|
| (Documentation for the Mode=NTFS menu) |
|
|
|
|
| DFSee main page | File | Edit | Actions | Display | Help |
| Mode=FDISK | AUX | EXT2+3 | FAT | HFS+ | HPFS | JFS | NTFS | REISER | XFS | SWAP |
Display a pseudo-graphical map of used versus free sectors in the filesystem
Display a usage map for the currently selected disk or filesystem
A pseudo-graphical map of the disk or partition allocation is
displayed, showing the distribution of data over the object
This is also an indication for the amount of unused sectors in
the object, that are beneficial to 'SMART-SECTOR' optimizations
in imaging and cloning operations.
The percentage of used sectors are displayed as a percentage at
the end of the line, and a total usage percentage and size is
shown just after the map itself.
For filesystems that support resizing, the limits for resizing
are shown after the map itself.
Submenu to search for deleted/normal files, list and possibly recover them
This submenu offers selections to search for normal or deleted
files, display the resulting lists and possibly recover files.
Search MFT records for deleted files, 'Recover from list' will UNDELETE them
This will search the whole partition for MFT-records of DELETED
files that match the partial filename (wildcard) specified.
The sectornumbers of the found MFT-records will be added to the DFSee
sectorlist so can be used in later actions, or be exported to a file.
The files contained in that list can be RECOVERED to any directory
on the system, including a network, by using the 'RECOVER' command.
Search MFT records for deleted or non-deleted files, for 'Recover from list'
This will search the whole partition for MFT-records of non-deleted
or deleted files that match the partial filename (wildcard) specified.
The sectornumbers of the found MFT-records will be added to the DFSee
sectorlist so can be used in later actions, or be exported to a file.
The files contained in that list can be RECOVERED to any directory
on the system, including a network, by using the 'RECOVER' command.
Search MFT area for records for non-deleted files, for 'Recover from list'
This will search the whole partition for MFT-records of non-deleted
regular files that match the partial filename (wildcard) specified.
The sectornumbers of the found MFT-records will be added to the DFSee
sectorlist so can be used in later actions, or be exported to a file.
The files contained in that list can be RECOVERED to any directory
on the system, including a network, by using the 'RECOVER' command.
Display (selected) files from the list, using a PATH+FILENAME wildcard
This will display the DFSee sector-list in a compact format, suited
to the data contained in the list
This usually is a 'list -f' or a 'list -s' variant.
Recover (selected) files from the list to a supplied recovery directory
This will allow you to recover (copy) one or more of the files in the
list to any local or network directory on your system.
It will prompt for a destination directory first, using the last used
one as a default. All files recovered in one go, will be recovered to
this same directory, with their original path appended to retain the
directory structure whenever possible.
It will also prompt for a selection specification in the form of a
full PATH+FILENAME wildcard and an optional allocation-percentage.
As an example, the specification:
'*mydoc*\*project_x*.doc%100'
will recover all files that have 'mydoc' somewhere in the PATH,
'project_x' in the filename and have an extension of '.doc' that
seem to be 100% recoverable. (100% allocation-OK ranking).
Recover the file associated with the CURRENT sector to a recovery directory
This will allow you to recover (copy) the file represented by the
CURRENT displayed sector, also called the 'THIS' sector to any local
or network directory on your system.
It will prompt for a destination directory first, using the last used
one as a default. The file will be recovered with its original path
appended to that to retain the directory structure whenever possible.
The menu item will only be enabled (selectable) when the CURRENT sector
represents a normal or deleted FILE for the filesystem involved.
This means it has to be a type 'f' or 'z' sector, which is:
For HPFS: an FNODE sector
For JFS: an INODE sector
For NTFS: an MFT record
Fix bootsector, HiddenSectors/GEO, BOOT.INI and NTLDR imaging and fixing
This submenu offers selections for fixes related to booting like
fix the bootsector itself, NTLDR image creation and restore,
fixing the HiddenSectors and geometry fields in the bootsector
plus BOOT.INI display and FIX of a BOOT.INI entry
Fix bootsector by replacing it by the the spare-one, or creating a new one
This will create a new NTFS bootsector for the partition by replacing
it with the spare-copy found at the end of the partition.
