
   Display File Systems; version 4.23 23-05-2002  (c) 1994-2002; Jan van Wijk
 ----------------------------[ www.dfsee.com ]-------------------------------

CONTENTS
--------

 Terminology used

Note: for command descriptions and usage examples see the other dfs*.txt files


Terminology used
----------------

 dot-number     A numeric value, preceded with a period, which is used to
 .NNNNN         select a sectornumber from the sectorlist.
                The first sector in the list will be '.0' and the largest
                value depends on the DFSee version. (see "Sector list")
                Leading zeroes can be left out, so ".18" equals ".000018"
                It can have any number of digits, upto the maximum value.

 Base           This is the base-sectornumber (PSN) that equals LSN-0.
                So, when the current opened entity is a partition, it will be
                the PSN for the first sector of the partition being viewed.
                It is displayed at the end of the DFSee statusline and can
                also be displayed using the 'store' command.
                There is also a 'base' command that can be used to specify
                this base value manually, as well as the 'limit' value.
                It has options to set the BASE for various areas like freespace
                The base and limit values will normally be set automatically
                when opening any entity like a partition.


 BootManager    A program that controls booting one out of several bootable
 BMGR           partitions on your harddisks. There are many implementations
 BM             residing either in their own partition, using some space in
                in a FAT partition or only a few 'reserved' sectors near the
                master boot record (MBR).
                Well known bootmanagers are the IBM one (with OS/2), the one
                used with Windows-NT/2000/XP and the Linux-loader LILO.
                Within DFSee most references to it deal with the IBM version
                of the BootManager which has been shipped with OS/s since the
                earliest 2.0 releases. The lates incarnations as used on eCS
                WsEB and the convenience-pack is fully integrated with the LVM
                technology used in those versions and also has better support
                for booting beyond the 1024 cylinder limit and 2nd/3rd disks.


 Bootsector     The very first sector of a filesystem that usually holds some
 Bootrecord     critical information about it like:
 BR             Bootcode, used when the partition is bootable
                Geometry and size info (boot parameter block)
                Location of filesystem tables (FAT, MFT, Superblock, RootDir)


 Bootsector     A field in the partition table entry that specifies the
 offset         position of the defined partition as an offset.
                The 'base' for this offset is either 0 (MBR position) or the
                position of the first EBR in the chain (the 'EBR-base'):

                For a primary partition:
                The offset from the partition-table-sector (MBR so always 0)
                to the location of the partition bootsector.

                For the first extended-container (type 05 or 0f) in the MBR:
                The offset from MBR = 0 to the first EBR in the chain.
                This position is reused in other logical offsets, and DFSee
                calls it the "EBR-base".

                For a logical partition:
                The offset from the EBR-base (first EBR) to the location of
                the partition bootsector.

                For all other extended-containers (type 05 or 0f in an EBR):
                The offset from the EBR-base to this target EBR.


 CHS            Cylinder Head Sector (addressing)
                This is the classical way of addressing physical sectors
                on a disk. It is used in the PC's BIOS, in partition tables
                and in low-level disk-IO API's (IOCTL, INT-13).
                In most implementations the addressing ranges are limited
                causing all sorts of problems with large disks/partitions.


 Clone          Make a sector-by-sector copy of a disk, partition or volume
                to another. In DFSee this will be a store-to-store copy,
                where a store represents any disk, partition or volume.
                This allows large copy operations, like whole physical disks,
                without the need for intermediate image files.


 Cluster        A (small) group of adjacent sectors that are handled by the
                operating system as one allocation-unit.
                It is used on FAT filesystems to allow large partitions at
                the cost of more wasted "slack" space, and on NTFS to balance
                performance, slack-space etc.
                HPFS does not use sector-clustering (or a cluster-size of 1!)

                DFS will try to account for clustering where needed, for
                example in size calculations and where sector/cluster pointers
                are used in the filesystem internal structures.


 Compatibility  An LVM volume that can also be used/seen by older operating
 volume         systems, and that can be made bootable. The partition-type for
                the partitions associated with this volume (always ONLY one!)
                has the usual values like 0x07 for HPFS and 0x06 for FAT16.

