DFSee Menu doc
DFSee logo
(Current version is: 16.1, released 22-May-2019)
DFSee reflected in disk platter
Fsys-Home  |  DFSee-Home  |  Download  |  Buy Now  |  USB/CDrom  |  Documentation  |  Support  |  History  |  Contact
(dfsee)

DFSee: disk maintenance, recovery and forensic analysis tool

DFSee USB stick
DFSPUPPY USB stick front DFSPUPPY USB stick back
FDISK - MBR/GPT PTEDIT - HEX EDIT - SCRIPTED RECOVERY
IMAGING - CLONING - MOVE - RESIZE - FILE/DIRECTORY BROWSING
DFSee 12cm CDROM

Multiplatform Swiss army knife to examine disks in great detail and fix problems with partition definitions and file systems. Create an exact clone or a compressed imagefile from your whole disk or a single partition. BROWSE through directories, and view or copy/recover files directly from the browser. Dig deep into partitioning or filesystem structures with dedicated displays and a HEX/ASCII editor and disasembler for forensic analysis. DFSee is a generic disk, partition and filesystem utility for maintenance and data-recovery. It supports partition-tables (FDISK MBR/GPT, OS2-LVM) and filesystems like (V)FAT, FAT-32, EFAT, HPFS, NTFS, JFS, EXT2/3/4, HFS+, APFS, ISO9660, and some functionality for ReiserFS, XFS, SWAP and GRUB

DFSee is NOT free software, however a fully functional evaluation version is available without requiring immediate registration. For regular use several license models are available, starting with a single-user individual registration for just € 49

DFSee functional diagram


DFSee conceptual diagram

Developed with OpenWatcom

ArcaOS/eCS/OS2, DOS32, Windows, macOS and Linux version in one package! Main functionality:

MBR and GPT disk partitioning

As a replacement for the classic FDISK, OS2-LVM and (Linux) Gparted programs, with support for MBR as well as GPT style tables.

DFSee is a complete replacement for the partitioning tools as found with DOS, OS/2, Windows-XP/7/8/9/10, macOS and Linux.
It is also a replacement for the LVM utility that comes with ArcaOS, eComStation and all OS/2 versions 4.50 or newer.
Apart from the standard create/delete type of functions there are a lot of special commands to display information and fix all kinds of problems related to partition-tables and (OS2) LVM information. A fully interactive partition-table editor is included as well (PTEdit), both for classic MBR-style partitiong as the more recent GPT (Guid Partition Tables).

Finally, the FDISK functionality combined with the scripting capabilities is being used by large organisations for automatic (and unattended) roll-out scenarios.

Disk and partition recovery

To recover from partition problems and disasters (UNFDISK)

An often used function here is the DFSDISK/DFSFAST procedure that automates the collection of needed information to 'UNDO' an accidental FDISK operation or other partitioning related disasters.
Analysis of this information by an expert (like DFSee support) often leads to the required recovery commands, usually delivered in the form of a dedicated recovery-script that can be run from the DFSee menu.
Another important feature is the ability to save and restore ALL partitioning information in a regular file that you can keep as a backup (on removable media or network) so recovery operations will be MUCH easier.

Disk and partition copying

As a tool to copy whole disks or partitions

Two main functions are available:

IMAGING Whole disks, partitions or parts of partition can be saved to an imagefile, either RAW or in a compressed format. The imagefiles can be restored to the same or a different location resulting in backup or copy functionality. The compressed images can be opened for directory/file browsing, to view or to retrieve individual files from such a backup image. This works for partition images as well as full-disk images.

For large images, and using removable media to store them, it is possible to limit the size of the generated files and create multiple numbered files for one image. For direct writing to removable media like diskettes, CDR or DVD-R (streaming) it will prompt for media-change too.

When using compressed images, it has the added benefit that you can use the BROWSE functionality to navigate the files and directories in the (.IMZ) image and copy individual files or directories out of it (selective RESTORE function).

CLONING Cloning can make an exact copy of (part of) a partition or disk to another area on the same or another disk. This can be used as a very fast backup facility and to move partitions arround.
Check the CLONE, MOVE and COPY commands and menu-items ...

For both imaging and cloning, DFSee can use internal allocation information from the filesystem structures to skip unused areas (SMART clone/image) minimizing imagesize and speeding up the process.

For forensic use, the SMART option should not be activated, to make sure the image/clone retains ALL the information of the original, including the unused disk sectors/blocks.