This can be very useful when the bootsector got damaged by a virus
or a crashing program (writing to sector 0) or if the partition was
deleted by accident using FDISK or LVM and recreated again.
Fix first NTLDR sectory, directly after the bootsector, using a builtin copy
This will write a builtin copy of the 1st NTLDR sector to the disk,
making sure that sector is a 'known good' one. This sector is taken
from a US-English Windows-XP formatted NTFS partition, but is believed
to be generic over many Windows (and language) versions.
This can be very useful when that NTLDR sector got damaged somehow
In case of problems, you can also use the NTLDR imaging functions,
and use these to copy a complete NTLDR image from a known-good
to a damaged one.
The symptoms of a damaged NTLDR (sector) are a BLACK SCREEN quickly
after booting, with a blinking text cursor in the upper left corner.
One known cause of damage is the OS/2 LVM and/or BootManager, when
used to install OS/2 (or eComStation) into a logical partition, while
an NTFS partition (with Windows) is the FIRST PRIMARY partition.
The exact circumstances under which this may occur are not known
Fix first NTLDR sectory, with the Vista 'BOOTMGR' code, using a builtin copy
This will write a builtin copy of the 1st NTLDR sector to the disk,
making sure that sector is a 'known good' one. This sector is taken
from a Windows-Vista formatted NTFS partition with the 'BOOTMGR' code,
but is known to be generic over many Windows (and language) versions.
This can be very useful when that NTLDR sector got damaged somehow
In case of problems, you can also use the NTLDR imaging functions,
and use these to copy a complete NTLDR image from a known-good
to a damaged one.
The symptoms of a damaged NTLDR (sector) are a BLACK SCREEN quickly
after booting, with a blinking text cursor in the upper left corner.
Create compressed imagefile with the NTLDR sectors for this partition
This will create a compressed imagefile with the 15 NTLDR sectors
from the current NTFS partition, to be used later for a restore to
a damaged system.
Restore imagefile with a 'known good' NTLDR to current partition
This will restore an imagefile with the 15 NTLDR sectors to the
current NTFS partition, to recover from a 'BLACK SCREEN' hang
situation on booting.
Find (first) BOOT.INI, display the default line and partition-index to boot
This will search for the first occurence of a 'BOOT.INI' file in
the currently opened filesystem (FAT, FAT32 or NTFS).
When found, some info of the file will be displayed, and the line
containing the DEFAULT partition to be booted will be displayed
including the 'partition(W)' partition index. It should look like:
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
Below that line, the partition-index for the CURRENT partition
as calculated by DFSee will be shown. From these two values you
can see if the BOOT.INI default entry is correct for booting the
Windows contained in the current selected partition (if any).
Note that DFSee can only calculate the correct value when the
filesystem was opened as a PARTITION, not as a volume ...
Find (first) BOOT.INI, update default partition-index to fix a boot failure
This will prompt for a replacement value for the partition-index
to be used in the 'default' boot line in the BOOT.INI file.
Specify '*' or 'fix' to use the value calculated by DFSee,
or fill in a numeric value if you want to try another one.
Add a ' -2' after this value to force BOTH occurences in the
BOOT.INI file to be updated at the same time. Updating just one
might be safer, since the old value is still there too, but it
will result in a the Windows BOOTMANAGER menu toi be displayed
with these two (now different) partitions selected.
The corrected one will be the 'default' line ...
In some situations, it might be needed to try out a few values
to find the one that will allow Windows to boot again ...
It will then search for the first occurence of a 'BOOT.INI' file
in the currently opened filesystem (FAT, FAT32 or NTFS).
When found, some info of the file will be displayed, and the line
containing the DEFAULT partition to be booted will be displayed
including the 'partition(W)' partition index. It should look like:
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
Below that line, the partition-index calculated by DFSee is shown.
Incorrect values for the default partition-index will lead to
boot failures with messages like:
Invalid Boot.ini
or
Windows could not start because the following file
is missing or corrupt: Windows\system32\Hal.dll
The specified or calculated value will be substituted for the
partition-index in the default line.