                Note: If you want to create a compatibility volume using LVM.EXE
                      choose to create a volume that "can be made bootable"


 Disk           A (physical) disk, usually containing one or more partitions.
                These are usually fixed disks in a computer system, driven by
                EIDE or SCSI controllers, but they can also be removable or
                external to the computer itself.


 EBR            Extended Boot Record
                It contains no boot code but only a partition table that
                holds the location of a single logical partitions.
                It usually is located on the cylinder just before the actual
                logical partition itself, at Head-0, Sector-1.
                Each EBR will also point to the next EBR if more logical
                partitions exist on the same disk.


 eCS            eComStation, the client version of the latest OS/2 release
                as marketed by Serenity Systems. This is the OS/2 4.50
                kernel delivered with a lot of additional desktop enhancements
                and applications as well as an easier installation procedure.


 Ext-chain      Extended partition chain, this is the list of all extended
                boot records (EBR) each holding a partition table with two
                entries: 1) An entry for the logical partition involved,
                            with partition types like FAT (0x06), HPFS (0x07)
                            or any other defined type
                         2) An entry pointing to the next EBR in the chain,
                            with partition-type 0x05 (standard) or 0x0f for
                            Windows-partitions beyond 1024 cylinders.

                There is an entry in the partition-table in the MBR that points
                to the first EBR, this also has type 0x05 or 0x0f.
                (also see Ext-container)


 Ext-container  The extended container is the area of the disk that includes
                all logical partitions (and NO primaries).
                It has an entry in the partition-table in the MBR, and counts
                for the limit of 4 entries total.
                This leads to the following two practical limits:
                - 4 primary partitions, and NO logicals, or
                - 3 primary partitions plus an unlimited number of logicals


 Ext-Int-13     Extended INT-13, a new BIOS interface that breaks the 1024
                cylinder limit. Implemented on recent (EIDE/ATA) BIOS'es
 (DFSDOS)       and some operating system drivers (like Win9x Dosbox)
                Due to several problems with different implementations,
                DFSee will recognize the existence, but only use Ext-Int-13
                on disks really larger than the limit (1024 cylinders)


 FAT            File Allocation Table, the most important structure in the
                classic DOS filesystem that also gave it its name.
                It is a table of cluster-numbers that indicates the cluster
                that holds the next part of the current file or directory,
                or indicates that this was the last cluster.
                The first cluster of a file is pointed to by the directory
                entry that also has the filename, size and the flags.
                This way the location of each cluster of a file can be easily
                found by following this "allocation-chain".

                The size of one entry in this FAT is usually 2 bytes (16bit),
                and clusters of maximum 32Kb, resulting in the largest FAT16
                filesystem of 2Gb. (4Gb on Win-NT with 64Kb clusters)

                On small disks (and diskettes) a 12-bit FAT is used, and for
                real large disks the FAT32 filesystem was introduced.

                DFSee supports 12, 16 and 32-bit FAT filesystems.

                The FAT has no redundancy and is sensitive for errors like:
                - "lost clusters" where no directory entry points to the chain
                - "cross links"   where two allocation chains point to the same
                   cluster at some point.


 FAT32          Version of the FAT filesystem that uses 4-byte = 32-bit FAT
                entries. This makes the maximum size of a FAT32 filesystem
                nearly unlimited. The FAT structure itself does take up a lot
                of space on the disk, and in memory when using the filesystem.

                FAT32 was introduced with Windows-95, and is also supported on
                the other newer Windows versions (98, ME, 2000 and XP).

                OS/2 and eCS also support it through the 3rd-party installable
                filesystem FAT32.IFS made by Henk Kelder.


 fid            Freespace ID, the number that uniquely identifies a specific
                area of freespace on a disk, as indicated in the most left
                column in the standard DFSee partition table display.


 FNODE          File-Node in HPFS filesystem
                A descriptive sector that holds the most critical information
                about a file in the filesystem like Shortname, size information
                and allocation information. (date & time are in the directory)
                It is usually located just before the actual filedata, so just
                like files FNODES are scattered all over the HPFS volume.
                DFSee uses remaining FNODE information to find deleted files.


