DFSee version 11.0 21-12-2011 (c) 1994-2011: Jan van Wijk =========================[ www.dfsee.com ]========================== _______________________________________________________________________________ C O N T E N T S: _______________________________________________________________________________ Command reference = overview of HPFS specific commands Detailed description = description for every command Diagram of an example HPFS structure Note: All generic commands can be found in DFSCMDS.TXT, for example: ALLOC, CHECK, CLONE, RESIZE, RECOVER, SAVETO, SCAN, WIPE _______________________________________________________________________________ C O M M A N D R E F E R E N C E: _______________________________________________________________________________ HPFS specific commands Active filesystem : HPFS, specific commands are: \path-spec = find and show file/directory relative to root (FINDPATH) ALBIT a [lsn s] = Set/reset allocation bit in bitmap for lsn-range BITMAP [xx,s,D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format CA [lsn][opt] = Check Allocation integrity for (current) fnode lsn CHECK [drive] = Check filesystem integrity for drive-letter (CHKDSK) DELFIND [name] = Find deleted files, limit to FNODES containing [name] DIRTY [clean|d] = Make HPFS dirty-bit Clean (avoids CHKDSK) or set it Dirty DIRMAP = Show directory band allocation and usage map FILEFIND [name] = Find normal files, limit to FNODES containing [name] FINDBASE [t][l] = find the start of an HPFS partition by searching sectors FINDCP = find the Codepage info sectors (before FIXCP and FIXSPARE) FINDROOT [n] = find the Root directory starting the search at LSN [n] FIXBOOT = Create HPFS bootsector from template and partition table FIXBOOT [drive] = Create HPFS bootsector from template and partition table FIXBS [clear] = Update bad sector table with LSNs from DFSee badsec-list FIXCP [cpi] = Update spareblock with found LSN for codepage info FIXCS = Calculate checksums and write superblock and spareblock FIXROOT [root] = Fix superblock using found/given root LSN and partition info FIXSUPER [root] = Fix superblock using found/given root LSN and partition info FIXSPARE [cpi] = Create HPFS spareblock sector from superblock info GETBS = Read HPFS bad sector table into DFSee badsec-list HPFSMAP [all] = Show data band allocation bitmaps, HPFS specific format NOBADS = Reset bad-sector/cluster administration to ZERO bad sectors PATH [n] = Show all path components for current fnode, up to root SUPER = Display the filesystem SPARE and SUPERBLOCK sectors For an up-to-date list of commands, use the '?' command HPFS specific sector types (see ??? command) 'I' = File data 'E' = EA data 'A' = ACL data 'B' = Boot area 's' = HPFS superblock 'p' = HPFS spareblock 'H' = Hotfix table 'h' = Hotfix data 'x' = Bad sector list 'X' = Bad sector 'S' = Spare Dirblocks 'D' = Directory Fnode 'y' = Deleted Dir Fnode 'f' = File Fnode 'z' = Deleted FileFnode 'a' = Allocation block 'Z' = Deleted All-block 'd' = Directory block 'P' = Dir-band (free) 'Q' = Dir-band bitmap 'c' = Codepage info 't' = Codepage data 'i' = HPFS386 User-id 'm' = Bitmap Tables 'M' = Bitmap data For an up-to-date list, use the '???" command _______________________________________________________________________________ D E T A I L E D D E S C R I P T I O N: _______________________________________________________________________________ \path-spec = find and show file/directory specified by path-spec Purpose: Locate the fnode for a known file or directory Parameters: path-spec full path specification with no intervening space after the '\' command character Output: Search result list starting at the ROOT directory up to the requested file or directory. It is either followed by an error message if the path-spec was not found or by the display of the corresponding fnode information. Remarks: The search algorithm depends on the ROOT fnode being known. When the superblock is corrupt this fnode can be resolved using the 'findroot' command. _______________________________________________________________________________ ALBIT a lsn s = Set/reset allocation bit in bitmap for lsn-range Purpose: Manually set or reset allocation bits in the bitmap Parameters: a mandatory 's', 'a' or '1' will set to "allocated", others will be set to "free" state. lsn optional Start LSN for the range, default is 'this' s optional size for the LSN-range, default is 1 Output: none Remarks: This is a potentially dangerous operation. _______________________________________________________________________________ BITMAP [xx s D] = Show bitmap at LSN xx, size s, in alloc or [D]ir format Purpose: Show a bitmap located at specified LSN, alloc or DIR format Parameters: xx mandatory