DFSee version 9.08 18-04-2008 (c) 1994-2008: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Note on the format Examples of DFS usage _______________________________________________________________________________ N O T E O N T H E F O R M A T: _______________________________________________________________________________ I will write most examples in the form of a DFSee 'scenario' that begins with starting DFSee, and then lists the commands to be used. Starting DFS could be DFSOS2.EXE, DFSDOS.EXE or DFSWIN.EXE (NT/2000/XP), in the example I will use one of them, just fill in whatever you use ... Also, on commands I might add some comment at the end of the line, preceded with a ';' character. You can include that on the actual command, it will be echoed to the screen (and possible log file) but otherwise has no effect. _______________________________________________________________________________ E X A M P L E S: _______________________________________________________________________________ 1) Make a backup of all the important partition sectors in a file Note: It is advisable to use the DFSDISK script for this unless special parameters are required. This will produce all the required backup and information files for recovery. (see HOWTO item number 3) For other purposes, the PSAVE command can be used directly: DFS ;Start DFS and scan physical disks psave * a:\dfspsave Backup of partitioning sectors q Where the last part (Backup of ...) can be any comment you like It can be restored at any time using the PRESTORE command. This will either restore all sectors, or just selected ones. See DFSFDISK.TXT To run this command directly from the (operating system) command line: DFSxxx.EXE psave * a:\dfspsave Backup of partitioning sectors The PSAVE command is also contained in the DFSTART script that can be used to make a backup of all your partitioning information after changes. It is also part of the DFSDISK script used for disaster analysis. So you can also run DFSTART or DFSDISK (not both :-) to get the backup. _______________________________________________________________________________ 2) Create logfile to keep DFSee output for analysis (or to send to me :-) Command Explanation DFS ;Start DFS and scan physical disks log filename ;append logging to 'filename.log' ... or even simpler: DFS -l:filename ... Where you fill in a meaningful filename, like part of your name ... Do NOT use output redirection (DFS xxxx > filename.log) because that will cause a lot of garbage to be logged into the file. _______________________________________________________________________________ 3) Collect information to perform a manual un-fdisk (find all boot sectors): This is automated in the scripts DFSDISK.BAT (DOS/WinNT versions) and DFSDISK.CMD (OS/2 version). These collect info for every physical disk. For analysis, zip the resulting log and PSAVEd files and send it to me: support@dfsee.com Add as many details as you can remember about the original disk layout, partition types, sizes etc. I'll use some of my spare time to take a look at it, which might take some time! _______________________________________________________________________________ 4) Recover a 'lost' NTFS partition where the bootsector is damaged and the partition is not recognized by NT anymore (assuming 3rd partition): Command Explanation DFS ;Start DFS and scan physical disks log recover part 3 fs NTFS fixboot _______________________________________________________________________________ 5) Recover a 'lost' JFS partition where the bootsector is damaged and the partition is not recognized by OS/2 anymore (assuming 2nd partition): Command Explanation DFS ;Start DFS and scan physical disks log recover part 2 fs JFS fixboot _______________________________________________________________________________ 6) Recover a 'lost' HPFS partition where the bootsector is damaged and the partition is not recognized by OS/2 anymore (assuming 1st partition): Command Explanation DFS ;Start DFS and scan physical disks log recboot part 1 fs HPFS fixboot _______________________________________________________________________________ 7) Recover a 'lost' or damaged HPFS spareblock (sector 11) when the partition is not recognized by OS/2 anymore (assuming 1st partition): Command Explanation DFS ;Start DFS and scan physical disks log reCSpare part 1 fs HPFS findcp fixspare Note: with a damaged spareblock you can get various error messages from OS/2 about codepages or other things. However when starting DFSee and selecting the partition it will tell the spareblock is damaged. _______________________________________________________________________________ 8) Save and restore (parts of) a disk or volume The "sim" command can be used to save a complete disk, including partition information to one (very large!) file on a different (network) drive. To save the entire unit (opened disk/partition or volume) use: Command Explanation DFS ;Start DFS and scan physical disks sim img-name 0 $ It can be restored using the "wrim" command, but will only work perfectly if the destination disk has the same geometry as the source disk. ('heads' and 'sectors' the same like "255, 63", cylinders same or larger). This can be used to clone one workstation to multiple machines. Note:From DFS version 4.14 this can be done more easily using CLONE cmd It can also be very useful to save a single sector (like the bootsector) when you are experimenting with the filesystem. Command Explanation DFS ;Start DFS and scan physical disks part 04 ;select the partition sim bootsecX 0 1 ;save bootsector to file bootsecX.img _______________________________________________________________________________ 9) Create a trace-logfile to allow analysis of DFSee internal problems This is to allow analysis of traps or other unexpected behaviour by DFSee and will create a possibly LARGE logfile containing functional trace information on what DFSee is doing. There are three ways to create such a trace, the simplest one will start functional tracing right from the start and might create a HUGE file: Command Explanation DFS -111 ;Start DFS with trace to DFS-111.log ... ;execute any DFSee command that ;shows the problem being analysed As an alternative, you can start DFSee with a regular logfile, and start the functional-trace later in the scenario. This reduces the size of the resulting logfile. Command Explanation DFS -l:problem1 ;Start DFS with trace to problem1.log ... ;execute any DFSee command that ... ;leads towards the problem trace -t 100 ;start trace with timestamps ... ;execute the 'problematic' command(s) Finally you can start DFSee without any logging, and just before the problematic command start functional-trace to a specified logfile: Command Explanation DFS ;Start DFS ... ;execute any DFSee command that ... ;leads towards the problem trace -t problem2 ;start trace to problem2.log ... ;execute the 'problematic' command(s) In all cases, zip the resulting logfile(s) and send with a description of the problematic DFSee behaviour (hang, trap, crash ...) to: support@dfsee.com _______________________________________________________________________________ 10) Undelete a file on HPFS or NTFS; Find the files using: Command Explanation DFS ;Start DFS and scan physical disks part 01 ;select the right partition delfind ;find ALL deleted files export undel01 ;save found fnode info to a file delshow ;optionally list them (ALL !) delshow *test*%100 ;or just a selection, here only 100% ;recoverable with 'test' in the name Use "recover" command to copy the deleted files to a directory, see (11) _______________________________________________________________________________ 11) Recover a selection of the found "undeletable" files (NTFS or HPFS) First find the possibly deleted files using DELFIND, see (9) Command Explanation DFS ;Start DFS and scan physical disks part 01 ;select the right partition import undel01 ;restore found info from file delshow *inst* ;list files with 'inst' in the name recover X:\undel *inst* ;recover same ones to X:\undel\ dir Notes: - It's best to use a different drive to avoid overwriting - The wildcard used on 'delshow' and 'recover' can contain multiple wildcard characters, and deals with the FULL PATH and filename, so you can include (parts of) the directory too. - You can also undelete a single file using the 'saveto' command and specifying the files sequence number: .NNNNN shown at the left of the 'list' output. _______________________________________________________________________________ 12) Update the HPFS bad sector list with the results of a DFS scan Find all sectors that are unreadable: Command Explanation DFS ;Start DFS and scan physical disks part 01 ;select the right partition scan ;find unreadable sectors export b badguys ;save in an ASCII file badguys.lsn Now replace the internal bad sector list with the new modified one: Command Explanation DFS ;Start DFS and scan physical disks part 01 ;select the right partition import b badguys ;get the bad sector list from file fixbs ;and insert in HPFS badsector list Notes: - You can do this in one step too, no need to export/import _______________________________________________________________________________ 13) Show all detected anomalies in the SLT (like allocation errors) Command Explanation DFS ;Start DFS and scan physical disks part nn ;select a partition check ;build SLT and report all errors _______________________________________________________________________________ 14) Display the FAT for a diskette in drive A: Command Explanation DFS ;Start DFS and scan physical disks vol a fatshow _______________________________________________________________________________ 15) Display the FAT Root directory for partition C: Command Explanation DFS ;Start DFS and scan physical disks part C ; select the partition d ; next is bootsector d ; next is root directory _______________________________________________________________________________ 16) Save the master boot record (MBR) on a different PC connected with a parallel laplink cable and running the LPT tool: Command Explanation DFS ;Start DFS and scan physical disks disk 1 sim [lpt.exe]d:\images\mbr.img 0 1 _______________________________________________________________________________ 17) Restore the master boot sector from a different PC connected with LPT: Command Explanation DFS ;Start DFS and scan physical disks disk 1 wrim [lpt.exe]d:\images\mbr.img 0 1 _______________________________________________________________________________ 18) Resolve original name of OS/2 HPFS FILExxxx.CHK files (created by CHKDSK) When CHKDSK recovers files it will place them in a FOUND.xxx directory in the root directory. This directory contains one or more recovered files with names like FILE0001.CHK The original name of the file is still in the Fnode, it can be shown using the following DFSee HPFS commands (assuming partition 03) : Command Explanation DFS ;Start DFS and scan physical disks part 03 ;Select partition 'id' (must be HPFS) \found.000\file0001.chk ;Search and display Fnode for .CHK Now 15 characters of the original name are shown as "Fnode Name String" Note: This will only work with the older CHKDSK versions, the newer ones create a binary CHKDSK.LOG in the root directory of the checked drive, and use a different naming scheme where the original name is reflected already. It is NOT in the FNODE anymore. To read the CHKDSK.LOG use the PMCHKLOG.EXE program that is supplied by IBM (and documented somewhat with the Warp-4 fixpack 8 readme) Last time I looked (May 2003) it was still available at: ftp://service.boulder.ibm.com/ps/products/os2/fixes/chklogpk.exe This is a self extracting file with all needed files. This really should have been part of the OS distribution by now! _______________________________________________________________________________ 19) Show freespace areas (HPFS, FAT, NTFS) Command Explanation DFS ;Start DFS and scan physical disks slt $ _______________________________________________________________________________ 20) Automatically FDISK a workstation using a batch file or command file like: echo DFSee FDISK generic workstation > dfsfdisk.log dfsdos -b newmbr 1 clean dfsdos -b create primary bmgr dfsdos -b startable 1 dfsdos -b create logical fat 6 1 -1,c MAINT dfsdos -b create primary hpfs * 1 +0 WARP This will create a disk with boot manager (image prepared with DFSIBMGR), a small maintenance partition at the end of the disk minus 1 cylinder and a primary partition filling the rest of the disk. Note: This can be done using a native DFSee script (like makepart.dfs) too and this will perform much quicker when run from a diskette because the executable file only gets loaded once. See item 46 for an example. _______________________________________________________________________________ 21) Automatically FDISK a server machine using a batch file or command file like: echo DFSee FDISK RAID server > dfsfdisk.log dfsdos -b newmbr * clean dfsdos -b create primary bmgr dfsdos -b startable 1 dfsdos -b create primary hpfs 300 1 0 SYSTEM dfsdos -b create logical fat 200 1 dfsdos -b create logical hpfs * 1 0 RESTORE dfsdos -b create logical hpfs * 2 dfsdos -b create logical fat * 3 dfsdos -b setboot 0:SYSTEM dfsdos -b setboot m:advanced _______________________________________________________________________________ 22) Make a clean master boot record, getting rid of all old partitions Command Explanation DFS ;Start DFS and scan physical disks newmbr 1 clean ;Create fresh MBR on disk 1 with ;clean, empty partition table _______________________________________________________________________________ 23) Restore saved backup of all the important partition sectors from a file Command Explanation DFS ;Start DFS and scan physical disks prestore * a:\dfspsave Each of the available *.PDn files will be restored to the same disk it was created from. All saved sectors will be restored and, when not using batch mode, the user will be prompted for each of them allowing a more selective restore. _______________________________________________________________________________ 24) Restore PSAVE file of one disk, to a different one, clone partition tables Command Explanation DFS ;Start DFS and scan physical disks prestore 3 a:\dfspsave.pd1 Assuming a PSAVE has been run with at least one disk present, the file dfspsave.pd1 will contain all important partition sectors for disk 1. This will be restored to the specified disknumber 3. _______________________________________________________________________________ 25) Create a detailed overview of all your disks and partitions in a text file Command Explanation DFS -l:diskpart ;Start DFS and open a logfile part -V -a This can also be run directly from the command line, as in: DFS.EXE -l:diskpart -Q part -V -a _______________________________________________________________________________ 26) Clone a physical disk to another (identical) one, including all data Command Explanation DFS -l:dskclone ;Start DFS and open a logfile disk 2 ;select/open the TARGET disk clone -d:1 ;clone disk-1 to disk-2 This can also be run directly from the command line (batch mode!), using: DFS.EXE -l:dskclone -b -Q disk 2#clone -d:1 _______________________________________________________________________________ 27) Clone partition from another partition (data only, no partition table) Command Explanation DFS -l:pclone ;Start DFS and open a logfile part 7 ;select/open the TARGET partition clone -p:1 ;clone part-1 to part-7 This could be used to clone the BMGR to another disk, including all code and configuration data. _______________________________________________________________________________ 28) Resize (truncate) the first partition, making 500 MiB available Command Explanation DFS -l:truncate ;Start DFS and open a logfile part 1 ;select/open the partition resize -f:500 ;truncate to current size minus 500MiB _______________________________________________________________________________ 29) Create an imagefile for a partition, using CLONE instead of SIM Step 1: Create a dummy image file at the destination Stap 2: Open the created dummy and CLONE an existing partition to it echo dummy > v:\part05_backup.img DFS -l:imgclone im v:\part05_backup.img clone -p:05 q Note: The resulting image will be as large as the partition! In real life, SIM is the better alternative. _______________________________________________________________________________ 30) Expand an HPFS partition using DFSee and CHKDSK (updated for 4.28) While testing the TRUNCATE command for HPFS, where CHKDSK is needed to fixup the allocation bitmaps, I found that it also works the other way! a) Make some freespace AFTER your HPFS partition (using DFSee delete) b) Wipe this freespace to all binary zeroes (to avoid garbage info) c) Delete the HPFS partition, and create it again in the same place but with a larger size. (using the freespace from step a) d) Use the 'RESIZE -m' command to update the HPFS internal size info e) Reboot, to allow OS/2 to notice the changed partition and LVM info f) Run CHKDSK on the partition, this will expand the allocation bitmaps to use the whole new partition size for the HPFS filesystem. When the partition has been accessed, it is better to execute the steps (c) and (d) from a bootable