 Freespace      An area on a partitionable disk that is NOT taken up by a
                defined primary or logical partition. Depending on the size
                and location of the freespace, it can be used to create new
                primary and/or logical partitions. DFSee classifies the
                available freespace area's to indicate what you can do:

                f0 = Wasted       : Freespace that can NOT be used at all,
                Wasted  FreeSpace   because it is not in the ext-container and
                                    the partition table in the MBR is full.
                                    (max 4 primaries including ext-container)

                f1 = Primary      : Freespace where only a PRIMARY partition
                Primary FreeSpace   can be created because there is a primary
                                    partition between it and the ext-container.

                                    Also, the first track of the disk can never
                                    contain any logical partitions. If a disk
                                    has only logical partitions this first track
                                    (1 cylinder, typical 7.8Mb) will be empty.
                                    It CAN be used to put a primary partition
                                    of 1 cylinder (like BootManager).


                f2 = Logical      : Freespace where only a LOGICAL partition
                Logical FreeSpace   can be created because the partition table
                                    in the MBR is FULL, or because the area is
                                    inside the ext-container.

                f6 = H-Logic      : Logical freespace that is just before the
                Logical FreeSpace   current ext-container. Creating a logical
                                    here will cause the ext-container to grow
                                    A primary partition can NOT be created here

                fa = T-Logic      : Logical freespace that is just after the
                Logical FreeSpace   current ext-container. Creating a logical
                                    here will cause the ext-container to grow.
                                    A primary partition can NOT be created here

                f3 = N-P/Log      : Freespace where you can create a logical or
                Pri/Log FreeSpace   a primary. The logical would be the first
                                    one, so the ext-container will be created
                                    at the same time too.

                f7 = H-P/Log      : Freespace that is just before the current
                Pri/Log FreeSpace   ext-container. Creating a logical here will
                                    cause the ext-container to grow. You can
                                    also create a primary partition here.

                fb = T-P/Log      : Freespace that is just after the current
                Pri/Log FreeSpace   ext-container. Creating a logical here will
                                    cause the ext-container to grow. You can
                                    also create a primary partition here.

                ff = Track-0      : This is a (small) area of space in the first
                Track-0 Area +Mbr   track of the disk where NO partition can be
                                    created, but that is sometimes used to
                                    install a bootmanager or put special
                                    information (like LVM info).

                You will get these code and descriptions with the 'pl f' command


 FS             A filesystem is the structuring of data on a storage medium
 File System    that allows easy access to that data by creating directory
                information and ways to search, read and write data.
                A filesystem also may have provisions aiding in data-recovery,
                security, compression and more ...
                There are dozens of implementations of filesystems with many
                different strategies to achieve the desired goals.
                In the PC (Intel) world the most used are FAT and FAT32, NTFS,
                HPFS, EXT2 and JFS. These are also the filesystems that are
                supported (more or less) by DFSee.

 Geometry       The division of harddiskspace in seperate cylinders, tracks
                and sectors per track, often referred to as CHS addressing.

                C ==> cylinder or number of cylinders
                      the position of R/W heads on the platters, each position
                      has access to a single track on each of the platters

                H ==> head     or number of heads
                      the active head-number for a single platter

                S ==> sector   or number of sectors per track
                      each track consists of several sectors

                The total number of available sectors is  C * H * S

                Now all of this is based on the physical layout of a traditional
                harddisk, and does very often not reflect the physical reality.

                Modern harddisks have just a few platters, and a high number
                of cylinders and sectors per track. This can even vary on
                different areas of the disk. For the external interface it is
                translated to a 'normalized' CHS geometry called 'physical geo'
                or a simpler linear addressing scheme is used where the sectors
                are simply numbered starting with 0 called logical block
                addressing or LBA.

                PC systems however carry the legacy of BIOS interfaces that use
                CHS type addressing on those interfaces. For capacity reasons
                that is often NOT the physical geometry as used by the disk
                itself, but a more convenient logical-geometry.

                Within DFSee three different geometries are used, see the
                corresponding descriptions for:  Ph-Geo, LogGeo and SysGeo


 HPFS           High Performance FileSystem
                Offered as a real improvement over the classic FAT filesystems
                with the OS/2 1.2 operating system. Its main advantages where
                faster access, more reliable error recovery and better handling
                of large disks. There is also a (server) version called HPFS386
                that adds native security information to the filesystem.