LSN of a bitmap sector s optional size to dump: 1..63 specifies sectors 64..xxx specifies bytes Default is 4 sectors (default bitmap size) D optional directory format flag Output: Graphical bitmap display of the specified bitmap LSN. Remarks: Specifying an LSN that is not a bitmap-LSN will result in a garbage bitmap display. _______________________________________________________________________________ CHECK [drive] = Check filesystem integrity for drive-letter (CHKDSK) Purpose: Perform a filesystem check, and report the errors found. Parameters: drive PID or driveletter for partition to check. When not specified, the CURRENT object is checked. Options: -r Force refresh of the Sector Lookup Table (SLT) even if one exists already Output: Two lines for each sector in error that is found. The first lists the sector number, where it is referenced from and a short description. The second line is an error description. For HPFS the reported errors are: 0x000001 Linked to some structure, but not in allocation-map 0x000002 Allocated in allocation-map, but no known link 0x000004 HPFS Shortname does not match DIR name 0x000008 Fnode is a directory but DirFlag is not set 0x000010 Fnode data length greater than Dir-entry size 0x000020 Fnode data length smaller than Dir-entry size 0x000040 Fnode data length greater than allocated size 0x000080 Fnode data length smaller than allocated size 0x000100 Checksum value is incorrect 0x001000 LSN does not point to valid Dirblock 0x002000 LSN does not point to valid Fnode 0x004000 LSN does not point to valid Allocation sector 0x008000 LSN is too large for this volume 0x010000 Unreadable or corrupted CP-INFO sector 0x020000 Unreadable or corrupted CP-DATA sector 0x800000 The filesystem is marked DIRTY (open files) this may cause bogus errors to be displayed! Remarks: Some of the errors are generic, but most are filesystem specific. The generic ones are also listed with the CHECK/SLT command in dfscmds.txt. _______________________________________________________________________________ DIRTY [clean|d] = Make HPFS dirty-bit Clean (avoids CHKDSK) or set it Dirty Purpose: Modify the HPFS volume's 'dirty' state Parameters: state mandatory 'clean' will set it clean (no CHKDSK) 'dirty' will force CHKDSK on reboot (unless clean shutdown done afterwards) Output: 'super/spareblock written' confirmation Remarks: A volume is normally marked 'dirty' by the OS on the first write access to it, and set 'clean' on successful shutdown. This means a system crash will cause a CHKDSK on reboot It is most useful from boot diskettes (DOS or OS/2) _______________________________________________________________________________ CS = Calculate HPFS style checksum on last-read sector Purpose: Show / check checksum on HPFS sector (super/spare) Parameters: none Output: Checksum value Remarks: Only meaningful for superblock (10) and spareblock (11) These checksums are also stored by HPFS in the spareblock. _______________________________________________________________________________ DELFIND [name] = Find deleted files, limit to FNODES containing [name] Purpose: Find deleted files, with 'name', starting at current LSN Parameters: name optional part of filename wanted, not a true wildcard, but may start and end in a '*' character Options: -c Start from current sector, not start of volume -v Verbose search, list files while found (SLOW!) Output: Find-result list (as "find -t:z") on screen and in memory Remarks: All deleted files, or the ones where the FNODE sector contains the specified ASCII string, will be found and added to the list. The [name] selection aims at the FILENAME part only, to select on part of the full path for the file, use the wildcard select parameters on the DELSHOW and RECOVER commands The [name] is NOT case-sensitive, and there is a slight chance of 'false-hits' when other parts of the FNODE contains the string List can be manipulated as usual, best viewed with "delshow" _______________________________________________________________________________ DIRMAP = Show directory band allocation and usage map Purpose: Show usage of the preallocated directory band Parameters: none Output: A single graphical bitmap display showing the allocation of the preallocated directory band. Remarks: If 100% is allocated more directory information will be allocated elsewhere on the volume. _______________________________________________________________________________ FILEFIND [name] = Find normal files, limit to FNODES containing [name] Purpose: Find non-deleted files, where the FNODE contains a name. The found files can be copied to another disk using the RECOVER or SAVETO commands, just as with deleted files. Parameters: name optional part of filename wanted, not