DOS diskette using DFSDOS. Otherwise you might get problems (traps) while shutting down OS/2 for the reboot. This is caused by out of date information in several caches. As an alternative for testing with minimal risk, you could create a new (larger) partition and CLONE the smaller one to that location. The scenario for that (and as I used it) is: a) Make a new partition, larger than the current one at different location b) Wipe this new partition to all binary zeroes (to avoid garbage info) c) Reboot, to allow OS/2 to notice the changed partition and LVM info d) For LVM systems, create a new volume "from existing partition" e) Clone the source HPFS partition to this new, larger, location f) Use the 'RESIZE -m' command to update the HPFS internal size info g) Run CHKDSK on the partition, this will expand the allocation bitmaps to use the whole new partition size for the HPFS filesystem. Note that the reboot/LVM step has been moved to an earlier stage here to avoid any risk of clearing the bootsector. (by LVM.EXE) Note: I am not sure if there is a limit to how much you can expand your HPFS partition. All experiences and info on that is welcome! My largest test was expanding a 2000 MiB eComStation bootable partition to a new size of 3500 MiB, the result was a working HPFS partition! _______________________________________________________________________________ 31) Using a DOS boot diskette for DFSDOS.EXE 5.XX TIP: Do NOT USE EMM386 in combination with DFSDOS version 5.xx, as this is known to cause stability problems on some cases like a solid hang on startup of DFSDOS.EXE. 4.XX TIP: Create a boot diskette using a memory manager such as EMM386 to make well over 600 KiB of memory available. NOTE: only needed for DFSDOS version 4.xx !!! version 5.xx runs in 200 KiB free ... _______________________________________________________________________________ 32) Change the filename in an HPFS directory and Fnode This is sometimes needed to get rid of a file that has 'illegal' characters in the name like '>' or other strange characters created in a different codepage. High-level: a) Find the FNODE for the file ('find' command or '\path+filename') b) Update Shortname if needed ('H .' + 'edit' command) c) Check and write back ('show' + 'write' command) d) Find related directory block ('u' + 'd' command) e) Find the long-filename in there ( 'H . ' + some 'd' commands) f) Edit the long-filename in there ('edit' command) g) Check and write back ('show' + 'write' command) Low-level: change '\tmp\filename.bad' to 'filename.txt' DFS.EXE part 03 \tmp\filename.bad h . edit -p:16 -a:"txt" show write . u d ;display the DIR-block ;if BTree pointers are listed, select ;the right block using a ".nnn" cmd ;Note the alphabetic ordering of names H . ;Display first of possible 4 sectors d ;use "d" or until the sector d ;with the filename in it is found edit -p:0xa4 -a:"txt" show write . q _______________________________________________________________________________ 33) Reboot to a different operating system partition (IBM BootManager installed) OS/2 or eComStation installations with IBM BootManager installed can use the standard SETBOOT.EXE program to reboot to any bootable partition. You can do the same using the DFSee program. Added benefit is that you can use it from a Windows partition as well (to boot back to OS/2) and that you can have an extra confirmation step if you like. Example to boot from eComStation to an XP partition called "WinXP": Create a new program object by locating any existing program icon, right-click and select "Create another -> Program" and fill in: Path and filename: H:\T\DFSOS2.EXE Parameters: -w+ setboot -i:WinXP Working Directory: h:\t Session type should be "OS/2 Window" (or "eCS Window") type of program. For the icon you can use DFS.ICO or DFSEE.ICO from the distribution ZIP file, or any other icon you like. As setup like this ("-w+") it will ask for a confirmation (are you sure) If you want to skip that too, just add the "-B" switch to the parameters and specify to start the program "minimized". Example to boot back to "eComStation" from the XP partition: In Windows (NT, W2K, XP) just create a 'shortcut' to the DFSWIN.EXE program and specify the right parameters, example: "-w+ setboot -i:eComStation" For Windows-9x you can do the same using DFSLDOS.EXE, however that also requires the Windows-9x reboot program DFSDOSX.EXE to be present, this will perform a regular Windows shutdown and reboot after the right IBM BootManager info has been set to boot into the wanted partition. Note that DFSLDOS does NOT support a windowed user interface so any "-w+" option will be ignored, and the confirmation is a simple text message. From a command line the reboot is initiated (without confirmation) using: DFSLDOS -B setboot -i:eComStation To create a shortcut on the Desktop that does the same (with confirmation): Right-click on the Desktop, select "New->Shortcut" In "Command line" field: "c:\tools\dfsldos.exe setboot -i:eComStation" Use [Next] to select a Name, then an Icon and [Finish] ... Make sure DFSLDOS.EXE and DFSDOSX.EXE are in the specified directory. DFSLDOS.EXE is in a separate download from the DFSee website, and will not be maintained. The latest available version is 5.04 _______________________________________________________________________________ 34) Copy files from a damaged or inaccessible NTFS, HPFS or FAT partition Sometimes you lose access to NTFS files because of some kind of crash, a failed update or whatever. DFSee is often still capable of finding files within the NTFS filesystem and copy them to another disk. This can be very useful to save a few very important files before reinstalling or trying other recovery methods. DFS.EXE -l:myproj part 02 filefind .java list -f *myproj* recover a: *myproj* q This will first find all filenames containing ".java" in their name on partition number 2 (must be NTFS, HPFS or FAT) and then list all those that also have "myproj" somewhere in the full path specification. Finally the same files as displayed by list are recovered by copying them to the diskette in A: The 'recover' could use a more specific wildcard, like *myproj*dialogs* based on your judgement of the "list -f" output. You can also recover them in several groups to make the files fit on more than one diskette ... Make sure the diskette has enough space to hold all the files to recover, a disk full situation will cause an ungraceful failure! Of course you can recover to any volume (driveletter, path) that you have access to when running DFSee. It could be another disk-partition or a network drive or whatever ... _______________________________________________________________________________ 35) Copy files from a damaged or inaccessible HPFS or FAT partition (DIRFIND) This is an alternative to scenario (34) that works on HPFS and FAT and could be a lot faster too because it searches the directory structures instead of the entire partition. It uses DIRFIND instead of FILEFIND. DFS.EXE -l:myimages part 15 dirfind s \ -l:*.jpg recover d:\images *.jpg q This will first find, then list and finally recover ALL .JPG files from partition 15 to the directory 'D:\images\' on driveletter D: Any paths (subdirectories) from the source partition 15 will be preserved when possible, or be replaced by unique numbers. Note: This requires DFSee version 4.27 or later. _______________________________________________________________________________ 36) Show (only) the disk geometry or MBR-identification for all disks Some recently added options of the 'PART' command can be used to display the disk geometry for all disks, without showing any warnings or the complete table. part -g -w- -t- -g = read disks (refresh) and show geo -w- = do NOT show any warnings -t- = do NOT show the partition table display So, from the command line, to display it and directly quit again: DFS.EXE -Q part -g -w- -t- That will display the geo and automatically quit. Or if you want it in a logfile: DFS.EXE -l:geometry -Q part -g -w- -t- Will put it in 'geometry.log' Another new option will include a one line description of the boot code found in the MBR for each disk: part -m -w- -t- -m = read disks (refresh) show geo AND show MBR description -w- = do NOT show any warnings -t- = do NOT show the partition table display So, from the command line, to display it and directly quit again: DFS.EXE -Q part -m -w- -t- _______________________________________________________________________________ 37) Expand an NTFS partition using DFSee and Windows 'check' (updated for 4.28) The scenario listed in (30) for HPFS works for NTFS as well, with some minor