      DFSee version 6.11 25-08-2004  (c) 1994-2004: Jan van Wijk
 =========================[ www.dfsee.com ]==========================

_______________________________________________________________________________

C O N T E N T S:
_______________________________________________________________________________

  Note on the format
  Examples of DFS usage
_______________________________________________________________________________

N O T E   O N   T H E   F O R M A T:
_______________________________________________________________________________

I will write most examples in the form of a DFSee 'scenario' that begins
with starting DFSee, and then lists the commands to be used.

Starting DFS could be DFSOS2.EXE, DFSDOS.EXE or DFSWIN.EXE (NT/2000/XP),
in the example I will use one of them, just fill in whatever you use ...

Also, on commands I might add some commant at the end of the line, preceded
with a ';' character. You can include that on the actual command, it will be
echoed to the screen (and possible log file) but otherwise has no effect.
_______________________________________________________________________________

E X A M P L E S:
_______________________________________________________________________________

 1) Make a backup of all the important partition sectors in a file

    Note: It is advisable to use the DFSUNFD script for this unless
          special parameters are required. This will produce all
          the required backup and information files for recovery.
          (see HOWTO item number 3)

    For other purposes, the PSAVE command can be used directly:

    DFS                                 ;Start DFS and scan physical disks
      psave * a:\dfspsave  Backup of partitioning sectors
      q

    Where the last part (Backup of ...) can be any comment you like

    It can be restored at any time using the PRESTORE command. This will
    either restore all sectors, or just selected ones. See DFSFDISK.TXT


    To run this command directly from the (operating system) command-line:

    DFSxxx.EXE  psave  *  a:\dfspsave  Backup of partitioning sectors


    The PSAVE command is also contained in the DFSTART script that can be
    used to make a backup of all your partitioning information after changes.
    It is also part of the DFSUNFD script used for disaster analysis.
    So you can also run DFSTART or DFSUNFD (not both :-) to get the backup.
_______________________________________________________________________________

 2) Create logfile to keep DFSee output for analysis (or to send to me :-)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log  filename                     ;append logging to 'filename.log'
      ...

    or even simpler:

    DFS -log:filename
      ...

    Where you fill in a meaningful filename, like part of your name ...

    Do NOT use output redirection (DFS xxxx > filename.log) because that
    will cause a lot of garbage to be logged into the file.
_______________________________________________________________________________

 3) Collect information to perform a manual un-fdisk (find all boot sectors):

    This is automated in the scripts DFSUNFD.BAT (DOS/WinNT versions) and
    DFSUNFD.CMD (OS/2 version). These collect info for every physical disk.

    For analysis, zip the resulting log and PSAVEd files and send it to me:

                  support@dfsee.com

    Add as many details as you can remember about the original disk layout,
    partition types, sizes etc. I'll use some of my spare-time to take
    a look at it, which might take some time!
_______________________________________________________________________________

 4) Recover a 'lost' NTFS partition where the bootsector is damaged and
    the partition is not recognized by NT anymore (assuming 3rd partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log recover
      part 3
      fs NTFS
      fixboot
_______________________________________________________________________________

 5) Recover a 'lost' JFS partition where the bootsector is damaged and
    the partition is not recognized by OS/2 anymore (assuming 2nd partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log recover
      part 2
      fs JFS
      fixboot
_______________________________________________________________________________

 6) Recover a 'lost' HPFS partition where the bootsector is damaged and
    the partition is not recognized by OS/2 anymore (assuming 1st partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log recboot
      part 1
      fs HPFS
      fixboot
_______________________________________________________________________________

 7) Recover a 'lost' or damaged HPFS spareblock (sector 11) when the
    partition is not recognized by OS/2 anymore (assuming 1st partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log recspare
      part 1
      fs HPFS
      findcp
      fixspare

    Note: with a damaged spareblock you can get various error messages from
          OS/2 about codepages or other things. However when starting DFSee
          and selecting the partition it will tell the spareblock is damaged.
_______________________________________________________________________________

 8) Save and restore (parts of) a disk or volume

    The "sim" command can be used to save a complete disk, including partition
    information to one (very large!) file on a different (network) drive.
    To save the entire unit (opened disk/partition or volume) use:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      sim img-name 0 $

    It can be restored using the "wrim" command, but will only work perfectly
    if the destination disk has the same geometry as the source disk.
    ('heads' and 'sectors' the same like "255, 63", cylinders same or larger).
    This can be used to clone one workstation to multiple machines.
    Note:From DFS version 4.14 this can be done more easily using CLONE cmd

    It can also be very useful to save a single sector (like the bootsector)
    when you are experimenting with the filesystem.

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 04                           ;select the partition
      sim bootsecX 0 1                  ;save bootsector to file bootsecX.img
_______________________________________________________________________________

 9) Create a trace-logfile to allow analysis of DFSee internal problems

    This is to allow analysis of traps or other unexpected behaviour by DFSee
    and will create a possibly LARGE logfile containing functional trace
    information on what DFSee is doing.

