DFSee logo
(Documentation for the EXPERT Mode=NTFS menu)
(to DFSee main page)  |  File  |  Edit  |  Actions  |  Image  |  Display  |  Scripts  |  Help  |  (to BASIC menu)
Mode=FDISK  |  AUX  |  DUMPFS  |  EXTn  |  FAT  |  EFAT  |  HFS+  |  HPFS  |  JFS  |  NTFS  |  REISER  |  SWAP  |  XFS
(Mode=NTFS)


Mode=NTFS Menu: [Windows-NT/W2K/XP/W7/W8 native File System]

Allocation map display

From main menu: Mode=NTFS -> Allocation map display

Display a pseudo-graphical map of used versus free sectors in the filesystem

Menu item screenshot(s)


    Display a usage map for the currently selected disk or filesystem

    A pseudo-graphical map of the disk or partition allocation is
    displayed, showing the distribution of data over the object

    This is also an indication for the amount of unused sectors in
    the object, that are beneficial to 'SMART-SECTOR' optimizations
    in imaging and cloning operations.

    The percentage of used sectors are displayed as a percentage at
    the end of the line, and a total usage percentage and size is
    shown just after the map itself.

    For filesystems that support resizing, the limits for resizing
    are shown after the map itself.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


File Find/Recover/HEXedit

From main menu: Mode=NTFS -> File Find/Recover/HEXedit

Find deleted/normal files, list and possibly recover them. HEX edit dir/file


    This submenu offers selections to search for normal or deleted
    files, display the resulting lists and possibly recover files.

    It also offers selection to HEX-edit either the meta-information
    for a file (MFT-record) or the actual file contents

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Browse/Recover Deleted Files

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Browse/Recover Deleted Files

Find deleted files, then BROWSE the resulting list and copy files (UNDELETE)


    This will find most files that have been deleted from a
    filesystem and store the result in the sector-list.

    The sectorlist is then used to BROWSE through the find results.

    The dialog will allow 'actions' to be performed on the listed
    files/directories, using <ENTER> to get the popup menu:

                 - View contents, as ASCII on File/Dir
                 - View as x86 Assembler - disassembly
                 - HEX-edit, contents only on File/Dir
                 - Edit Contents, autoview on File/Dir
                 - View OS/2 EA or Xattr on a File/Dir
                 - Edit DATA area sectors for File/Dir
                 - Edit META:Inode/Fnode/MFT/Dir-entry
                 - Edit the base filename for File/Dir
                 - Copy/Recover File(s) to other drive
                 - Reduce list to SELECTED files only

    While deleted files can NOT be recoverd 'in-place' they CAN be
    copied to another filesystem, in effect UNDELETING them with
    the 'Copy/Recover' selection from the above menu.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Search Deleted files => list

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Search Deleted files => list

Search MFT records for deleted files, 'Recover from list' will UNDELETE them


    This will search the whole partition for MFT-records of DELETED
    files that match the partial filename (wildcard) specified.

    The sectornumbers of the found MFT-records will be added to the DFSee
    sectorlist so can be used in later actions, or be exported to a file.

    The files contained in that list can be RECOVERED to any directory
    on the system, including a network, by using the 'RECOVER' command.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Search Any/all files => list

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Search Any/all files => list

Search MFT records for deleted or non-deleted files, for 'Recover from list'


    This will search the whole partition for MFT-records of non-deleted
    or deleted files that match the partial filename (wildcard) specified.

    The sectornumbers of the found MFT-records will be added to the DFSee
    sectorlist so can be used in later actions, or be exported to a file.

    The files contained in that list can be RECOVERED to any directory
    on the system, including a network, by using the 'RECOVER' command.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Search Normal files => list

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Search Normal files => list

Search MFT area for records for non-deleted files, for 'Recover from list'


    This will search the whole partition for MFT-records of non-deleted
    regular files that match the partial filename (wildcard) specified.

    The sectornumbers of the found MFT-records will be added to the DFSee
    sectorlist so can be used in later actions, or be exported to a file.

    The files contained in that list can be RECOVERED to any directory
    on the system, including a network, by using the 'RECOVER' command.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Browse FS, directory/files F9

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Browse FS, directory/files F9

Browse files/directories in a list from a single directory, or current list

Menu item screenshot(s)


    This will show the contents of a single directory, specified
    by a PATH from the ROOT directory, or by selecting a directory
    from the browse list itself (including the '..' directory).

