 alloc-chunks.
╔═════════╗ ╔══════════════════╗ ╔═══════╗
║SUPER ║ ┌──>║ DIR block ║ ┌──>║ FNODE ║
║ ║ │ ║ ║ │ ║ ║
║ ║ ╔═══════╗ │ ║┌────────────────┐║ │ ║ ║ ╔══════════
║Root LSN ────>║ FNODE ║ │ ║│*Special**Start*│║ │ ║ ALLOC ──>║ DIR block
╚═════════╝ ║ ║ │ ║│entry FNODE LSN│║ │ ╚═══════╝ ║
║ ║ │ ║│BtreeDownPtr LSN│║ │ ║┌─────────
║ ALLOC ──┘ ║└────────────────┘║ │ ║│8514.RC
╚═══════╝ ║┌────────────────┐║ │ ║│entry FNO
║│OS2 (subdir) │║ │ ║│BtreeDown
║│entry FNODE LSN├────┘ ║└─────────
┌─────────────────────────────┤BtreeDownPtr LSN│║ ║┌─────────
│ ║└────────────────┘║ ║│ANSI.EXE
│ ║┌────────────────┐║
│ ║│Special-end │║
│ ╔══════════════════╗ ║│entry FNODE LSN│║ ╔══════════════════╗
└─>║ DIR block ║ ║│BtreeDownPtr LSN├───────>║ DIR block ║
║┌────────────────┐║ ║└────────────────┘║ ║┌────────────────┐║
║│*Special**Start*│║ ╚══════════════════╝ ║│*Special**Start*│║
║│entry FNODE LSN│║ ║│entry FNODE LSN│║
║│BtreeDownPtr LSN│║ ╔═══════╗ ║│BtreeDownPtr LSN│║
║└────────────────┘║ ┌─>║ FNODE ║ ║└────────────────┘║
║┌────────────────┐║ │ ║ ║ ║┌────────────────┐║
║│AUTOEXEC.BAT │║ │ ║ ║ ╔═══════════ ║│PP... filename │║
║│entry FNODE LSN├───┘ ║ ALLOC ──>║┌────────── ║│entry FNODE LSN│║
║│BtreeDownPtr LSN│║ ╚═══════╝ ║│ 1st data- ║│BtreeDownPtr LSN│║
║└────────────────┘║ ║└────────── ║└────────────────┘║
║┌────────────────┐║ ║┌────────────────┐║
║│OS1.. filename │║ ║│README filename │║
║│entry FNODE LSN│║ ┌───────────────────────────┤entry FNODE LSN│║
║│BtreeDownPtr LSN│║ │ ║│BtreeDownPtr LSN│║
║└────────────────┘║ │ ║└────────────────┘║
║┌────────────────┐║ │ ║┌────────────────┐║
║│**Special**End**│║ │ ║│XXX... filename │║
║│entry FNODE LSN│║ │ ║│entry FNODE LSN│║
║│BtreeDownPtr LSN│║ │ ║│BtreeDownPtr LSN│║
║└────────────────┘║ │ ║└────────────────┘║
╚══════════════════╝ │ ║┌────────────────┐║
│ ║│**Special**End**│║
│ ║│entry FNODE LSN│║
│ ║│BtreeDownPtr LSN│║
│ ║└────────────────┘║
│ ╚══════════════════╝
│
│ ╔════════════════════════╗
│ ┌───>║┌──────────────────────┐║
│ │ ║│ 1st data-sector │║
│ │ ║└──────────────────────┘║
│ │ ║┌──────────────────────┐║
│ ╔═══════╗ │ ║│ 2nd data-sector │║
└─>║ FNODE ║ │ ║└──────────────────────┘║
║ ║ │ ╚════════════════════════╝
║ ─────┘
║ ALLOC ║ ╔════════════════════════╗
║ ─────────>║┌──────────────────────┐║
╚═══════╝ ║│ 3rd data-sector │║
║└──────────────────────┘║
(c) 1995 ║┌──────────────────────┐║
J. v. Wijk ║│ 4th data-
Examples of DFS usage
---------------------
1) Resolve original name of FILExxxx.CHK files (created by CHKDSK)
When CHKDSK recovers files it will place in a FOUND.xxx directory in
the root-directory. This directory contains one or more recovered files
with names like FILE0001.CHK
The original name of the file is still in the Fnode, it can be shown
using the following dhpfs commands (assuming drive c:) :
Command Explanation
DFS disks Start DFS and scan physical disks
part id Select partition 'id' (must be HPFS)
\found.000\file0001.chk Search and display Fnode for .CHK
Now 15 characters of the original name are shown as "Fnode Name String"
2) Show freespace area's (HPFS)
slt $
3) Undelete a file; Find the fnode using:
"f z" find the next deleted fnode
"f z shortname" next deleted named shortname (case-sensitive)
"f$@ z shortname" next deleted named shortname (case-insensitive)
Add a '*' to the find command to do a repeated search (see 'f' command)
Then use the "saveto path" command to copy the data for the deleted
file to a directory.
Notes: - It's best to use a different drive to avoid overwriting
4) Save and restore (parts of) a disk
The "sim" command can be used to save a complete disk, including partition
information to one (very large!) file on a different (network) drive.
The save the entire unit (opened disk/partition or volume) use:
"sim img-name 0 $"
It can be restored using the "wrim" command, if and only if the destination
disk has exactly the same geometry as the source disk (heads, sectors cyl).
This could be used to clone one workstation to multiple machines.
4) List all "undeletable" files
Find the FNODES for possibly deleted files using
"f* z" or for specific files: "f*$@ z shortname"
Now list them, including PATH and recovery reliability using:
"list f+f"
Known limitations and bugs
--------------------------
- There is no real support for FAT, NTFS yet besides basic recognition.
- saveto only save the basic file-data, no extended attributes yet
Considered improvements
-----------------------
Automatic detection of inconsistencies (like CHKDSK, FST, HVA and CHKPART)
This will show HPFS problems like CHKDSK does, but in more detail and
maybe some more types of inconsistencies.
Note: Basic HPFS functionality implemented in version 1.62
Some partitioning errors implemented in version 1.82
Real coverage of other file-systems besides HPFS like FAT, LINUX, NTFS ...
The code has been prepared for other file-systems in version 2.21
Graphical User Interface
This could make the program easier to use, however it also makes
the program requirements less attractive becaus it uses PM/WPS
or WINxx and makes porting more difficult.
A command-line version will allways be available to allow operation
from a minimal (diskette) system.
Write capability,
This will allow recovery operations without using other (third-party)
utilities. This will require locking the entire disk so usage is
often limited to diskette BOOT.
Note: Some write enabled commands have been implemented starting with 1.90
Improved volume/disk locking implemented in version 2.25
Update of HPFS internal bad-sector list after a DFS 'scan' command
This is a low-priority item, disks with many bad-sectors are doomed anyway
Recovery for deleted files (undelete), basics implemented in 2.30
Recovery for a 'quick format' on HPFS (unformat)
Recovery for repartitioning (un-fdisk)