changes due to the 'other operating system' involved. Actually it is even easier because I found that an explicit 'check' operation is often not needed because Windows (XP) will do that at startup automatically. WARNING: Do NOT resize the NTFS partition you are booted from! I strongly advise to use the OS/2 version, or the DOS version DFSDOS.EXE from a DOS boot diskette (requires 700 KiB free mem) a) Make some freespace AFTER your NTFS partition (using DFSee delete) b) Wipe this freespace to all binary zeroes (to avoid garbage info) c) Delete the NTFS partition, and create it again in the same place but with a larger size. (using the freespace from step a) c2 On an LVM system, use the 'LVM' command to update the recorded size d) Use the 'RESIZE -m' command to update the NTFS internal size info e) Reboot to Windows (tested with XP, but NT and and W2K should be OK too) f) Run the 'check' option on the partition in the 'disk management' tool. I found that this step was not really needed, but it can't hurt and you can see if the partition is healthy after the resize. Of course the alternative as outlined in scenario (30) with using a newly created partition and CLONE works too, it is just a different way to get that larger partition table entry for the filesystem to be resized. Note: I am not sure if there is a limit to how much you can expand your NTFS partition. I have tested a 4GiB NTFS data partition, and resized that succesfully to 6GiB. The resulting filesystem was accessible by the XP operating system. I will run another test expanding a bootable Windows-XP that is now 3.5GiB to take up 6GiB ... Update 30-07-2002: Resize of a bootable Windows-XP fails, maybe because it detects a different size at startup, and decides that this is a 'different' computer so the registration is not valid. Resizing back to the smaller size often does NOT work because the allocation information is incorrect for the larger size, and the whole area is considered to be 'in use'. So you have to prepare for this by making an image or clone backup first, and restore that. _______________________________________________________________________________ 38) Show detailed information from .PDn file saved with PSAVE Although a lot of useful information from the files saved with PSAVE can be shown just by typing them (like 'type mysystem.pd1') sometimes you need to see exactly what is inside, before restoring with PRESTORE. This can be done by restoring it to a VIRTUAL disk inside DFSee, and use the normal available display commands on that. DFS.EXE virtual mysystem.pd1 ; make disk just like the PD1 map -d ; show current disk as a map q Actually you can use any of the display commands to view that disk like PART, MAP, DISK, WALK, PL etc., but remember that the ONLY sectors present are the partition tables, LVM-info and bootsectors. So selecting a partition and looking inside will probably result in errors. This is also a good way for experimenting with DFSDISK results. Creating a VIRTUAL disk from one of the DFSDISK.PDx files is a great starting point for recovery tests without risking damaging your real disk. _______________________________________________________________________________ 39) Show (minor) differences between (cloned, HPFS) partitions using COMP As an example for using the compare command I will show you how to use that combined with a few LIST commands to show difference between two HPFS partitions, clones made a few days apart. The original is an eCS boot partition that has been used for a few days after the first cloning. DFS.EXE -l:compeCS part 15 ; select first clone comp -p:19 -list ; compare to other, create list list +f list +fi q There was 2.5 MiB worth of differences, but removing all the lines with 'unidentified data' from the list output reduces that to just a few files. Changes between the two are updates to config.sys, replaced kernel and the DANI drivers. Rest listed are dynamic often changed files ... ========= Example output (edited logfile) for this scenario ============= DFSee-OS2 version : 5.00 executing: comp -p:19 -l Compare area from : alternate Store 2 : Partition (part) 19 = ' ' mode = HPFS TO current store : DEFAULT = Store 1 : Partition (part) 15 = ' ' mode = HPFS Sectors to handle : 003E8200 = 2000 MiB to start sect: 00000000 Compare to area on: same disk, buffer 8064 sect = 4032 KiB First sector todo : 00000000 Progress 4 MiB/. : 00000000 ....................................... 1920 MiB+ 4 MiB/. : 003BEC80 ..................... Last sector done : 003E81FF size 003E8200 = 2000 MiB Elapsed time is : 152 seconds, throughput 13.16 MiB/sec Different sectors : 000012E1 = 2417 KiB The compared areas are NOT identical DFSee-OS2 version : 5.00 executing: list -f (and -f:i, combined in log) .00006 = 0003012E : f 100% 1024 B \IBMCOM\LANTRAN.LOG .00007 = 0003012F : f 100% 2048 KiB \os2\system\SWAPPER.DAT .00010 = 00092D3D : z 100% 255 KiB \os2\OS2SYS.### .00012 = 00092D7A : z 100% 512 B \IBMLAN\LSSHARE.### .00014 = 000938C3 : f 100% 915 KiB \os2krnl.dbg .00016 = 00093A19 : z 100% 1024 B \os2\eCSClock\ALARM.### .00017 = 00093A58 : f 100% 67 KiB \os2\boot\DaniS506.ADD .00018 = 00093A59 : f 100% 26 KiB \os2\boot\DaniATAP.FLT .00019 = 00093A79 : z 100% 512 B \mptn\ETC\TCPOS2.### .00020 = 000A295E : f 100% 12 KiB \IBMLAN\LOGS\NET.AUD .00027 = 000AC6EA : f 100% 830 KiB \os2krnl .00052 = 000AC9AF : z 50% 1024 B \os2\eCSClock\ALARM.### .00053 = 000AC9B0 : f 100% 512 B \mptn\ETC\TCPOS2.INI .00054 = 000AC9B1 : z 100% 1024 B \os2\eCSClock\ALARM.### .00055 = 000AC9B2 : f 100% 512 B \IBMLAN\LSSHARE.INI .00060 = 000AD253 : f 100% 1024 B \os2\eCSClock\ALARM.LST .00061 = 000AD254 : z 100% 0 B \os2\OS2.!!! .00062 = 000AD255 : z 100% 0 B \os2\OS2SYS.!!! .04525 = 000B0B6B : z 100% 1152 KiB \os2\OS2.### .04526 = 000B71D8 : f 100% 1152 KiB \os2\OS2.INI .04527 = 000CB3CA : f 100% 255 KiB \os2\OS2SYS.INI .04528 = 000D68B7 : f 100% 35 KiB \POPUPLOG.OS2 .04638 = 001F07A4 : D 100% 2048 B \Desktop\ .04639 = 001F07A5 : D 100% 2048 B \Nowhere\ .04644 = 001F08F9 : f 100% 9 KiB \Config.Sys ========= End output (edited logfile) for this scenario ============= _______________________________________________________________________________ 40) SETBOOT to other partition, changing LVM driveletters too (2 C: drives) On a system with two LVM-aware operating systems installed, both with assigned instead of calculated drive-letters it is not possible to have two separate C: drives, one visible, the other hidden, and switch between them using IBM BootManager (as often used before LVM)." It IS possible however, to assign the driveletter C: to the partition you want to boot to, after removing it from the current one and then reboot to that new C: drive using a SETBOOT. This can be automated in a single DFSee command (a so called multi-command) As an example, assume there are 3 primary partitions: 1 IBM BootManager 2 eCS-test partition, also installed as C: 3 eCS-GA, installed as primary C: The command to switch from eCS-GA to the eCS-test would be: DFS -w+ -Q lvm -B 3 -l- #lvm -B 2 -l:C #setboot -i:C And to switch back from eCS-test to the eCS-GA: DFS -w+ -Q lvm -B 2 -l- #lvm -B 3 -l:C #setboot -i:C In the example, the LVM will be executed without questions asked, and the setboot will ask a confirmation first. Note that if you decide NOT to boot at this point, that the C: driveletter has changed! This might cause problems with LVM or other disk-tooling. An example to switch without any questions asked: DFS -b -Q lvm 2 -l- #lvm 3 -l:C #setboot -i:C These commands can easily be put in a small batch file (.CMD) or even into the 'parameters' field of a program object on the Desktop. _______________________________________________________________________________ 41) Display contents of a .PDx file (from PSAVE) as a DFS table (and map) dfs virtual -B dfsdiski.pd1 dfs virtual -B dfsdiski.pd1#map -d These commands return to the operating system command line, to stay within DFSee for further displays, use: dfs -Q- virtual -B dfsdiski.pd1 _______________________________________________________________________________ 42) Convert all partitions of a system to LVM-volumes, no questions asked dfs -b vcu _______________________________________________________________________________ 43) Convert any new partitions to volumes, but keep existing ones the same dfs -b lvm * -V _______________________________________________________________________________ 44) Examine (and possibly change) all LVM related values for the volumes using an interactive dialog window. (can also be started with ) dfs lvm q To run this directly from the OS command line, and quit the