Of course you need to reboot to test if this fix worked ...
Note:
Unless you specify the ' -2' option with the value,
this is NOT a full 'REPAIR' of your BOOT.INI file!
It is just the minimum update to allow booting Windows again!
You must properly edit boot.ini once Windows is running again,
or use 'bootcfg /rebuild' from the recovery-console that can
be started from regular Windows installation CDs.
When there is damage to the BOOT.INI file beyond an incorrect
partition-index, fixing it this way might not be possible.
Fix bootsector HiddenSectors and geometry fields to match partition tables
This will update the 'hidden sectors' field in the bootsector
to match the offset to the partition-table the partition is
defined in and update the geometry Heads and Sectors field to
match the current disk geometry.
This could be REQUIRED for some operating systems like OS/2
to accept and mount the partition as a driveletter!
Change the volume serial number, making this volume unique (after clone :-)
This will update the 'volume serial number' in the bootsector
This could be REQUIRED for some operating systems after cloning
a filesystem, to make sure the volume serial numbers are unique.
Reset the bad-sector administration to show ZERO bad-sectors or clusters
This will check for bad-sectors being present in the
filesystem and when present, reset to NO bad sectors.
FAT: Reset all 'BAD' values in the FAT to FREE
NTFS: Update $BadClus and $BitMap to reset bad-clusters
HPFS: Make the bad-sector-list in the spare-block empty
This can be very useful after cloning or imaging a partition
or disk that includes bad-sectors to a new replacement one.
Find detailed info (FNODE/MFT-record) for the specified file/directory path
This uses the specified path from the root-directory to locate
detailed information for the file or directory for that path.
This will be from the FNODE on HPFS, the MFT-record on NTFS or
similar structures like Inodes on other filesystrems.
The path and filename may contain spaces.
When found the information will be displayed in the standard
format as defined for the filesystem that is active.
You can display related information like the directory entry
or the actual file data from there using the U and D commands.
Find the MFT record for the root directory
This will search for the MFT-record that belongs to the root
directory for this NTFS filesystem, without using the explicit
references in the bootsector.
This can be useful if the bootsector got damaged.
Make the currently selected PRIMARY the 'active' partition for MBR/BIOS boot
This will make the currently selected PRIMARY partition the
ACTIVE one for the disk.
There should only be a single active partition on every disk.
When the system starts, the BIOS will usually boot from
the ACTIVE partition on the first disk.
In IBM BMGR/LVM terms the active partition is called STARTABLE.
Delete the currently selected partition from the partition tables
This will delete the partition that is currently selected to be
deleted from the partition-tables. This will result in the space
occupied by the partition becoming FREESPACE that can be used
again to create new partitions.
For primary partitions on LVM-systems, the related LVM-information
is cleared as well, to avoid consistency problems later when a new
partition is created at the same position.
Update $Volume special file flags to indicate filesystem is in NORMAL state
This will update the fileystem-status field in the NTFS $Volume file
to indicate that filesystem is in a NORMAL state, no CHKDSK required
This can be useful to avoid an automatic CHKDSK after that flag has
been set by a utility (such as DFSee) or by a 'CHKDSK C: /f' or the
corresponding context-menu item for the system volume.
It CANCELS the scheduled CHKDSK that would be done on the next boot.
Note: The filesystem itself is NOT cleaned in any way, it is just the
statusflag in the $Volume special file that is modified.
The clean versus dirty state of the filesystem itself is kept in the
$Logfile special file (journal log) and can not be modified by DFSee
It IS displayed when opening an NTFS partition, or whenever the
DIRTY command is used.
Update $Volume special file flags to indicate filesystem needs CHKDSK to run
This will update the fileystem-status field in the NTFS $Volume file
to indicate that filesystem is DIRTY.
This will force a 'CHKDSK /f' on the next boot of Windows
Note: The filesystem itself is NOT affected in any other way, it is
just the 'CHKDSK required' statusflag that is modified.