    Alternatively, the CURRENT contents of the sectorlist can be
    browsed, when available (by specifying a '.' for the directory

    The list can be browsed in an interactive dialog, a bit like
    a regular filemanager.

    The dialog will allow 'actions' to be performed on the listed
    files/directories, using <ENTER> to get the popup menu:

                 - View contents, as ASCII on File/Dir
                 - View as x86 Assembler - disassembly
                 - HEX-edit, contents only on File/Dir
                 - Edit Contents, autoview on File/Dir
                 - View OS/2 EA or Xattr on a File/Dir
                 - Edit DATA area sectors for File/Dir
                 - Edit META:Inode/Fnode/MFT/Dir-entry
                 - Edit the base filename for File/Dir
                 - Copy/Recover File(s) to other drive
                 - Reduce list to SELECTED files only

    When the browse session is ended (<Esc> or <F3> key):

      - the SAME filesystem/partition stays selected
        You can restart browse the same partition with the <F9> key,
        or start browsing another partition from the Actions menu
        using: 'Actions -> Open Partition, Browse FS'

      - the sector-list contains the last browsed directory
        and can be viewed with commands like 'list -f

      - The last entry (file) that was selected will also be set
        as the current sector-location ('this'), so it easy to
        analyse that furthher, for example by using the HEX-editor
        that can be started with <F2>, or simply by viewing the
        sector using the <Enter> key.
    Note: When working in 'mode=FDISK' (with a whole disk opened)
          you will be presented with a selection-list to pick a
          partition with a filesystem first.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Display files from List ...

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Display files from List ...

Display (selected) files from the list, using a PATH+FILENAME wildcard

Menu item screenshot(s)


    This will display the DFSee sector-list in a compact format, suited
    to the data contained in the list

    This usually is a 'list -f' or a 'list -s' variant.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Recover files from list ...

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Recover files from list ...

Recover (selected) files from the list to a supplied recovery directory


    This will allow you to recover (copy) one or more of the files in the
    list to any local or network directory on your system.

    It will prompt for a destination directory first, using the last used
    one as a default. All files recovered in one go, will be recovered to
    this same directory, with their original path appended to retain the
    directory structure whenever possible.

    It will also prompt for a selection specification in the form of a
    full PATH+FILENAME wildcard and an optional allocation-percentage.

    As an example, the specification:

       '*mydoc*\*project_x*.doc%100'

       will recover all files that have 'mydoc' somewhere in the PATH,
       'project_x' in the filename and have an extension of '.doc' that
       seem to be 100% recoverable. (100% allocation-OK ranking).

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Recover THIS file ...

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Recover THIS file ...

Recover the file associated with the CURRENT sector to a recovery directory


    This will allow you to recover (copy) the file represented by the
    CURRENT displayed sector, also called the 'THIS' sector to any local
    or network directory on your system.

    It will prompt for a destination directory first, using the last used
    one as a default. The file will be recovered with its original path 
    appended to that to retain the directory structure whenever possible.

    The menu item will only be enabled (selectable) when the CURRENT sector
    represents a normal or deleted FILE for the filesystem involved.
    This means it has to be a type 'f' or 'z' sector, which is:

         For HPFS: an FNODE sector
         For JFS:  an INODE sector
         For NTFS: an MFT record

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Find ONE file/dir by Path

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Find ONE file/dir by Path

Find info (FNODE/MFT-record etc) for ONE specified file/directory path


    This uses the specified path from the root-directory to locate
    detailed information for the file or directory for that path.
    This will be from the FNODE on HPFS, the MFT-record on NTFS or
    similar structures like Inodes on other filesystrems.

    The path and filename may contain spaces.

    When found the information will be displayed in the standard
    format as defined for the filesystem that is active.
    You can display related information like the directory entry
    or the actual file data from there using the U and D commands.

    You can also use the 'saveto' command or corresponding menu
    item 'Recover THIS file' to create a copy of this found file
    on the specified or default recovery destination
    (or use the combined menu option instead of this find :-)

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Find and Recover ONE file

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> Find and Recover ONE file

Find ONE file by full path+filename, and recover it to a recovery directory


    This uses the specified path starting from the ROOT to locate
    ONE specific file, and when found will issue a SAVETO command
    to recover the contents of this file to a recovery directory.