DFSee executable after the last volume is handled, use: dfs -w lvm Note: You can either use the key or the and keys in the dialog windows to get to the next (or previous) volume. Once the last volume has been done, the LVM dialog is ended. _______________________________________________________________________________ 45) Put ALL existing volumes on the IBM BootManager menu, with dialog window and confirmation for each one (allowing more manual changes) dfs lvm * -menu q _______________________________________________________________________________ 46) Use a native DFSee script to partition a new system (also see 20 & 21) In this case a BootManager image is installed as well, and this requires the file DFSIBMGR.IMG to be present. (created with DFSIBMGR cmd). It will also create the needed LVM-info on the fly using the new -L option for the create command and the new "LVM" functionality. dfs run makepart wsname This will be an 'interactive' run where you will be prompted for confirmations for each command, and can change any values using the LVM dialog as well. For an unattended run (no questions) use: dfs -b run makepart wsname In both cases the 'makepart.dfs' file contains: ;----------- start of script ;Workstation partitioning: BMGR, OS2, MAINT and Data partitions ; log ws$1 ; newmbr 1 clean cr pri bmgr 1 -d:1 -L:"-D -V" cr pri hpfs 800 -d:1 -L:"-D -v:'OS2' -l:C -menu" cr log hpfs 100 -d:1 -L:"-D -v:'MAINT' -l:M -menu" cr log hpfs -d:1 -L:"-D -v:'DATA' -l:D" startable 1 ; part -r ;----------- end of script _______________________________________________________________________________ 47) Perform a CHECK on all partitions, creating a check.log file dfs -l:check part -c _______________________________________________________________________________ 48) Convert partitions to volumes, using industry-standard drive-letter assignments. This is useful if the boot OS is DOS and HPFS, FAT32 or NTFS partitions need to be assigned driveletters too. In this example a logfile 'convert.log' will be created too, and the processing will be 'silent' (no output to the screen). dfsdos -b -q -Q -l:convert part -i#vcu _______________________________________________________________________________ 49) Delete a file from an NTFS filesystem that the normal NT/W2K/XP programs cannot handle. (possibly due to filename problems) This is sometimes needed to get rid of a file that has 'illegal' characters in the name or has an extreme long filename. High-level: a) Select the NTFS volume in question based on drive-letter (VOL) b) Search for the file, using (part of) the filename (FILEFIND) c) Select the right one and show file-details as double-check (.NNN) d) Clear the 'MFT-record' for this file (WIPE) e) Have Windows perform a CHKDSK to update the directory information and allocation for the file. This will release the used space for the file and remove the name from the directory it was in. As an example, when the filename contains the unique "bad-bad file" and there is only one such file on volume G:, the following // to be refined ... DFSWIN.EXE -l:delfile vol g filefind "very-badguy" ;find the files .0 ;select the right one (or only) wipe z . 2 ;wipe MFT record clean (note . !) q Take good care with the WIPE command syntax, it has THREE parameters the second is a DOT and the third is the number TWO. When this is finished, the command: CHKDSK G: /f should be run from a command prompt. Make sure the volume (here G:) is not in use at that time by any program or the CHKDSK will complain ... In the output, you are likely to see references to the filename of the file you are removing since the directory entry will be removed, and you should also see some space being recovered for the file's data area. _______________________________________________________________________________ 50) Correct "does not start on cylinder boundary" error for the first primary partition on a disk that has been moved from the first cylinder to make space for something else. Partition-Magic will NOT align it properly in this case. It will stay aligned on head 1, sect 1 while it should be at head 0, sect 1. We need to move the whole partition towards the beginning of the disk, over one track distance (1 track, usually 63 sectors = 0x3f). As an example, to realign a 3000 MiB FAT32 partition that is PID 2 now: DFSDOS.EXE -l:align delete 2 ;delete current partition table entry cr pri fat32 size ;create it again, aligned part 2 ;select the recreated partition clone -p:2 -f:1,h -!- ;move by cloning, over 1 track (head) ;bypassing the CLONE dialog Note: This correction is mainly cosmetic, there are hardly any tools or operating systems that have a real problem with this misalignment. _______________________________________________________________________________ 51) Clone a physically damaged disk to a new one, to allow recovery on that. This will cause minimal use of the damaged disk, and allows for a second chance if the recovery should fail for some reason. You need an extra disk as a destination for the clone, and it needs to be the same size or larger to make a complete copy of the original damaged disk. To CLONE a physically damaged disk for recovery, the following options are recommended for maximum reliability: -E:i to continue cloning after read errors (incl retries) -b:1 to force single sectors reads, this is very slow but will result in a minimum number of unreadable sectors Note: not needed anymore in DFSee version 7.09 and later since these automatically reduce buffer-size when bad-sectors are encountered. You might also want to change the number of retries on sector read errors from the default of 0 (no retries). To use retries to have a larger chance of recovering hard to read sectors after many retries ... To change this, you need to use the global -A: switch at startup, example: DFSOS2.EXE -A:3 Note: there have been a few reports of DFSDOS.EXE hanging after cloning many bad sectors using a retries (with -A:5). So assuming your damaged disk is placed as the 2nd disk in a system, and a new one is available as disk number 3, the cloning would be: DFSOS2.EXE -l:clone2 disk 3 ;select DESTINATION disk clone -E:i -b:1 -d:2 ;clone from DAMAGED disk q Of course you can use any of the DFSxxx.EXE versions ... The resulting logfile could become large if many read errors occur, but could be very useful afterwards to check where the bad spots have been. Immediately after the cloning has completed, it is advised to change the partition types on the new disk to types NOT recognized by the operating system, to avoid automatic CHKDSK/SCANDISK operations. If you don't do this, recovery might be made very difficult or even impossible ... You might even need to do this on the damaged disk too, if still possible. Note that unreadable sectors on the destination disk will have a content of all 0xFE bytes, easy to recognize as invalid ... _______________________________________________________________________________ 52) Find files on a damaged FAT partition Since the FAT filesystem does not have a data structure for each file, like NTFS and HPFS do, it is harder to find files. There is a SUBFIND command however that will find all sectors that have ".." directory entry Together with the (new) -d option on the LIST command (implies -l-) this can be used to create a listing of all files in those subdirectories. DFSDOS.EXE -l:fnames part 1 ;select a FAT partition subfind ;find subdirectory sectors list -d ;list contents, but keep list. The resulting 'fnames.log' can be used to find missing files by name, and they can be recovered by redisplaying the directory in question and then use the .NNN command plus a SAVETO command to copy the filedata. Note: On older versions this was impossible because listing a directory would destroy the search result list, replacing it with the files in the displayed directory. _______________________________________________________________________________ 53) Fix a "WARNING : Logical partition extends beyond EBR extended-container" This warning will be given together with the partition ID (PID). There are two ways to fix this problem: You can change it interactively using the PTE command, type the command: PTE -p:PID on the DFSee command line, where PID is the DFSee partition ID for the partition (taken from the warning or left column in "part" display). Now you will see a display of the partition table for that partition. Note the value that it shows (in blue text) in the "end cyl" field. The value in yellow on green is the same or exactly 1023. (int13 limited). Using the key, you will see the previous partition table, with the extended-container