Display MFT record for specified MFT-index or a selected special file $xxx
Submenu offering display for the NTFS special files, or
any other MFT record when specified by number
It will display information for the file or directory referenced
by the MFT-record selected from this menu and/or dialog.
Display any MFT record, by specifying the MFT-index (record number)
This will display information for the file or directory referenced
by the MFT-record specified.
This includes filenames, flags, date and time as well as security
information and allocation details.
Note: The MFT-record has to be identified by its (hexadecimal)
MFT number, as found in directory details or 'well-known'
ones like 05 for the root-directory.
$MFT special file, Master File Table itself, full allocation
$MFT special file, Master File Table itself, full allocation
Everything on an NTFS volume is a file, and each of those files
is described by its own MFT-record in the Master File table.
An MFT record holds references to all attributes for the file,
where attributes can be 'resident' in the same MFT-record, can
be 'external' in an allocated area of clusters (run-list)
or even can be described in a secondary MFT-record.
$MFTMirr special file, Master File Table, duplicate, first 4 records only
$MFTMirr special file, Master File Table, duplicate, first 4 records
This is just for emergency use when the MFT-record for the MFT itself
and for the logfile are damaged, only FOUR records are duplicated.
$LogFile special file, the NTFS transaction log, used in CHKDSK recovery
$LogFile special file, the NTFS transaction log, used in CHKDSK
This is the transaction log, where all pending changes for the
filesystem structures are kept. This allows very quick recovery
of the filesystem to a known good state after a crash.
Note: User data is NOT kept in the logfile, so after a crash
there CAN be damage to 'open (user) files'. It is just the
filesystem structures that are kept safe using this log!
$Volume special file, holds the volume LABEL and NTFS version information
$Volume special file, holds the volume LABEL and NTFS version info
The label, as set/displayed by the 'LABEL' command is kept here,
as well as volume creation timestamps and the version of the
NTFS filesystem driver that created or updated it:
1.2 Original Windows NT, sometimes called NTFS 4
3.0 Introduced with W2K, sometimes called NTFS 5
3.1 Introduced with XP, sometimes called NTFS 5.1
$AttrDef special file, holds a list of supported attributes for the volume
$AttrDef special file, holds a list of supported attributes for volume
This defines the allowed attributes on the volume, with the
properties for that specific attribute like sorting rules,
minimum and maximum size, and whether the attribute can be
an external one or not.
RootDir, main index to the volumes regular files and directories
RootDir, main index to the volumes regular files and directories
As a matter of course, this is the starting point for all
regular diroctory and file-access to the volume. It holds
an index with filenames as present in the root directory.
$Bitmap special file, cluster-level allocation information; used/un-used
$Bitmap special file, cluster-level allocation information
This is a simple binary file with one bit for every cluster
in the volume, that will be '1' for a cluster that is in-use
and '0' for unused clusters.
$Boot special file, Boot sector plus 1st stage of the NTLDR (15 sectors)
$Boot special file, Boot sector plus 1st stage of the NTLDR
This maps the standard boot-sector plus the 15-sector area
directly after that, containing the NTFS micro-FSD 'NTLDR'.
This NTLDR is the FIRST stage of loading Windows, and will
locate and execute the regular file 'NTLDR' that may be
located anywhere in the same filesystem.
$BadClus special file, Bad Cluster list using SPARSE file, non-sparse == BAD
$BadClus special file, Bad Cluster list using a SPARSE file
This is a SPARSE file, that normally just has a single extent
representing the whole volume, and is not-allocated (-sparse-).
When bad-clusters are detected, they are added to this file
as allocated areas. Every allocated area is 'BAD' and since it
is now allocated to this special file, it will not be used ...
$Secure special file, index to centralized security info for the volume
$Secure special file, index to centralized security info for volume
This is a collection of security information for the volume, which
is indexed by a security-index kept in the 'standard' attribute for
every file.
It replaces the 'security-descriptor' attribute that was used in the
older NTFS versions (NT, NTFS 1.2 and older) for efficiency reasons.
Note that in an NTFS 1.2, MFT record '9' is used by '$Quota' ...