    The path and filename may contain spaces.

    Note:
    The recovered file will be placed directly in the specified
    recovery directory without the full original path, but with
    the proper filename retained (even on JFS :-).

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



HEX edit file/dir Info (1)

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> HEX edit file/dir Info (1)

Find + edit FAT dir entry / HPFS fnode / JFS inode / NTFS MFTrec+small files

Menu item screenshot(s)


    This uses the specified path from the root-directory to locate
    information for the file or directory for that path.
    This will be from the FNODE on HPFS, the MFT-record on NTFS or
    similar structures like Inodes on other filesystrems.

    The path and filename may contain spaces.

    When found the information at THAT level (1st, direct)
    will be opened in the standard HEX editor

    This will often be META-data about the file or directory,
    with a layout strongly defined by the filesystem type

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


HEX edit file/dir Data (2)

From main menu: Mode=NTFS -> File Find/Recover/HEXedit -> HEX edit file/dir Data (2)

Find, then HEX edit most HPFS / JFS / NTFS file-data or directory contents

Menu item screenshot(s)


    This uses the specified path from the root-directory to locate
    information for the file or directory for that path.
    This will be from the FNODE on HPFS, the MFT-record on NTFS or
    similar structures like Inodes on other filesystrems.

    The path and filename may contain spaces.

    When found the information at the NEXT level (2nd, indirect)
    will be opened in the standard HEX editor

    This 'next' level is what would be displayed using a 'd' command
    or using the ENTER key when the first level is being displayed.

    It will often be data or contents for the file or directory.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Boot area fixes/updates

From main menu: Mode=NTFS -> Boot area fixes/updates

Fix bootsector, HiddenSectors/GEO, BOOT.INI and NTLDR imaging and fixing


    This submenu offers selections for fixes related to booting like
    fix the bootsector itself, NTLDR image creation and restore,
    fixing the HiddenSectors and geometry fields in the bootsector
    plus BOOT.INI display and FIX of a BOOT.INI entry

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Fix Bootsector from SPARE

From main menu: Mode=NTFS -> Boot area fixes/updates -> Fix Bootsector from SPARE

Fix bootsector by replacing it by the the spare-one, when found at end


    This will create a new NTFS bootsector for the partition by replacing
    it with the spare-copy found at the end of the partition.

    This can be very useful when the bootsector got damaged by a virus
    or a crashing program (writing to sector 0) or if the partition was
    deleted by accident using FDISK or LVM and recreated again.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Fix Bootsector, using W7/8/10

From main menu: Mode=NTFS -> Boot area fixes/updates -> Fix Bootsector, using W7/8/10

Fix bootsector by creating a new one using Windows-7/8/10 template code


    This will create a new NTFS bootsector for the partition by replacing
    it with a newly created one, using template code from Windows-7

    This variant is for the 'BOOTMGR' style loader

    This can be very useful when the bootsector got damaged by a virus
    or a crashing program (writing to sector 0) or if the partition was
    deleted by accident using FDISK or LVM and recreated again.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Fix Bootsector, using NT/XP

From main menu: Mode=NTFS -> Boot area fixes/updates -> Fix Bootsector, using NT/XP

Fix bootsector by creating a new one using Windows-NT/XP template code


    This will create a new NTFS bootsector for the partition by replacing
    it with a newly created one, using template code from Windows-XP

    This variant is for the 'NTLDR' style loader

    This can be very useful when the bootsector got damaged by a virus
    or a crashing program (writing to sector 0) or if the partition was
    deleted by accident using FDISK or LVM and recreated again.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Wipe filesystem Bootsector

From main menu: Mode=NTFS -> Boot area fixes/updates -> Wipe filesystem Bootsector

Wipe the Bootsector, FIRST sector in a filesystem. Remove obsolete FS info


   This will wipe the bootsector (first sector) of the selected
   filesystem or partition.