for the partition in question. On this display it should show the same value for the "end cylinder" but in this case it will be LESS (that is what the warning is about). If you type the correct value over the displayed value in the input field (yellow on green) and to the next field, it will be updated. The related fields will be updated as well to keep everything consistent. If the shown values seem OK, press to write the changes to disk. The second method is simply deleting the partition with "DELETE PID" and create it again using the right type, size and so on ... This will recreate it without damaging any data. _______________________________________________________________________________ 54) Make a multiple partition JFS LVM-volume accessible again Sometimes LVM information gets damaged by disk-tools or by system crashes. For multiple partition JFS volumes, this often results in OS/2 or eCS not assigning a drive-letter anymore because the LVM info is not consistent. To recover this, you need to update the LVM-information on EACH of the involved partitions, making them consistent again. The most important requirements for such a volume are: - The LVM partition names for each partition in the set must be different - The LVM volume name recorded with each one must be exactly equal - The assigned drive-letter recorded with each one must be identical As an example, if you have a large JFS volume that has 3 partitions residing on DFSee partition IDs (PID) 03, 05 and 14, you can create consistent LVM information using: DFSDOS.EXE -l:jfsmulti lvm 03 -v:"jfs 3 part multi" -p:"disk1-multipart-1" -l:K lvm 05 -v:"jfs 3 part multi" -p:"disk1-multipart-2" -l:K lvm 14 -v:"jfs 3 part multi" -p:"disk2-multipart-3" -l:K Note: Recovering LVM-info this way will only work if the LVM-signature sectors and related information, which resides at the END of each partition is still intact. If that is damaged too, it will be nearly impossible to recover the JFS volume. You might be able to use LVM.EXE with a "create from existing partition" selecting each of the partitions in turn, but that should be done in the exact same order as originally. _______________________________________________________________________________ 55) Shorten LVM disk-, Volume- and Partition names to 19 positions maximum This may be needed when long names have been created using LVM.EXE, it can cause display problems with 'lvm /query' and it causes all sorts of problems for tools using the LVM-API (like eCS 1.1 install) To avoid problems, these names should not have more than 19 characters. DFSee will give a warning on the 'PART' command for each disk and partition with a name longer than 19 characters. To shorten all volume names and partition names for all partitions use: lvm -P- * ;shorten volume+partition names lvm -P- -n ;shorten disk names Or, if you want to have the chance to edit the disknames: lvm -n ;shorten disk names, with prompt To edit the volume and partition names, just start the lvm dialog interactively and edit each name as appropriate and use the key to get to each partition in turn: lvm ;start interactive lvm dialog _______________________________________________________________________________ 56) Create a compact partition listing, suitable for email and newsgroups This may be needed when you want to post an overview of the most important partition information to a newsgroup or email it. Typical DFSee output is 80 characters wide and might contain special characters so it easily causes all sorts of formatting problems like line-wrapping when displayed or handled by an email or news program. The simplest way to get such a list is: DFS query and to get it into a file: DFS query > filename or, even better DFS -l query You can also reduce the output more by leaving out the copyright: DFS -B- -l:filename query Finally, since the "query" command is just a synonym for "part -C -m" you can also add other "part" options to the command, examples: DFS query -v ;verbose list all partitions DFS query -m- -d:2 ;just disk 2 DFS query -C- -m- ;the standard 'framed' table DFS query -t- -m- -w ;list warnings only DFS query 3 ;show partition 3 DFS query -d:2 1,r ;show 1st partition on disk 2 In all cases, the 'DFS' program can be either DFSDOS, DFSOS2 or DFSWIN _______________________________________________________________________________ 57) Set the default selection on the IBM BootManager menu With this you can force the IBM BootManager menu to always come up with the specified name/partition being selected, causing that to boot after the timeout even if you booted something else the last time. DFS.EXE setboot -0:"sysname" ;to set default selection to "sysname" q You can also reset it to always default to the 'last booted' system. DFS.EXE setboot -0- ;to set default to 'last booted' q You can do it directly from the command line too: DFS setboot -0- Note that the option is a ZERO not the letter O! _______________________________________________________________________________ 58) Updating the boot code in the MBR sector, NEWMBR This will replace the boot code called by the BIOS (first disk usually) by generic code from DFSee. Doing this will get rid of any unwanted code there like boot managers or even worse virii. DFS.EXE newmbr 1 ;refresh boot code in MBR on disk 1 q You can also erase ALL partitions by clearing the partition table: DFS.EXE newmbr 1 -c ;refresh code and clean table q From the DFSee menu you can do the same using: Mode=FDISK -> New MBR Code KEEP tables -> 1 .. select disk or, to erase the partition table too: Mode=FDISK -> New MBR Code Erase tables -> 1 .. select disk That menu entry both REPLACES the boot code called by BIOS to startup your system (mostly important for the first disk) and it completely erases the partition table in that same MBR sector. And although it does not really are the other partition tables in any extended boot records (EBR) for you logical partitions, it does make all of those invisible since the reference to them in the MBR-table is gone. It does NOT erase any LVM or other information though, the command is limited to the very first sector on the disk only (MBR). _______________________________________________________________________________ 59) Remove LVM information from existing partition(s) You can't completely remove the LVM info from ONE partition using DFSee, but there are two methods that come close: A) Remove all RELEVANT info from the LVM info for a partition This will delete everything that is normally used or displayed for an LVM volume. As an example, for partition 06: lvm 06 -D -v- -p- -l- -m- -i- After applying it will NOT be considered a volume anymore. However, the LVM sector for the partition will still contain the disk name, the partition size, and LVM signature and a valid CRC. Using this partition with DFSee, LVM.EXE or LVMGUI would look the same as using a freshly created partition without any LVM info. B) Remove (erase!) all LVM sectors for a disk This will set the LVM-info and LVM-signature sectors to ZERO! pclear ls -d:n Where 'n' is the disk-number or '*' for all disks. Both commands are documented in DFSFDISK.TXT. _______________________________________________________________________________ 60) Find and recover a SINGLE deleted file (NTFS or HPFS) Command Explanation DFS ;Start DFS and scan physical disks part 01 ;select the right partition delfind document ;find file with 'document' in name delshow *document* ;optional check, list files ... recover x:\tmp ;recover all files to X:\tmp\ dir When there are more than one file listed, you can use a selection wildcard on the recover as well, as in: recover x:\tmp *mydoc* ;recover only files matching 'mydoc' Notes: - It's best to use a different drive to avoid overwriting - The wildcard used on 'delshow' and 'recover' can contain multiple wildcard characters, and deals with the FULL PATH and filename, so you can include (parts of) the directory too. - You can also undelete a single file using the 'saveto' command and specifying the files sequence number: .NNNNN shown at the left of the 'list' output. _______________________________________________________________________________ 61) Create a compressed backup of a RAW imagefile (like SVISTA .HDD) Command Explanation DFS -d- ;start DFS, no physical disk scan sim -I"warp4.hdd" ;open RAW, create compressed image A faster way to do that fom the OS2 commandline using dialogs is: dfs -d- sim -I:"warp4.hdd" Or fully automated, no questions asked: dfs -d- -b -Q sim warp4 -z -m:620,m -I:"warp4.hdd" This would create multiple files, conveniently sized for backup to