 INT-13         DOS Interrupt-13, the classical way to interface to
                physical disks in DOS. Limited by design to 1024 cylinders.
 (DFSDOS)       Maximum disksize, when using BIOS disk-translation like LBA
                is just below 8Gb (1024 cylinders, 255 heads, 64 sectors)


 JFS            Journalling FileSystem
                A filesystem originally developed by IBM for the AIX operating
                system sharing a lot of features with other UNIX filesystems
                and adding journalling on all filesystem operations.
                This greatly reduces the time to check and repair any damage
                after crashes or other disasters (CHKDSK).
                First offered for OS/2 with WsEB and now also available in eCS
                and the convenience pack for the desktop.
                The OS/2 implementation requires LVM, and is not bootable (yet)


 LCN            Logical Cluster Number, used in filesystems that store cluster
                numbers internally (and in their bootsectors) like NTFS does.


 LFN            The long version of the file/directory name that is kept in a
 (VFAT)         VFAT directory. This name is using UNICODE (not ASCII).
                It is used on Win9x and Win-2000/XP FAT filesystems (16/32 bit)


 Limit          This is the largest LSN (Logical Sectornumber) that can be used
                with the currently opened store. For a partition, that will be
                last sector in the partition. The limit value can be displayed
                using the 'store' command. The 'base' command can be used to
                specify a 'limit' value manually when desired.
                The base and limit values will normally be set automatically
                when opening any entity like a partition.


 LogGeo         Logical geometry
                This is the most important geometry within DFSee since ALL
                translations between logical block address (LBA) which are
                usually called Physical Sector Numbers or PSN within DFSee
                are done using this logical geometry. The initial values
                are retrieved from the operating system, but this CAN be
                changed using the GEO command. The GEO command without any
                parameters will also list the LogGeo for the current disk.


 Logical        A partition listed in a partition-table in an extended boot
 partition      record (EBR) inside the ext-container.
                By convention, the EBR is located at the start of a cylinder,
                at Head-0, sector-1 and the actual partition (bootsector)
                starts at Head-1, sector-1.


 LSN            Logical Sector Number
                This is the zero-based, unsigned 32-bit, number for a
                sector on a logical partition. The partition can be seen
                as a linear sequence of sectors.
                Note: when accessing a whole disk, the LSN equals the PSN


 LsnInfo        A value combining an LSN and a (small) informational value in
                a single 32-bit number. It can be kept in the sector-list and
                the sector lookup table, most operations will recognize and
                handle it correctly.
                On example of usage is the directory-sector LSN plus the index
                of a directory-entry for (V)FAT directories.
                LsnInfo 78000345 combines LSN 00000345 with index 7 and a
                single bit to mark it as an LsnInfo value (flag 0x08000000)
                So this points to the 8th directory entry in the directory
                sector at LSN 0345. (entry-numbers start counting at 0 :-)


 LVM            Logical Volume Manager, an 'FDISK' like program plus related
                operating system drivers on OS/2 Warp Server for e-business,
                the convenience-pack (client) and the new eComStation client.
                LVM allows more flexible naming and usage of partitions and
                drive-letters, including joining multiple partitions on
                more than one disk into a single volume.
                DFSee respects the drive-letters as assigned with LVM and has
                special display options like the 'PLIST LVM' command in FDISK
                mode. Also the 'part' display will show volume- and partition
                names as well. (TIP: use a display-size wider than 80 columns)
                The SETBOOT command is also compatible with the newer LVM-type
                bootmanager. This allows setboot to be used from NT/DOS too.

                Note: Creating new partitions will NOT (yet) also create the
                      required LVM info. Therefore it is better to use LVM.EXE
                      when possible, or remove all LVM info with DFSee and let
                      the VCU.EXE utility create new (default) LVM info.
                      (tested with compatibility volumes only, not LVM/JFS)


 LVM volume     A (confusing) term used by LVM for a non-compatibility volume.
                It has a fixed type value of 0x35, and can have more than one
                partition associated with it. It is most often used for JFS
                filesystems, but HPFS or FAT is also possible.
                An LVM-volume allows disk-spanning and multiple partitions, but
                it is currently NOT possible to boot from it.