   Can be useful to get rid of old formatting infomation
   that may confuse tools when trying to reformat.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Fix 1st NTLDR sector, NT/XP

From main menu: Mode=NTFS -> Boot area fixes/updates -> Fix 1st NTLDR sector, NT/XP

Fix first NTLDR sectory, directly after the bootsector, using a builtin copy


    This will write a builtin copy of the 1st NTLDR sector to the disk,
    making sure that sector is a 'known good' one.  This sector is taken
    from a US-English Windows-XP formatted NTFS partition, but is believed
    to be generic over many Windows (and language) versions.

    This can be very useful when that NTLDR sector got damaged somehow

    In case of problems, you can also use the NTLDR imaging functions,
    and use these to copy a complete NTLDR image from a known-good
    to a damaged one.

    The symptoms of a damaged NTLDR (sector) are a BLACK SCREEN quickly
    after booting, with a blinking text cursor in the upper left corner.
    One known cause of damage is the OS/2 LVM and/or BootManager, when
    used to install OS/2 (or eComStation) into a logical partition, while
    an NTFS partition (with Windows) is the FIRST PRIMARY partition.
    The exact circumstances under which this may occur are not known

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Fix 1st NTLDR sector, W7/8/10

From main menu: Mode=NTFS -> Boot area fixes/updates -> Fix 1st NTLDR sector, W7/8/10

Fix first NTLDR sectory, with Vista/Win7/Win8 'BOOTMGR' using a builtin copy


    This will write a builtin copy of the 1st NTLDR sector to the disk,
    making sure that sector is a 'known good' one.  This sector is taken
    from a Windows-Vista formatted NTFS partition with the 'BOOTMGR' code,
    but is known to be generic over many Windows (and language) versions.

    This can be very useful when that NTLDR sector got damaged somehow

    In case of problems, you can also use the NTLDR imaging functions,
    and use these to copy a complete NTLDR image from a known-good
    to a damaged one.

    The symptoms of a damaged NTLDR (sector) are a BLACK SCREEN quickly
    after booting, with a blinking text cursor in the upper left corner.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Create NTLDR imagefile

From main menu: Mode=NTFS -> Boot area fixes/updates -> Create NTLDR imagefile

Create compressed imagefile with the NTLDR sectors for this partition


    This will create a compressed imagefile with the 15 NTLDR sectors
    from the current NTFS partition, to be used later for a restore to
    a damaged system.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Restore NTLDR imagefile

From main menu: Mode=NTFS -> Boot area fixes/updates -> Restore NTLDR imagefile

Restore imagefile with a 'known good' NTLDR to current partition


    This will restore an imagefile with the 15 NTLDR sectors to the
    current NTFS partition, to recover from a 'BLACK SCREEN' hang
    situation on booting.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Display Windows BOOT.INI

From main menu: Mode=NTFS -> Boot area fixes/updates -> Display Windows BOOT.INI

Find (first) BOOT.INI, display the default line and partition-index to boot


    This will search for the first occurence of a 'BOOT.INI' file in
    the currently opened filesystem (FAT, FAT32 or NTFS).

    When found, some info of the file will be displayed, and the line
    containing the DEFAULT partition to be booted will be displayed
    including the 'partition(W)' partition index. It should look like:

        default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

    Below that line, the partition-index for the CURRENT partition
    as calculated by DFSee will be shown. From these two values you
    can see if the BOOT.INI default entry is correct for booting the
    Windows contained in the current selected partition (if any).

    Note that DFSee can only calculate the correct value when the
    filesystem was opened as a PARTITION, not as a volume ...

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Fix BOOT.INI partition index

From main menu: Mode=NTFS -> Boot area fixes/updates -> Fix BOOT.INI partition index

Find (first) BOOT.INI, update default partition-index to fix a boot failure


    This will prompt for a replacement value for the partition-index
    to be used in the 'default' boot line in the BOOT.INI file.

    Specify '*' or 'fix' to use the value calculated by DFSee,
    or fill in a numeric value if you want to try another one.

    Add a ' -2' after this value to force BOTH occurences in the
    BOOT.INI file to be updated at the same time. Updating just one
    might be safer, since the old value is still there too, but it
    will result in a the Windows BOOTMANAGER menu toi be displayed
    with these two (now different) partitions selected.
    The corrected one will be the 'default' line ...

    In some situations, it might be needed to try out a few values
    to find the one that will allow Windows to boot again ...