$UpCase special file, table of uppercase characters used for collating/sort
$UpCase special file, table of uppercase characters used for collating
This is a mapping for each character in the UNICODE alphabet that
defines how it should be uppercased (collated). This is used insorting and comparing filenames since NTFS is case-preserving but
defined as case-insensitive for sort and compare ...
$Extend special file, index to more special files: $ObjId, $Quota, $Reparse
$Extend special file, index to more special files (open ended)
This is a regular directory, listing any special files not in the
fixed set, it is used for the added files in NTFS 3.0 and later:
$ObjId = index of all the $OBJECT_ID Attributes on the volume.
Every MFT Record is assigned a unique GUID (starting with W2K).
Additionally, a record may have a Birth Volume Id, a Birth ObjectId and a Domain Id, all of which are GUIDs.
$Quota = special file storing information about file quotas
In W2K and later this file keeps track of quotas (disk usage).
This is administred PER USER en per volume
$Reparse = special file storing information on reparse points.
A reparse point is like an equivalent of a UNIX symbolic-link.
It 'mounts' a file/directory, a network share or other volume
somewhere in an existing directory structure.
$UsnJrnl = user readable variant of the transaction/recovery log.
It does not seem to be used very often, not seen one yet :-)
Dump the system MFT records to an imagefile for later analysis (support :-)
This will create a binary dump for the first 25 MFT records,
quite useful for later analysis, perhaps by DFSee support.
The usual IMAGE dialog will be presented, with the startsector
and size filled in, as well as a suggested filename.
Check filesystem for inconsistencies and errors (Readonly, no fixing!)
This will perform a CHECK of the filesystem, somewhat like the
well-known CHKDSK but without automatically fixing anything.
The result of the check is a sector-lookup-table (SLT) that contains
information about all recognized filesystem areas that are in use.
Any error recognized will be flagged in the default display of
this SLT that is performed automatically by the CHECK command.
Create Sector Lookup Table (SLT) if needed, display as table or sector info
This submenu contains all menu-items related to OPENING an object
to analyse, fix or otherwise work with using other DFSee commands
and menu selections. The opened object will be the CURRENT one.
Show layout of current object by displaying parts of the Sector Lookup Table
This will display part of the sector-lookup-table (SLT)
You wil be presented with an option dialog first, where you
specify the desired format and part of the SLT to be displayed.
The SLT will be built automatically if not done yet, and it will
have been built by any previous CHECK command too.
Building the SLT will take place in the background while the
dialog can be used freely to specify any options for displaying.
After the dialog has been ended, and the SLT is ready, it will
be displayed as requested.
Typically the SLT will contain at least one entry for every file
on the filesystem, so there could be hundreds of thousands lines!
Show identification for specified (or current) sector, using the SLT
This will display information about the specified sector that is
available in the sector lookup table (SLT)
The most useful info is the sector referencing this sector, this
often leads to showing to which file/directory the sector belongs.
The SLT will be generated automatically if not yet available
Show identification for the last sector used, dictating the minimum FS size
This will display information about the sector that is the last
one being used (allocated) in the filesystem, and because of that
dictates the MINIMUM size for the filesystem for a RESIZE.
The most useful info is the sector referencing this sector, this
often leads to showing to which file/directory the sector belongs.
The SLT will be generated automatically if not yet available,
just as the required allocation information (alloc).
Unselect filesystem, reselect the same/first disk; enables Mode=FDISK menu
This will UNSELECT the current object/filesystem, and reselect a
whole physical disk, either the same disk as the partition was on,
or the first disk present in other cases.
This is a quick way to change to 'Mode=FDISK' and work on
disk-level issues
Download the complete menu-documentation as static HTML (15 Mb ZIP)
| DFSee main page | File | Edit | Actions | Display | Help |
| Mode=FDISK | AUX | EXT2+3 | FAT | HFS+ | HPFS | JFS | NTFS | REISER | XFS | SWAP |
| (Mode=NTFS page) | DFSee menu documentation for pulldown : Mode=NTFS |
| Views: 218578 |
|
Created by Jan van Wijk: Aug 2007, last update: 04-Oct-2007 |
|