                With a JFS filesystem in an LVM-volume you can use the advantages
                of expanding the volume to make it bigger (adding partitions).

                An HPFS or FAT filesystem in an LVM-volume will only be seen
                by an LVM-aware operating system, so it is HIDDEN for other
                operating systems. (can be used to manipulate drive-letters)


 MBR            Master Boot Record
                The first sector on the physical disk, located at PSN 0 =
                Cylinder 0, Head 0, Sector 1
                It contains the initial boot code called from the BIOS and
                the main partition table that holds the primary partitions
                and the start of the chain of extended boot records (EBR).


 mcs-number     A numeric value that can be specified as decimal or hexadecimal
                using units of Megabytes (m), Cylinders (c) or Sectors (s)
                The syntax specification for such a number is:

                        [0x]nnnnnn[,m|c|s]

                A 0x prefix indicates hexadecimal format while the default is
                decimal. The number can have any number of digits, but should
                fit in a 32 bit unsigned value.
                The default unit most often is m for Mb.


 MFT            Master File Table
                The master index in an NTFS filesystem that has one (or more)
                descriptive records for every file in the filesystem, including
                the MFT itself and other system area's like the bootrecord.
                When the NTFS volume hold a lot of files, this MFT can become
                very large (like 20Mb on a 4Gb system partition).


 MFT copy       A copy of the first 16 (most important) MFT records describing
                all the NTFS system files including Root-dirctory.
                DFSee will attempt to use that copy if the base MFT file seems
                to be damaged.


 MFT record     A record (typically 2 sectors) holding the key information
                about a file in NTFS. It has filenames, sizes, date and time
                information, security info and allocation information about
                the file in question.


 Mixed string   A string, usually a parameter for a command, that may contain
                mixed ASCII, HEXADECIMAL and UNICODE parts. Without quoting
                the contents will be interpreted as ASCII, with single quotes
                it will be hexadecimal value-pairs and text within double-
                quotes will be translated to UNICODE. A complex example:

                   string'09'with tab'20 20 20'spaces" and some unicode"

                   ASCII      ASCII             ASCII
                         HEX            HEX                 UNICODE

                Usage examples, see the FIND and EDIT command (DFSCMDS.TXT)


 NTFS           New Technology FileSystem
                The new (journalling) filesystem introduced with Windows-NT
                It has many of the same improvements over FAT as HPFS, but has
                a totally different internal structure. It also add security
                information and compression and is expandable by defining new
                stream-types. Several versions exist that added specific
                features to the original implementations.


 Partition      An area on a physical disk that holds a single logical
                filesystem like FAT, HPFS, Bootmanager, NTFS etc.
                There is an index to find partitions in the form of a
                set of partition-tables in the MBR/EBR chain.


 PDn            Partitionable or Physical Disk (number)
                A numbering of the physical disks in a system, starting with 1
                It is listed as the second column 'PD' in the 'part' display.
                This numbering in DFSee is also used for the virtual disks that
                can be created. The PD is often used as a parameter in the
                DFSee commands to explicitly choose a disk to work on.


 Ph-Geo         Physical geometry
                This is the geometry reported by the disk (or disk subsystem)
                It is for reporting only, DFSee does not use Ph-geo in any way


 pid            Partition-id
                A numbering of all the partitions (and freespace) area's on
                all the physical disks recognized by DFSee.
                It is listed as the first column 'id' in the 'part' display.
                This is an ongoing numbering over all disks, the same number
                also identifies any freespace that might be just BEFORE the
                partition with this pid. A freespace area after the last
                partition will have its own unique number (fid).