    It will then search for the first occurence of a 'BOOT.INI' file
    in the currently opened filesystem (FAT, FAT32 or NTFS).

    When found, some info of the file will be displayed, and the line
    containing the DEFAULT partition to be booted will be displayed
    including the 'partition(W)' partition index. It should look like:

        default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

    Below that line, the partition-index calculated by DFSee is shown.

    Incorrect values for the default partition-index will lead to
    boot failures with messages like:

        Invalid Boot.ini

    or

        Windows could not start because the following file
        is missing or corrupt: Windows\system32\Hal.dll

    The specified or calculated value will be substituted for the
    partition-index in the default line.

    Of course you need to reboot to test if this fix worked ...

    Note:
    Unless you specify the ' -2' option with the value,
    this is NOT a full 'REPAIR' of your BOOT.INI file!
    It is just the minimum update to allow booting Windows again!
    You must properly edit boot.ini once Windows is running again,
    or use 'bootcfg /rebuild' from the recovery-console that can
    be started from regular Windows installation CDs.

    When there is damage to the BOOT.INI file beyond an incorrect
    partition-index, fixing it this way might not be possible.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Fix HiddenSectors/Geo value

From main menu: Mode=NTFS -> Boot area fixes/updates -> Fix HiddenSectors/Geo value

Fix bootsector HiddenSectors and geometry fields to match partition tables


    This will update the 'hidden sectors' field in the bootsector
    to match the offset to the partition-table the partition is
    defined in and update the geometry Heads and Sectors field to
    match the current disk geometry.

    This could be REQUIRED for some operating systems like OS/2
    to accept and mount the partition as a driveletter!

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Set Volume Serial Number

From main menu: Mode=NTFS -> Boot area fixes/updates -> Set Volume Serial Number

Change the volume serial number, making this volume unique (after clone :-)


    This will update the 'volume serial number' in the bootsector

    This could be REQUIRED for some operating systems after cloning
    a filesystem, to make sure the volume serial numbers are unique.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Reset bad sectors

From main menu: Mode=NTFS -> Reset bad sectors

Reset the bad-sector administration to show ZERO bad-sectors or clusters


    This will check for bad-sectors being present in the
    filesystem and when present, reset to NO bad sectors.

     FAT:   Reset all 'BAD' values in the FAT to FREE
     EFAT:  Reset all 'BAD' values in the FAT to FREE
     NTFS:  Update $BadClus and $BitMap to reset bad-clusters
     HPFS:  Make the bad-sector-list in the spare-block empty

    This can be very useful after cloning or imaging a partition
    or disk that includes bad-sectors to a new replacement one.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   



Find Root directory

From main menu: Mode=NTFS -> Find Root directory

Find the MFT record for the root directory


    This will search for the MFT-record that belongs to the root
    directory for this NTFS filesystem, without using the explicit
    references in the bootsector.

    This can be useful if the bootsector got damaged.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   



Make THIS partition Active

From main menu: Mode=NTFS -> Make THIS partition Active

Make the currently selected PRIMARY the 'active' partition for MBR/BIOS boot


    This will make the currently selected PRIMARY partition the
    ACTIVE one for the disk.

    There should only be a single active partition on every disk.
    When the system starts, the BIOS will usually boot from
    the ACTIVE partition on the first disk.

    In IBM BMGR/LVM terms the active partition is called STARTABLE.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Delete THIS partition

From main menu: Mode=NTFS -> Delete THIS partition

Delete the currently selected partition from the partition tables


    This will delete the partition that is currently selected to be
    deleted from the partition-tables. This will result in the space
    occupied by the partition becoming FREESPACE that can be used
    again to create new partitions.

    For primary partitions on LVM-systems, the related LVM-information
    is cleared as well, to avoid consistency problems later when a new
    partition is created at the same position.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Set FS status Normal

From main menu: Mode=NTFS -> Set FS status Normal

Update $Volume special file flags to indicate filesystem is in NORMAL state


    This will update the fileystem-status field in the NTFS $Volume file
    to indicate that filesystem is in a NORMAL state, no CHKDSK required

    This can be useful to avoid an automatic CHKDSK after that flag has
    been set by a utility (such as DFSee) or by a 'CHKDSK C: /f' or the
    corresponding context-menu item for the system volume.