CDROM. _______________________________________________________________________________ 62) Restore a compressed backup to a RAW imagefile (like SVISTA .HDD) Command Explanation echo whatever > warp4.hdd ;create (nearly) empty file DFS -d- ;start DFS, no physical disk scan im warp4.hdd ;open nearly empty image base 0 0ffffffff ;allow any size wrim warp4.imz ;restore compressed one Note: There will be a quicker compound command like 'UNPACK' to automate that in one of the upcoming 7.xx minor releases _______________________________________________________________________________ 63) Edit a filename in a JFS directory structure, using thye HEX-editor It is not very easy, but doable. The way it works is navigate from the root directory towards the offending filename, using DFSee display commands and each time selecting the next level by using a '.NNN' command to pick a specific entry (file/directory). When the directory containing the incorrect filename is shown you start the HEX-editor on the directory structure. (use ) and carefully edit the offending filename. You must be aware that this are BTREE structures, so finding any filename depends on the sort-order. This means you should NOT change the alphabetic sort order of the entries, which may happen easily when changing the first letter in a filename ... If you DO happen to change the order, the file will still NOT be accessible later (although it will probably not trap either). It might be removed by CHKDSK in that case ... The easiest way to get to the correct directory is using the DFSee commandline that you get to using from the menu. I will show an example below, to navigate to the file: j:\toolkit\h\pmwp.h That is on a JFS partition of mine. I will show each command to be entered to get there, and (part of) the screen output that generates ... You start with a command to select the partition, followed by a few 's to get to the ROOT directory display: DFS part 13 Eventually resulting in a display like this: ++++++++++ DFSee OS/2 8.14 : Executing: FAT style Attrib. : D Inode Links : Parent Inode nr : 0x00000002 1st link Filename : Filename fullpath : \ File size (exact) : 0x00001000 = 4096 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 00029F18 0x000053e3 ++++++++++ The last line is the link to the real contents of the directory. For a directory with many files there may be more than one line, each with its own '.NNN. number (see later example). So now we select that one link: .0 And get a complete directory listed: +++++++++++++ DFSee OS/2 8.14 : Executing: .0 CRC=96fb7246; LSN : 0x00029F18 = Dir Btree+ Page Cyl 6119 H: 87 S: Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00B40008 07-12-2002 20:36:56 A 4096 ÄÄÄÁ D770 @home .001Ú00B62E83 08-04-2007 11:10:20 08-04-2007 11:10:27 256 ÄÄÄÁ D770 @info .013Ú00952988 11-09-2002 12:55:18 A 02-03-2007 16:58:50 8192 ÄÄÄÁ D770 pkg .014Ú00AC8E40 11-09-2002 13:08:46 A 4096 ÄÄÄÁ D770 toolkit .015Ú00AF85E0 11-09-2002 13:09:26 A 4096 ÄÄÄÁ D770 toolkt13 === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our directory 'toolkit' listed as number .014 Selecting that, using: .14 Results in the next level dirctory INODE: +++++++++++++ DFSee OS/2 8.14 : Executing: .14 CRC=f6eaef7e; LSN : 0x00AC8E40 = Directory Inode Cyl 6855 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 0048DFF0 0x00091bfe +++++++++++++ And another gets the actual contents: +++++++++++++ CRC=c92ab0c2; LSN : 0x0048DFF0 = Dir Btree+ Page Cyl 6423 H:209 S: Dtree Pg Self @Bl : 0x00091BFE Size: 0x0001 blocks = 0x00000008 = Next page @Bl : 0x00000000 sector LSN : 0x00000000 Previous page @Bl : 0x00000000 sector LSN : 0x00000000 Dtree page flags : 0x02 0x09 Reserved-2 : 0xa67c entries: 19 Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00AC8E41 15-08-2005 19:18:30 A 364 ÄÄÄÁaccessed 11-03-2007 15:50:42 660 -README- .001Ú00AC64E9 11-09-2002 13:08:46 A 4096 ÄÄÄÁ D770 bin .004Ú00AC9FB0 11-09-2002 13:08:54 A 4096 ÄÄÄÁ D770 dll .005Ú00ACA6C0 11-09-2002 13:08:54 A 12288 ÄÄÄÁ D770 h .006Ú00ADEDD8 11-09-2002 13:08:58 A 4096 ÄÄÄÁ D770 help === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our next level directory 'h' listed as number .005 Selecting that, using: .5 Results in the next level dirctory INODE: +++++++++++++ DFSee OS/2 8.14 : Executing: .5 CRC=a64710d3; LSN : 0x00ACA6C0 = Directory Inode Cyl 6856 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 004895F8 0x000912bf .001 004898F8 0x0009131f PMSEI.H .002 0048DDE8 0x00091bbd WPKEYBD.X +++++++++++++ This is a bit more complicated than before, the INODE contains a few 'splitpoints' that each link to a directory data structure. You need to find the correct branch to follow by comparing your filename (here 'pmwp.h') alphabetically with each entry, until this entry is 'smaller' and the next extry is 'larger' In our case that is between 'PMSEI.H' and 'WPKEYBD.X' so our pmwp.h must be in the .001 branch ... So selecting the correct 'branch' in the tree gets the actual contents: .1 +++++++++++++ CRC=7f563cb2; LSN : 0x004898F8 = Dir Btree+ Page Cyl 6422 H:160 S:5 Dtree Pg Self @Bl : 0x0009131F Size: 0x0001 blocks = 0x00000008 = Next page @Bl : 0x00091bbd sector LSN : 0x0048dde8 Previous page @Bl : 0x000912bf sector LSN : 0x004895f8 Dtree page flags : 0x02 0x01 Reserved-2 : 0x0a23 entries: 123 Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00ACFAEC 20-10-2000 00:19:00 A R 2723 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmsei.h .001Ú00ACFAED 20-10-2000 00:18:00 A R 21594 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmshl.h .002Ú00ACFAEE 20-10-2000 00:18:00 A R 51114 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmspl.h .003Ú00ACFAEF 20-10-2000 00:18:00 A R 117836 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmstddlg.h .004Ú00ACFAF0 20-10-2000 00:19:00 A R 11021 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmtypes.h .005Ú00ACFAF1 20-10-2000 00:18:00 A R 176052 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwin.h .006Ú00ACFAF2 20-10-2000 00:18:00 A R 11131 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwp.h .007Ú00ACFAF3 16-10-2000 20:27:00 A R 29453 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwsock.h .121Ú00AD3FD6 29-12-1999 02:25:00 A R 12671 ÄÄÄÁaccessed 11-03-2007 15:50:50 660 wpjob.xh .122Ú00AD3FD7 29-12-1999 02:19:00 A R 29067 ÄÄÄÁaccessed 11-03-2007 15:50:50 660 wpkeybd.h === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our next level, the wanted file 'pmwp.h' listed as number .006 We do NOT want to select that (would show file INODE) but instead want to EDIT this directory strcuture to change the name. Either use at this point to edit it sector-by-sector, or to edit the whole 4096 byte structure as one object, use: edit -s:8 It will pick up the sector-number to edit from the structure that has just been displayed (last used, or 'this' value) The HEX-editor will start and show a display like: +++++++++++++++ [PgUp] 0 1 2 3 4 5 6 7 8 9 a b c d e f [ItemUp] [LineUp] 000000 bd 1b 09 00 00 00 00 00 bf 12 09 00 00 00 00 00 [................] 000010 02 7b 00 ff 80 01 23 0a 01 00 00 00 1f 13 09 00 [.{....#.........] 000020 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 [................] 000030 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 [........... !"#$] 000040 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 [%&'()*+,-./01234] 000050 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 [56789:;<=>?@ABCD] 000060 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 [EFGHIJKLMNOPQRST] 000070 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 [UVWXYZ[\]^_`abcd] 000080 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 [efghijklmnopqrst] 000090 75 76 77 78 79 7a 7b 7c 7d 7e 7f 24 15 fc 18 fc [uvwxyz{|}~.$....] 0000A0 4c 73 04 00 ff 07 70 00 6d 00 73 00 65 00 69 00 [Ls....p.m.s.e.i.] 0000B0 2e 00 68 00 38 0c ff 04 05 7b 04 fc 1d 49 fc 1f [..h.8....{...I..] 0000C0 4d 73 04 00 ff 07 70 00 6d 00 73 00 68 00 6c 00 [Ms....p.m.s.h.l.] 0000D0 2e 00 68 00 fc 0f 49 fc 31 30 fc 0f 49 fc 29 0e [..h...I.10..I.).] 0000E0 4e 73 04 00 ff 07 70 00 6d 00 73 00 70 00 6c 00 [Ns....p.m.s.p.l.] 0000F0 2e 00 68 00 3f fc 2a fc 09 fc 3e fc 09 30 1c fc [..h.?.*...>..0..] 000100 4f 73 04 00 ff 0a 70 00 6d 00 73 00 74 00 64 00 [Os....p.m.s.t.d.] 000110 64 00 6c 00 67 00 2e 00 68 00 04 02 21 ff 02 08 [d.l.g...h...!...] 000120 50 73 04 00 ff 09 70 00 6d 00 74 00 79 00 70 00 [Ps....p.m.t.y.p.] 000130 65 00 73 00 2e 00 68 00 08 04 ff 06 05 aa 01 04 [e.s...h.........] 000140 51 73 04 00 ff 07 70 00 6d 00 77 00 69 00 6e 00 [Qs....p.m.w.i.n.] 000150 2e 00 68 00 34 fd 03 ff 04 1d d1 c7 36 ff 02 08 [..h.4.......6...] 