DFSee is intended for system administrators, data-recovery and forensic experts, and power-users!
It IS NOT a tool for beginners or the inexperienced.
DFSee was created with recovery and analysis in mind and takes safe approaches to all operations,
but the power of the program may lead to unexpected and undesirable results, including data-loss,
in the hands of inexperienced users.
DFSee should only be used if you know what you are doing or if you
are being instructed and closely supervised by someone who does.
FEATURE highlights
MBR and GPT disk partitioning
As a replacement for the classic FDISK, OS2-LVM and (Linux) Gparted programs,
with support for MBR as well as GPT style tables.
It is operated using (possibly scripted) commands or specific editors
working on MBR or GPT partition tables (PTEdit) or OS/2 LVM tables.
Disk and partition recovery
To recover from partition problems and disasters
(UNFDISK )
either by restoring a previously backup from just the partitioning-info,
or by using the DFSFAST/DFSDISK disk analysis procedures to allow
an expert (like DFSee support) to create a recovery script.
Disk and partition copying
| IMAGING |
Whole disks, partitions or parts of partition can be saved to
an imagefile, in RAW or a compressed format (IMZ).
The imagefiles can be restored to the same or a different location
resulting in backup or copy functionality.
Compressed images can be opened for directory/file browsing, to view or to
retrieve individual files from such a backup image (selective restore).
|
| CLONING |
Cloning can make an exact copy of (part of) a partition or disk to
another area on the same or another disk. This can be used as a
very fast backup facility and to create a work-copies for forensic analysis.
|
For forensic use, the SMART option can be disabled, to make sure
the image/clone retains ALL the information of the original, including
the unused disk sectors/blocks.
Filesystem BROWSE and FILE RECOVERY
A directory and file BROWSER, much like a filemanager, and
an easy to use and powerful way to access files in filesystems
that may otherwise be inaccesible, either because there is some filesystem
damage that prevents it from being 'mounted' in the normal way, because
you need to access it from an operating system that does NOT have a driver
for this type of filesystem, or because it is inside an imagefile.
Once in the browser, you can navigate through the directory structure
and edit/view/copy one or more of the presented files.
Copying files from the browser is a user-friendly way to RECOVER FILES from inaccessible filesystems,
and as a form of selective RESTORE from an image backup.
Forensic disk and filesystem analysis
DFSee has dedicated display and analysis functions for the supported filesystems.
This includes boot-sectors, superblocks and low-level directory structures.
Binary/HEX viewer/editor
DFSee includes a powerful binary (or rather HEX) display and edit tool, including an x86 disasssembler
and an ASCII viewer. Works directly on disk/partition sectors or on (binary) files.
Recognized FILESYSTEMS
DFSee has built-in drivers for many filesystems, so it does NOT depend
on the operating system to access them, it only needs RAW access to the disks.
A modular approach is used where each filesystem recognized, implements
a specific mode of operation with FS-specific commands and structures.
On selecting a data-source (disk, partition, volume, image) DFSee will
try to recognize the involved filesystem and activate the support
for it automatically.
The currently available modes/filesystems are:
| FDISK | For partitioning work, default active at startup |
| APFS | Apple filesystem, used on iOS and later macOS |
| AUX | Auxilary mode for unrecognized data |
| EFAT | Enhanced FAT filesystem for huge files and media |
| EXT2/3/4 | Native filesystem on Linux, EXT3/4 are journaled |
| DUMPFS | Large-disk (crash) DUMP partition for OS/2 |
| FAT | Classic PC filesystems including FAT32 and VFAT |
| HFS | The journaled filesystem HFS+ for (older) macOS |
| HPFS | Native filesystem on OS/2, eComStation, ArcaOS |
| ISO | ISO9660 FS as used on CDROM/DVD and ISO images |
| JFS | Journaled filesystem on OS/2, eCS or ArcaOS |
| NTFS | Native filesystem on Windows-XP and later |
| REISER * | Journaled filesystem on Linux by Hans Reiser |
| SWAP * | Dedicated Linux SWAP partition |
| XFS * | The 'X' terabyte journaled filesystem on Linux |
The filesystems marked with '*' have partial support (no browse/file-recovery).
More fileystems will be added over time.
Filesystems can be accessed either on real hardware, or in several variations of imagefiles
like RAW, DFSee IMZ and VirtualBox VDI.
Supported Operating Systems
| DOS | A 32-bit DOS program, runs on most DOS versions, including FreeDOS |
| Linux | Generic Lunix 32-bit program running in X-terminals as well as the console |
| macOS | Apple macOS, as a 64-bit program running in the Terminal or iTerm |
| OS/2 | IBM's OS/2 platform, including the newer eComStation and ArcaOS variants |
| Windows | Microsoft Windows, starting from XP op to the latest Windows-10 release |
Designed to offer the same windowed user-interface including mouse and clipboard suport on many platforms.
Most functionality is available in the form of commands, that can either be executed from
an extensive menu-system with dialogs, entered on the commandline, or from a script-file
allowing automated operation.