    It CANCELS the scheduled CHKDSK that would be done on the next boot.

    Note: The filesystem itself is NOT cleaned in any way, it is just the
          statusflag in the $Volume special file that is modified.

    The clean versus dirty state of the filesystem itself is kept in the
    $Logfile special file (journal log) and can not be modified by DFSee
    It IS displayed when opening an NTFS partition, or whenever the
    DIRTY command is used.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Set FS status Dirty

From main menu: Mode=NTFS -> Set FS status Dirty

Update $Volume special file flags to indicate filesystem needs CHKDSK to run


    This will update the fileystem-status field in the NTFS $Volume file
    to indicate that filesystem is DIRTY.

    This will force a 'CHKDSK /f' on the next boot of Windows

    Note: The filesystem itself is NOT affected in any other way, it is
    just the 'CHKDSK required' statusflag that is modified.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   



Display an MFT record

From main menu: Mode=NTFS -> Display an MFT record

Display MFT record for specified MFT-index or a selected special file $xxx


    Submenu offering display for the NTFS special files, or
    any other MFT record when specified by number

    It will display information for the file or directory referenced
    by the MFT-record selected from this menu and/or dialog.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Specified MFT number ...

From main menu: Mode=NTFS -> Display an MFT record -> Specified MFT number ...

Display any MFT record, by specifying the MFT-index (record number)


    This will display information for the file or directory referenced
    by the MFT-record specified.

    This includes filenames, flags, date and time as well as security
    information and allocation details.

    Note: The MFT-record has to be identified by its (hexadecimal)
          MFT number, as found in directory details or 'well-known'
          ones like 05 for the root-directory.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



0 - $MFT, Master File Table

From main menu: Mode=NTFS -> Display an MFT record -> 0 - $MFT, Master File Table

$MFT special file, Master File Table itself, full allocation


   $MFT     special file, Master File Table itself, full allocation

   Everything on an NTFS volume is a file, and each of those files
   is described by its own MFT-record in the Master File table.

   An MFT record holds references to all attributes for the file,
   where attributes can be 'resident' in the same MFT-record, can
   be 'external' in an allocated area of clusters (run-list)
   or even can be described in a secondary MFT-record.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


1 - $MFTMirr, Backup table

From main menu: Mode=NTFS -> Display an MFT record -> 1 - $MFTMirr, Backup table

$MFTMirr special file, Master File Table, duplicate, first 4 records only


   $MFTMirr special file, Master File Table, duplicate, first 4 records

   This is just for emergency use when the MFT-record for the MFT itself
   and for the logfile are damaged, only FOUR records are duplicated.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


2 - $LogFile, Journal file

From main menu: Mode=NTFS -> Display an MFT record -> 2 - $LogFile, Journal file

$LogFile special file, the NTFS transaction log, used in CHKDSK recovery


   $LogFile special file, the NTFS transaction log, used in CHKDSK

   This is the transaction log, where all pending changes for the
   filesystem structures are kept. This allows very quick recovery
   of the filesystem to a known good state after a crash.

      Note: User data is NOT kept in the logfile, so after a crash
            there CAN be damage to 'open (user) files'. It is just the
            filesystem structures that are kept safe using this log!

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


3 - $Volume, Volume info

From main menu: Mode=NTFS -> Display an MFT record -> 3 - $Volume, Volume info

$Volume special file, holds the volume LABEL and NTFS version information


   $Volume  special file, holds the volume LABEL and NTFS version info

   The label, as set/displayed by the 'LABEL' command is kept here,
   as well as volume creation timestamps and the version of the
   NTFS filesystem driver that created or updated it:

        1.2  Original Windows NT, sometimes called NTFS 4
        3.0  Introduced with W2K, sometimes called NTFS 5
        3.1  Introduced with  XP, sometimes called NTFS 5.1

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


4 - $AttrDef, Attributes

From main menu: Mode=NTFS -> Display an MFT record -> 4 - $AttrDef, Attributes

$AttrDef special file, holds a list of supported attributes for the volume


   $AttrDef special file, holds a list of supported attributes for volume

   This defines the allowed attributes on the volume, with the
   properties for that specific attribute like sorting rules,
   minimum and maximum size, and whether the attribute can be
   an external one or not.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