000160 52 73 04 00 ff 06 70 00 6d 00 77 00 70 00 2e 00 [Rs....p.m.w.p...] 000170 68 00 41 00 0c 00 ff 04 1d d1 c7 11 ff 02 08 00 [h.A.............] 000180 53 73 04 00 ff 09 70 00 6d 00 77 00 73 00 6f 00 [Ss....p.m.w.s.o.] 000190 63 00 6b 00 2e 00 68 00 01 04 02 43 ff 02 08 04 [c.k...h....C....] +++++++++++++++ Where our 'pmwp.h' filename is shown as UNICODE characters in the lines marked 000160 and 000170. You can change the name now either typing new hexadecimal values on the left side of the edit-window, or using ASCII values on the right. You switch between the two using the key. The edit position is where the normal cursor is, and the same position in the other pane will be highlighted in purple ... For changing the 'funny' characters to regular ASCII ones, it may be the easiest to edit in HEX, making sure every other byte in the filename is a zero (00). make sure you do not modify any of the 'non-filename' bytes, and that the sort-order remains the same when possible. Changed bytes will be painted in yellow for convenience. When done, hitting will get you a confirmation dialog to write the sector/object back to the disk ... _______________________________________________________________________________ 64) Delete a file from a JFS filesystem (undeleteable, strange characters etc) The way it works is navigate from the root directory towards the offending filename, using DFSee display commands and each time selecting the next level by using a '.NNN' command to pick a specific entry (file/directory). When the directory containing the incorrect filename is shown you select that by a last .NNN command, which will display the INODE for the offending file. At that point you WIPE a single sector (the INODE) to zeroes. After a reboot, you do a 'chkdsk /f' on the drive and that should tell you it removed the directory entry as well. The easiest way to get to the correct directory is using the DFSee commandline that you get to using from the menu. I will show an example below, to navigate to the file: j:\toolkit\h\pmwp.h That is on a JFS partition of mine. I will show each command to be entered to get there, and (part of) the screen output that generates ... You start with a command to select the partition, followed by a few 's to get to the ROOT directory display: DFS part 13 Eventually resulting in a display like this: ++++++++++ DFSee OS/2 8.14 : Executing: FAT style Attrib. : D Inode Links : Parent Inode nr : 0x00000002 1st link Filename : Filename fullpath : \ File size (exact) : 0x00001000 = 4096 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 00029F18 0x000053e3 ++++++++++ The last line is the link to the real contents of the directory. For a directory with many files there may be more than one line, each with its own '.NNN. number (see later example). So now we select that one link: .0 And get a complete directory listed: +++++++++++++ DFSee OS/2 8.14 : Executing: .0 CRC=96fb7246; LSN : 0x00029F18 = Dir Btree+ Page Cyl 6119 H: 87 S: Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00B40008 07-12-2002 20:36:56 A 4096 ÄÄÄÁ D770 @home .001Ú00B62E83 08-04-2007 11:10:20 08-04-2007 11:10:27 256 ÄÄÄÁ D770 @info .013Ú00952988 11-09-2002 12:55:18 A 02-03-2007 16:58:50 8192 ÄÄÄÁ D770 pkg .014Ú00AC8E40 11-09-2002 13:08:46 A 4096 ÄÄÄÁ D770 toolkit .015Ú00AF85E0 11-09-2002 13:09:26 A 4096 ÄÄÄÁ D770 toolkt13 === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our directory 'toolkit' listed as number .014 Selecting that, using: .14 Results in the next level dirctory INODE: +++++++++++++ DFSee OS/2 8.14 : Executing: .14 CRC=f6eaef7e; LSN : 0x00AC8E40 = Directory Inode Cyl 6855 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 0048DFF0 0x00091bfe +++++++++++++ And another gets the actual contents: +++++++++++++ CRC=c92ab0c2; LSN : 0x0048DFF0 = Dir Btree+ Page Cyl 6423 H:209 S: Dtree Pg Self @Bl : 0x00091BFE Size: 0x0001 blocks = 0x00000008 = Next page @Bl : 0x00000000 sector LSN : 0x00000000 Previous page @Bl : 0x00000000 sector LSN : 0x00000000 Dtree page flags : 0x02 0x09 Reserved-2 : 0xa67c entries: 19 Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00AC8E41 15-08-2005 19:18:30 A 364 ÄÄÄÁaccessed 11-03-2007 15:50:42 660 -README- .001Ú00AC64E9 11-09-2002 13:08:46 A 4096 ÄÄÄÁ D770 bin .004Ú00AC9FB0 11-09-2002 13:08:54 A 4096 ÄÄÄÁ D770 dll .005Ú00ACA6C0 11-09-2002 13:08:54 A 12288 ÄÄÄÁ D770 h .006Ú00ADEDD8 11-09-2002 13:08:58 A 4096 ÄÄÄÁ D770 help === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our next level directory 'h' listed as number .005 Selecting that, using: .5 Results in the next level dirctory INODE: +++++++++++++ DFSee OS/2 8.14 : Executing: .5 CRC=a64710d3; LSN : 0x00ACA6C0 = Directory Inode Cyl 6856 Description for a : Directory Btree Root + Internal nodes Nr Page LSN Block-nr Split-point name (abbreviation) === ======== ========== =============================== .000 004895F8 0x000912bf .001 004898F8 0x0009131f PMSEI.H .002 0048DDE8 0x00091bbd WPKEYBD.X +++++++++++++ This is a bit more complicated than before, the INODE contains a few 'splitpoints' that each link to a directory data structure. You need to find the correct branch to follow by comparing your filename (here 'pmwp.h') alphabetically with each entry, until this entry is 'smaller' and the next extry is 'larger' In our case that is between 'PMSEI.H' and 'WPKEYBD.X' so our pmwp.h must be in the .001 branch ... So selecting the correct 'branch' in the tree gets the actual contents: .1 +++++++++++++ CRC=7f563cb2; LSN : 0x004898F8 = Dir Btree+ Page Cyl 6422 H:160 S:5 Dtree Pg Self @Bl : 0x0009131F Size: 0x0001 blocks = 0x00000008 = Next page @Bl : 0x00091bbd sector LSN : 0x0048dde8 Previous page @Bl : 0x000912bf sector LSN : 0x004895f8 Dtree page flags : 0x02 0x01 Reserved-2 : 0x0a23 entries: 123 Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize === ======== =================== ==== =================== ======== .000Ú00ACFAEC 20-10-2000 00:19:00 A R 2723 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmsei.h .001Ú00ACFAED 20-10-2000 00:18:00 A R 21594 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmshl.h .002Ú00ACFAEE 20-10-2000 00:18:00 A R 51114 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmspl.h .003Ú00ACFAEF 20-10-2000 00:18:00 A R 117836 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmstddlg.h .004Ú00ACFAF0 20-10-2000 00:19:00 A R 11021 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmtypes.h .005Ú00ACFAF1 20-10-2000 00:18:00 A R 176052 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwin.h .006Ú00ACFAF2 20-10-2000 00:18:00 A R 11131 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwp.h .007Ú00ACFAF3 16-10-2000 20:27:00 A R 29453 ÄÄÄÁaccessed 11-03-2007 15:50:49 660 pmwsock.h .121Ú00AD3FD6 29-12-1999 02:25:00 A R 12671 ÄÄÄÁaccessed 11-03-2007 15:50:50 660 wpjob.xh .122Ú00AD3FD7 29-12-1999 02:19:00 A R 29067 ÄÄÄÁaccessed 11-03-2007 15:50:50 660 wpkeybd.h === ======== =================== ==== =================== ======== Nr InodeLSN Creation/LastAccess Attr Modified / Filename Filesize +++++++++++++ So we see our next level, the wanted file 'pmwp.h' listed as number .006 We want to select that now, to show the file INODE, and erase it. .6 The display will be something like this: ++++++++++++++ pmwp.h INODE CRC=224fa32a; LSN : 0x00ACFAF2 = File Inode Cyl 6857 H:184 S:26 062E2CF1 Fileset InoStamp : 0x45e72d6c = 01-03-2007 19:45:48 Inode self number : 0x00047352 = 291666 FileSet : 0x10 Generation : 203463 Owning User (Uid) : 0x00000000 = 0 (root) Group : 0x06 6 (disk) File Mode (660) : 0x420481b0 = -rw-rw---- FAT style Attrib. : A R Inode Links : 1 File size (exact) : 0x00002B7B = 11131 Allocated size : 0x00003000 = 12288 Inode extent @Bl : 0x00159F5C Size: 0x0004 blocks = 0x00000020 = 16.0 KiB Last Access time : 18-04-2007 18:48:07 Last Status : 01-03-2007 15:22:39 Last Modify time : 20-10-2000 00:18:00 Creation : 20-10-2000 00:18:00 Description for a : Regular File Btree Root + Leaf nodes Allocation Check : OK Saveto/Recover/Undelete of filedata is possible RelCluster Extent-size Data-LSN ========== ================== ======== C 00000000 000018 = 12.0 KiB 00AD3EA0 ++++++++++++++ Now WIPE this INODE structure (one sector) using the command: wipe z . 1 After this you should reboot, and after that BEFORE accessing this driveletter in any other way execute a CHKDSK: chkdsk j: /f Where j: is the driveletter of the JFS filesystem in question. As is often the case, this description looks a lot more complicated that executing the actual procedure :-) _______________________________________________________________________________ ----------------------------[ www.dfsee.com ]-------------------------------