a true wildcard, but may start and end in a '*' character Options: -c Start from current sector, not start of volume -v Verbose search, list files while found (SLOW!) Output: Find-result list (as "find -t:f") on screen and in memory Remarks: All non-deleted files, or the ones where the FNODE contains the specified ASCII string, will be found and added to the list. The [name] selection aims at the FILENAME part only. To select on part of the full path for the file, use the wildcard select parameters on the DELSHOW and RECOVER commands afterwards. The [name] is NOT case-sensitive, and there is a slight chance of 'false-hits' when other parts of the FNODE contain the string List can be manipulated as usual, best viewed with "delshow" or the equivalent "list -f" The names used will be significant in the first 15 characters only. The rest of the name will be replaced by hyphens ('-'). This is because the FNODE only stores the first 15 characters of the name. _______________________________________________________________________________ PATH [n] = Show all path components for current fnode, up to root Purpose: Show the directory branch that contains current file/dir Parameters: n optional Start LSN for the search Output: One line for each found 'parent' directory, up to the root Remarks: _______________________________________________________________________________ CA [lsn][opt] = Check Allocation for (current) fnode lsn Purpose: Check allocation integrity for current fnode Parameters: lsn optional LSN of the fnode opt optional Options: v = Verbose, show progress Output: ä Start of an HPFS allocation-sector used on heavily fragmented files with more than 8 file-extents ¯ Start of one file-extent (fragmented file) ú One sector, small green dot, allocation is OK þ One sector, big red dot is allocation error Also a summary is given with the number of (failed) sectors Remarks: Fnode may be for a regular file (sectors must be ALLOCATED) or for a deleted file (sectors must be FREE) _______________________________________________________________________________ FINDBASE [t][l] = find the start of an HPFS partition by searching sectors Purpose: Force a different partition start sector for HPFS partition Parameters: t One or more sector types to use in the search default is "spad", Super, Spare, Alloc and Dirblock f for fnode can also be used but is less reliable l Sector number to use as end for partition (optional) Output: Search progress and final result when HPFS partition found Remarks: Can be used if start of partition / partition tables are bad Use the "fs hpfs" command first to force HPFS mode. The old 'AUTOBASE' syntax is still accepted as a synonym ... _______________________________________________________________________________ FINDCP = find the Codepage info sectors (before FIXCP and FIXSPARE) Purpose: Find the first sector with codepage info for the partition Parameters: none Options: -A Do not stop after first Codepage-sector is found, default is to stop searching after the 1st and probably only one is found. Output: Search progress and codepage info when found Remarks: DFSee internal administration is updated with the found location to be used by FIXCP and FIXSPARE commands. _______________________________________________________________________________ FINDROOT [n] = find the Root directory without using the superblock Purpose: Find the fnode for the ROOT directory, even if parts of the volume, including the superblock, are damaged. Parameters: n optional Start LSN for the search Output: Search result list starting at the first fnode encountered up to the fnode for the ROOT directory when found. Remarks: Specifying a start lsn might be needed if reading at the start of the volume results in device errors, or if some fnodes in the sequence are corrupted. _______________________________________________________________________________ FIXROOT [root] = Fix superblock using found/given root LSN and partition info FIXSUPER [root] = Fix superblock using found/given root LSN and partition info Purpose: Fix bad Root-LSN pointer, after CHKDSK bugs or other damage Write new superblock to disk, when constructed at select. Parameters: root optional LSN of root directory (manual value) Note: When not specified, the current value or the FINDROOT result is used automatically (recommended). Options -r Force recalculate directory band locations and size Output: Display of updated superblock Remarks: FIXROOT and FIXSUPER are aliases, they are identical in function. One use is to write a newly created superblock to the disk if there was no superblock at all, and another use is updating the reference to the root directory after a FINDROOT command. The Root-LSN is the LSN for