5 - \ Root directory

From main menu: Mode=NTFS -> Display an MFT record -> 5 - \ Root directory

RootDir, main index to the volumes regular files and directories


   RootDir, main index to the volumes regular files and directories

   As a matter of course, this is the starting point for all
   regular diroctory and file-access to the volume. It holds
   an index with filenames as present in the root directory.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



6 - $Bitmap, Allocation map

From main menu: Mode=NTFS -> Display an MFT record -> 6 - $Bitmap, Allocation map

$Bitmap special file, cluster-level allocation information; used/un-used


   $Bitmap  special file, cluster-level allocation information

   This is a simple binary file with one bit for every cluster
   in the volume, that will be '1' for a cluster that is in-use
   and '0' for unused clusters.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


7 - $Boot, Boot + NTLDR

From main menu: Mode=NTFS -> Display an MFT record -> 7 - $Boot, Boot + NTLDR

$Boot special file, Boot sector plus 1st stage of the NTLDR (15 sectors)


   $Boot    special file, Boot sector plus 1st stage of the NTLDR

   This maps the standard boot-sector plus the 15-sector area
   directly after that, containing the NTFS micro-FSD 'NTLDR'.
   This NTLDR is the FIRST stage of loading Windows, and will
   locate and execute the regular file 'NTLDR' that may be
   located anywhere in the same filesystem.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


8 - $BadClus Bad clusters

From main menu: Mode=NTFS -> Display an MFT record -> 8 - $BadClus Bad clusters

$BadClus special file, Bad Cluster list using SPARSE file, non-sparse == BAD


   $BadClus special file, Bad Cluster list using a SPARSE file

   This is a SPARSE file, that normally just has a single extent
   representing the whole volume, and is not-allocated (-sparse-).
   When bad-clusters are detected, they are added to this file
   as allocated areas. Every allocated area is 'BAD' and since it
   is now allocated to this special file, it will not be used ...

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


9 - $Secure Security info

From main menu: Mode=NTFS -> Display an MFT record -> 9 - $Secure Security info

$Secure special file, index to centralized security info for the volume


   $Secure  special file, index to centralized security info for volume

   This is a collection of security information for the volume, which
   is indexed by a security-index kept in the 'standard' attribute for
   every file.
   It replaces the 'security-descriptor' attribute that was used in the
   older NTFS versions (NT, NTFS 1.2 and older) for efficiency reasons.
   Note that in an NTFS 1.2, MFT record '9' is used by '$Quota' ...

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


a - $UpCase Collating/Sort

From main menu: Mode=NTFS -> Display an MFT record -> a - $UpCase Collating/Sort

$UpCase special file, table of uppercase characters used for collating/sort


   $UpCase  special file, table of uppercase characters used for collating

   This is a mapping for each character in the UNICODE alphabet that
   defines how it should be uppercased (collated). This is used insorting and comparing filenames since NTFS is case-preserving but
   defined as case-insensitive for sort and compare ...

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


b - $Extend NTFS 3.0 extras

From main menu: Mode=NTFS -> Display an MFT record -> b - $Extend NTFS 3.0 extras

$Extend special file, index to more special files: $ObjId, $Quota, $Reparse


   $Extend  special file, index to more special files (open ended)

   This is a regular directory, listing any special files not in the
   fixed set, it is used for the added files in NTFS 3.0 and later:

     $ObjId   = index of all the $OBJECT_ID Attributes on the volume.

       Every MFT Record is assigned a unique GUID (starting with W2K).
       Additionally, a record may have a Birth Volume Id, a Birth    ObjectId and a Domain Id, all of which are GUIDs.

     $Quota   = special file storing information about file quotas

       In W2K and later this file keeps track of quotas (disk usage).
       This is administred PER USER en per volume

     $Reparse = special file storing information on reparse points.

       A reparse point is like an equivalent of a UNIX symbolic-link.
       It 'mounts' a file/directory, a network share or other volume
       somewhere in an existing directory structure.

     $UsnJrnl = user readable variant of the transaction/recovery log.

       It does not seem to be used very often, not seen one yet :-)

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Dump MFT records to file

From main menu: Mode=NTFS -> Dump MFT records to file

Dump the system MFT records to an imagefile for later analysis by support


    This will create a binary dump for the first 25 MFT records,
    quite useful for later analysis, perhaps by DFSee support.