 Primary        A partition that is listed is the partition-table in the MBR.
 partition      By convention these partitions start at the beginning of
                a disk cylinder (Head-0, sector-1) except for the very first
                partition that starts at Head-1, sector-1 to leave room for
                the MBR itself (and possibly other stuff, see Track-0 area)

 PSN            Physical Sector Number
                This is the zero-based, unsigned 32-bit, number for a
                sector on a physical disk. Addressing on a disk using
                PSN's is often referred to as Relative Block Addressing
                (RBA) or Logical Block Addressing (LBA)


 Sector         512 bytes of data (although other sizes exist!)
                This is the smallest amount of data manipulated by the
                disk subsystems and is also the basic allocation unit
                for the HPFS filesystem


 Sector list    A list of sector numbers (LSN) or LsnInfo combination-values
                that can be manipulated as a whole with commands like list,
                export, import, getbs, fixbs, dirfind, delfind, delsave etc.
                The size of the list is depends on the DFSee version:
                DFSMDOS: 200
                DFSDOS:  1600
                DFS:     409600
                DFSNT:   409600


 Shortname      The leading part of a filename, as contained in an HPFS fnode
 (hpfs)         and useful for undelete. The maximum length is 15 characters

 Shortname      The classical 8.3 version of a file/directory name that is
 (VFAT)         kept in a VFAT directory, alongside the long filename (LFN)


 SLT            Sector/Cluster Lookup Table
                An array of information about sectors or groups of sectors,
                containing the type of the sector(s) and the LSN of a
                directly related sector (usually an Fnode).
                It is currently implemented for HPFS only.


 Store          A collection of numbered sectors, being the basis for ALL
                DFSee commands to work on. A store can be representing:
                - A physical disk, usually in FDISK mode        (cmd DISK/WALK)
                - A partition on a disk, with a mode like HPFS       (cmd PART)
                - A volume opened directly, with a FS mode like HPFS (cmd VOL )
                - An image file opened for analysis                  (cmd IM  )
                - A DFSee virtual-disk or partition on such a disk   (cmd VMA )

                DFSee currently uses 3 stores (display with "store" cmd):

                0: The system store, used by DFSee internally
                1: User store number 1 (the default at startup)
                2: User store number 2 (alternate at startup)

                The default store is the one almost ALL commands work on.
                The alternate store can be used as the destination of COPY/MOVE
                operations. (which are to be implemented yet)


 SysGeo         System geometry
                Used by the DFSee low-level DISK read and write routines.
                It is usually the same as the logical geometry, but does NOT
                change when the logical geometry is changed with the GEO cmd


 Track-0 area   A small, normally unused, area at the beginning of the disk,
                between the MBR and the first primary partition.


 Truncate       Make a filesystem in a partition on a disk smaller, usually
                to allow creation of another partition.
                Typical use: create freespace to install a new operating system


 VCU            Volume Conversion Utility
                A program used with (the installation of) the LVM enabled
                versions of the OS/2 operating system like eCS and WsEB.
                It will create default LVM information-sectors for all the
                existing partitions on all physical disks. The partitions
                will all be "LVM compatibility volumes" that have default
                volume, partition and disk names like [A1] and [D1].
                This can be maintained later using the LVM/LVMgui programs.


 VFAT           An extension to the regular FAT directory entries that allows
                storage of long-filenames (LFN's) as well as the classic 8.3
                short version of those names. Used mainly by newer Windows
                versions, beginning with Windows-95. It can be used on any
                FAT filesystem, FAT12 (diskette), FAT16 and FAT32.


 Virtual disk   A disk that can be used just like any other partitionable disk
 (DFSee)        in DFSee but that only exists within DFSee memory.
                It can be created using the 'VMAKE' command, it is intended
                for experimenting and complex recovery scenario's
                Note: This is not the same as a 'RAMDISK' used with DOS


 Volume         A logical volume as seen by the active operating system,
                with a logical drive-letter associated to it.
                It can be either a hard-disk partition with a filesystem
                recognized and mounted by the operating system, or some
                other storage-medium like floppy disk or CD-Rom.
                Note: Network drives or other "virtual" filesystems can also
                      be referred to as volumes. However, DFSee can not access
                      them because such devices usually cannot be accessed
                      using low-level "open volume" (DASD) methods.

                Note: The term "Volume" is also used by WsEB, eCS and new OS/2
                      systems that use the Logical Volume Manager (LVM).
                      In this case the above still applies, but there is more
                      to LVM-volumes than this like disk-spanning etc.
                      For LVM systems think of a volume as another abstraction
                      layer, on top of the bare 'partitions'.
                      There usually is a 1 to 1 relationship between a volume
                      and one partition, but a volume CAN have more than one.