the root directory FNODE, that is stored in the HPFS superblock In some cases an additional OS/2 CHKDSK on the filesystem is needed to get normal access to the files again. _______________________________________________________________________________ FIXBOOT [drive] = Create HPFS bootsector from template and partition table Purpose: Fix corrupted bootsector for an HPFS partition Parameters: drive optional Driveletter of OS/2 or eCS installed on this (logical) partition, use '-' to reset to 'data' partition When not specified, the letter will be determined from existing partition info Options -c Use classic boot code (OS/2 20.0, upto Warp4) not newer I13X-aware (OS/2 4.50, eCS & CP) -I13X Use IBM standard I13X check (default is 'ignore') Output: Progress and confirmation info Remarks: For any of the filesystems (FAT, HPFS, NTFS, JFS) check the corresponding DFSxxx.TXT documentation file for 'FIXBOOT'. This will create a valid bootsector based on WARP version 4 bootsector code and size info from the partition table and/or the HPFS superblock at relative sector 0x10. Only the bootsector is written. To make the partition boot properly, it might be needed to run 'sysinstx' afterwards The partition table info (type and size) must still be valid, or a valid superblock must be present, or both. Without the -I13X and -c options, an I13X capable bootsector is created that does NOT check the I13X signature set by the MBR allowing it to work correctly with 'foreign' MBR code and bootmanagers as well as with the IBM ones. _______________________________________________________________________________ FIXSPARE [cpi] = Create HPFS spareblock sector from superblock info Purpose: Fix corrupted spareblock sector for an HPFS partition Parameters: cpi optional Force this CodePage LSN Output: Progress and confirmation info Remarks: This will create a valid spareblock sector based on the superblock and location of the codepages (use FINDCP first!) Only the spareblock and superblock are written, including the checksum information The partition table info (type and size) must still be valid! _______________________________________________________________________________ FIXCP [cpi] = Write back the CodePage LSN found with the 'FINDCP' command Purpose: Fix bad CodePage LSN pointer Parameters: cpi optional Force this CodePage LSN Output: none Remarks: This will only update the codepage reference in the spareblock Use the FIXSPARE command to recreate the entire spareblock. _______________________________________________________________________________ FIXBS [clear] = Update bad sector table with LSNs from DFSee badsec-list Purpose: Replace the internal HPFS bad sector list with the DFS bad sector list, or clear the list completely. Parameters: clear optional Make internal and DFSee bad sector list empty Output: none Remarks: The list can be the result of the "scan", "getbs", "mem" or "import" cmd, allowing modification offline with an editor. The OS/2 chkdsk command will give erroneous results on "reserved for system use" until the next reboot. It is better to lock the physical disk before writing to it See 'lock' and 'unlock' commands _______________________________________________________________________________ GETBS = Read HPFS bad sector table into DFSee badsec-list Purpose: Replace the DFS bad sector list with the internal HPFS one Parameters: none Output: none Remarks: none _______________________________________________________________________________ FIXCS = Calculate checksums and write to superblock and spareblock Purpose: (re)calculate the checksum for superblock and spareblock and write them both back to the disk Parameters: none Output: none Remarks: none _______________________________________________________________________________ HPFSMAP [all] = Show data band allocation bitmaps, HPFS specific format Purpose: Show usage and the distribution of data over the volume. Parameters: Any parameter will cause verbose format to be used Output: A single graphical bitmap display for the entire volume or for each allocation-band when verbose format is selected Remarks: System-reserved and directory band are indicated with 'S' and 'R' respectively. Other areas are filled in according to the degree of usage (allocation) This is the renamed "ALLOC" command from older DFSee versions. Without parameters it will show a single allocation-map for the whole volume with a fixed scale (Megabytes per character), so it can become quite large. With the 'all' parameter it will show a map for each of the 8 MiB allocation 'bands' which shows even more detail ... The new generic "ALLOC" command also shows a map for the whole volume, but scales that to fit on about one