These DFSee functions are comparable to programs like Norton GHOST and PowerQuest DriveImage, and simple tools like Linux 'dd'

Filesystem BROWSER, navigating files and directories

As a minimal directory and file BROWSER, much like a filemanager.

This is an easy to use and powerful way to access files in filesystems that may otherwise be inaccesible, either beacues there is some filesystem damage that prevents it from being 'mounted' in the normal way, because you need to access it from an operating system that does NOT have a driver for this type of filesystem, or because it is inside an imagefile.

Once in the browser, you can navigate through the directory structure and edit/view/copy one or more of the presented files.

Copying files from the browser is a user-friendly way to RECOVER FILES from inaccessible filesystems, and can also be used as a form of selective RESTORE from an image backup.

File recovery

As a tool to RECOVER files that have been accidentaly deleted or from otherwise unaccessible filesystems, by making a COPY of the file to another drive.

This feature is implemented for all FAT variants, APFS, EXT2/3/4, HFS+, HPFS, ISO9660, JFS, and NTFS.

It is operated using the user-friendly BROWSE interface, where you navigate to the files/directories to be recovered, and use the context-menu (with ) on a single file, or on a group of marked files or directories (space bar toggles mark).

Or you can use the manual file recovery procedure by finding all deleted or normal files (DELFIND/FILEFIND), and then letting the user make a selection based on a wild-card filespecification and a recoverability outlook percentage (from DELSHOW, 'list -f', or through the BROWSER display).
The actual recovery operation will copy the matching files to a specified directory, on another disk or on network storage (RECOVER).

You can find the file-recovery functions in the menu as well, in the specific 'Mode=...' submenus for the filesystems that support it.

Filesystem analysis and recovery

As an analysis and recovery tool for most used filesystems.

This includes boot-sectors, superblocks and low-level directory structures. For most supported filesystems some specific commands are available that fix common problems with that filesystem.
To support a large number of possible filesystems, DFSee uses specific modes of operation. Every mode has its own set of dedicated commands and recognized data formats (sector/block types). Generic commands (and sector types) are available in all modes. On selecting a data-source (disk, partition, volume, image) DFSee will try to recognize the involved filesystem and activate support for it automatically.

The currently available modes are:

FDISK For partitioning work, default active at startup
APFS Apple filesystem, used on iOS and later macOS
AUX Auxilary mode for unrecognized data
EFAT Enhanced FAT filesystem intended for huge media
EFAT Enhanced FAT filesystem intended for huge media
EXT2/3/4 Native filesystem on Linux, EXT3/4 are journaled
DUMPFS Large-disk (crash) DUMP partition for OS/2
FAT Classic PC filesystems including FAT32 and VFAT
HFS The journaled filesystem HFS+ for (older) macOS
HPFS Native filesystem on OS/2, eComStation, ArcaOS
ISO ISO9660 FS as used on CDROM/DVD and ISO images
JFS Journaled filesystem on OS/2, eCS or ArcaOS
NTFS Native filesystem on Windows-XP and later
REISER Journaled filesystem on Linux by Hans Reiser
SWAP Dedicated Linux SWAP partition
XFS The 'X' terabyte journaled filesystem on Linux

Commands specific to a mode are available in that mode only, except for many of the FDISK commands that are available all the time just as all the generic commands are.

Binary/HEX viewer/editor

As a powerful binary (or rather HEX) display and edit tool, including an x86 disasssembler and an ASCII viewer. Works directly on disk/partition sectors or on (binary) files.

DFSee can access data on hard-disks, operating-system volumes like diskettes or CDROM and files, inclusing DFSee compressed images (.IMZ) and VirtualBox disk images (.VDI)

Disclaimer

DFSee is NOT a beginners tool!
It was written for system administrators, data-recovery or forensic experts, and power-users

Although DFSee has been written with recovery and analysis in mind, and tries to take the safest approach to all operations, I can not give any guarantee regarding use of the DFSee program. The power of the program may lead to unexpected and undesirable results including data-loss in the hands of inexperienced users.

Only use DFSee and any function in it, if you know what you are doing, or when instructed by someone who does!
Really READ warning and confirmation messages, don't just acknowledge them!

Known bugs

None, at the moment ...

Fsys-Home  |  DFSee-Home  |  Download  |  Buy Now  |  USB/CDrom  |  Documentation  |  Support  |  History  |  Contact
(dfsee page) DFSee: disk maintenance, recovery and forensic analysis tool
Views: 420322 Viewable with Any Browser Created by Jan van Wijk:   May 2005, last update:   22-May-2019 Valid HTML 4.01 Transitional