    The usual IMAGE dialog will be presented, with the startsector
    and size filled in, as well as a suggested filename.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   



Analyse NTFS filesystem

From main menu: Mode=NTFS -> Analyse NTFS filesystem

Check filesystem for inconsistencies and errors (Readonly, no fixing!)


    This will perform a CHECK of the filesystem, somewhat like the
    well-known CHKDSK but without automatically fixing anything.

    The result of the check is a sector-lookup-table (SLT) that contains
    information about all recognized filesystem areas that are in use.

    Any error recognized will be flagged in the default display of
    this SLT that is performed automatically by the CHECK command.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Identify sectors (SLT)

From main menu: Mode=NTFS -> Identify sectors (SLT)

Create Sector Lookup Table (SLT) if needed, display as table or sector info


    This submenu allows you to build and inspect a 'Sector lookup Table'
    or SLT, that collects some info about each identifiable sector range
    in the currently selected filesystem.

    The SLT is the basis required to identify specific sectors, showing
    to what file or FS-metadata it belongs, and for the CHECK command.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   


Show object layout (SLT)

From main menu: Mode=NTFS -> Identify sectors (SLT) -> Show object layout (SLT)

Show layout of current object by displaying parts of the Sector Lookup Table


    This will display part of the sector-lookup-table (SLT)

    You wil be presented with an option dialog first, where you
    specify the desired format and part of the SLT to be displayed.

    The SLT will be built automatically if not done yet, and it will
    have been built by any previous CHECK command too.

    Building the SLT will take place in the background while the
    dialog can be used freely to specify any options for displaying.
    After the dialog has been ended, and the SLT is ready, it will
    be displayed as requested.

    Typically the SLT will contain at least one entry for every file
    on the filesystem, so there could be hundreds of thousands lines!

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Identify specific sector

From main menu: Mode=NTFS -> Identify sectors (SLT) -> Identify specific sector

Show identification for specified (or current) sector, using the SLT


    This will display information about the specified sector that is
    available in the sector lookup table (SLT)

    The most useful info is the sector referencing this sector, this
    often leads to showing to which file/directory the sector belongs.

    The SLT will be generated automatically if not yet available

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    


Identify Last used sector

From main menu: Mode=NTFS -> Identify sectors (SLT) -> Identify Last used sector

Show identification for the last sector used, dictating the minimum FS size


    This will display information about the sector that is the last
    one being used (allocated) in the filesystem, and because of that
    dictates the MINIMUM size for the filesystem for a RESIZE.

    The most useful info is the sector referencing this sector, this
    often leads to showing to which file/directory the sector belongs.

    The SLT will be generated automatically if not yet available,
    just as the required allocation information (alloc).

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

    



Reselect whole disk, FDISK

From main menu: Mode=NTFS -> Reselect whole disk, FDISK

Unselect filesystem, reselect the same/first disk; enables Mode=FDISK menu

Menu item screenshot(s)


    This will UNSELECT the current object/filesystem, and reselect a
    whole physical disk, either the same disk as the partition was on,
    or the first disk present in other cases.

    This is a quick way to change to 'Mode=FDISK' and work on
    disk-level issues

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Press <F1> again for more help; Some options may require switching to 'Expert mode'

   



PHP and HTML created by : TX-library 5.03 2017-10-09 (c) 1995-2017: Fsys Software
For application : DFSee OS/2 14.8 2017-11-09; (c) 1994-2017: Jan van Wijk with button/indicator: Expert

Download the complete menu-documentation as static HTML (24 Mb ZIP)

(to DFSee main page)  |  File  |  Edit  |  Actions  |  Image  |  Display  |  Scripts  |  Help  |  (to BASIC menu)
Mode=FDISK  |  AUX  |  DUMPFS  |  EXTn  |  FAT  |  EFAT  |  HFS+  |  HPFS  |  JFS  |  NTFS  |  REISER  |  SWAP  |  XFS
(Mode=NTFS page) DFSee menu documentation for pulldown : Mode=NTFS
Views: 387853 Viewable with Any Browser Created by Jan van Wijk:   Aug 2007, last update:   11-Sep-2017 Valid HTML 4.01 Transitional