screen/page. _______________________________________________________________________________ NOBADS = Reset bad-sector/cluster administration to ZERO bad sectors Purpose: Make sure the filsystem specific administration for bad sectors is reset to a state where NO bad-sectors are present. Parameters: none Output: Message indicating success or failure Remarks: This is most useful after CLONING (or imaging) a damaged disk or partition that had bad sectors areas to a new disk. Running the 'NOBADS' command will reclaim the previously marked sectors/clusters back for normal use. For HPFS this will affect the allocation bitmaps and the bad-sector list that is linked to the superblock. Sectors currently in the list will be marked 'free' in the bitmap, and a new empty bad-sector list is created. _______________________________________________________________________________ SUPER = Display the filesystem SPARE and SUPERBLOCK sectors Purpose: Display the contents of the JFS superblock Parameters: none Output: Most important fields of the superblock _______________________________________________________________________________ D I A G R A M O F E X A M P L E H P F S S T R U C T U R E: _______________________________________________________________________________ Basic HPFS data structure for Root directory with AUTOEXEC.BAT, README file, an OS2 subdirectory and lots of other files. The README file has it's data allocated in 2 alloc-chunks. ÉÍÍÍÍÍÍÍÍÍ» ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» ÉÍÍÍÍÍÍÍ» ºSUPER º ÚÄÄ>º DIR block º ÚÄÄ>º FNODE º º º ³ º º ³ º º º º ÉÍÍÍÍÍÍÍ» ³ ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ º º ÉÍÍÍÍÍÍÍÍÍÍ ºRoot LSN ÄÄÄÄ>º FNODE º ³ º³*Special**Start*³º ³ º ALLOC ÄÄ>º DIR block ÈÍÍÍÍÍÍÍÍͼ º º ³ º³entry FNODE LSN³º ³ ÈÍÍÍÍÍÍͼ º º º ³ º³BtreeDownPtr LSN³º ³ ºÚÄÄÄÄÄÄÄÄÄ º ALLOC ÄÄÙ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ³ º³8514.RC ÈÍÍÍÍÍÍͼ ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ º³entry FNO º³OS2 (subdir) ³º ³ º³BtreeDown º³entry FNODE LSNÃÄÄÄÄÙ ºÀÄÄÄÄÄÄÄÄÄ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´BtreeDownPtr LSN³º ºÚÄÄÄÄÄÄÄÄÄ ³ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº º³ANSI.EXE ³ ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ º³Special-end ³º ³ ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» º³entry FNODE LSN³º ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» ÀÄ>º DIR block º º³BtreeDownPtr LSNÃÄÄÄÄÄÄÄ>º DIR block º ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º º³*Special**Start*³º ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ º³*Special**Start*³º º³entry FNODE LSN³º º³entry FNODE LSN³º º³BtreeDownPtr LSN³º ÉÍÍÍÍÍÍÍ» º³BtreeDownPtr LSN³º ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ÚÄ>º FNODE º ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ º º ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º º³AUTOEXEC.BAT ³º ³ º º ÉÍÍÍÍÍÍÍÍÍÍÍ º³PP... filename ³º º³entry FNODE LSNÃÄÄÄÙ º ALLOC ÄÄ>ºÚÄÄÄÄÄÄÄÄÄÄ º³entry FNODE LSN³º º³BtreeDownPtr LSN³º ÈÍÍÍÍÍÍͼ º³ 1st data- º³BtreeDownPtr LSN³º ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ºÀÄÄÄÄÄÄÄÄÄÄ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º º³OS1.. filename ³º º³README filename ³º º³entry FNODE LSN³º ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´entry FNODE LSN³º º³BtreeDownPtr LSN³º ³ º³BtreeDownPtr LSN³º ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ³ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º º³**Special**End**³º ³ º³XXX... filename ³º º³entry FNODE LSN³º ³ º³entry FNODE LSN³º º³BtreeDownPtr LSN³º ³ º³BtreeDownPtr LSN³º ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ³ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ ³ ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ º³**Special**End**³º ³ º³entry FNODE LSN³º ³ º³BtreeDownPtr LSN³º ³ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ³ ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ ³ ³ ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» ³ ÚÄÄÄ>ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ ³ º³ 1st data sector ³º ³ ³ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº ³ ³ ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ³ ÉÍÍÍÍÍÍÍ» ³ º³ 2nd data sector ³º ÀÄ>º FNODE º ³ ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº º º ³ ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ º ÄÄÄÄÄÙ º ALLOC º ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» º ÄÄÄÄÄÄÄÄÄ>ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º ÈÍÍÍÍÍÍͼ º³ 3rd data sector ³º ºÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙº (c) 1995 ºÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿º J. v. Wijk º³ 4th data _______________________________________________________________________________