    There are three ways to create such a trace, the simplest one will start
    functional tracing right from the start and might create a HUGE file:


    Command                             Explanation

    DFS  -111                           ;Start DFS with trace to DFS-111.log
      ...                               ;execute any DFSee command that
                                        ;shows the problem being analysed

    As an alternative, you can start DFSee with a regular logfile, and
    start the functional-trace later in the scenario. This reduces the
    size of the resulting logfile.


    Command                             Explanation

    DFS  -l:problem1                    ;Start DFS with trace to problem1.log
      ...                               ;execute any DFSee command that
      ...                               ;leads towards the problem
      trace -t 100                      ;start trace with timestamps
      ...                               ;execute the 'problematic' command(s)


    Finally you can start DFSee without any logging, and just before the
    problematic command start functional-trace to a specified logfile:


    Command                             Explanation

    DFS                                 ;Start DFS
      ...                               ;execute any DFSee command that
      ...                               ;leads towards the problem
      trace -t problem2                 ;start trace to problem2.log
      ...                               ;execute the 'problematic' command(s)


    In all cases, zip the resulting logfile(s) and send with a description of the
    problematic DFSee behaviour (hang, trap, crash ...) to:

        support@dfsee.com
_______________________________________________________________________________

10) Undelete a file on HPFS or NTFS; Find the files using:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      delfind                           ;find ALL deleted files
      export   undel01                  ;save found fnode info to a file
      delshow                           ;optionaly list them (ALL !)
      delshow  *test*%100               ;or just a selection, here only 100%
                                        ;recoverable with 'test' in the name

    Use "recover" command to copy the deleted files to a directory, see (11)
_______________________________________________________________________________

11) Recover a selection of the found "undeletable" files (NTFS or HPFS)

    First find the possibly deleted files using DELFIND, see (9)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      import   undel01                  ;restore found info from file
      delshow  *inst*                   ;list files with 'inst' in the name
      recover  X:\undel  *inst*         ;recover same ones to X:\undel\  dir

    Notes: - It's best to use a different drive to avoid overwriting

           - The wildcard used on 'delshow' and 'recover' can contain
             multiple wildcard characters, and deals with the FULL PATH and
             filename, so you can include (parts of) the directory too.

           - You can also undelete a single file using the 'saveto' command
             and specifying the files sequence-number: .NNNNN shown at the
             left of the 'list' output.
_______________________________________________________________________________

12) Update the HPFS bad-sector list with the results of a DFS-scan

    Find all sectors that are unreadable:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      scan                              ;find unreadable sectors
      export b badguys                  ;save in an ASCII file badguys.lsn

    Now replace the internal bad-sector list with the new modified one:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      import b badguys                  ;get the bad-sector list from file
      fixbs                             ;and insert in HPFS badsector list


    Notes: - You can do this in one step too, no need to export/import
_______________________________________________________________________________

13) Show all detected anomalies in the SLT (like allocation errors)
    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part  nn                          ;select a partition
      check                             ;build SLT and report all errors
_______________________________________________________________________________

14) Display the FAT for a diskette in drive A:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      vol a
      fatshow
_______________________________________________________________________________

15) Display the FAT Root-directory for partition C:
    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part C                            ; select the partition
      d                                 ; next is bootsector
      d                                 ; next is root directory
_______________________________________________________________________________

16) Save the master boot record (MBR) on a different PC connected with a
    parallel laplink cable and running the LPT tool:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      disk 1
      sim [lpt.exe]d:\images\mbr.img 0 1
_______________________________________________________________________________

17) Restore the master boot sector from a different PC connected with LPT:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      disk 1
      wrim [lpt.exe]d:\images\mbr.img 0 1
_______________________________________________________________________________

18) Resolve original name of OS/2 HPFS FILExxxx.CHK files (created by CHKDSK)

    When CHKDSK recovers files it will place them in a FOUND.xxx directory in
    the root-directory. This directory contains one or more recovered files
    with names like FILE0001.CHK
    The original name of the file is still in the Fnode, it can be shown
    using the following dhpfs commands (assuming partition 03) :

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 03                           ;Select partition 'id' (must be HPFS)
      \found.000\file0001.chk           ;Search and display Fnode for .CHK

    Now 15 characters of the original name are shown as "Fnode Name String"


    Note: This will only work with the older CHKDSK versions, the newer ones
          create a binary CHKDSK.LOG in the root directory of the checked
          drive, and use a different naming scheme where the original name
          is reflected already. It is NOT in the FNODE anymore.
          To read the CHKDSK.LOG use the PMCHKLOG.EXE program that is supplied
          by IBM (and documented somewhat with the Warp-4 fixpack 8 readme)
          Last time I looked (May 2003) it was still available at:

             ftp://service.boulder.ibm.com/ps/products/os2/fixes/chklogpk.exe

          This is a self extracting file with all needed files.
          This really should have been part of the OS distribution by now!
_______________________________________________________________________________

19) Show freespace areas (HPFS, FAT, NTFS)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      slt $
_______________________________________________________________________________

20) Automatically FDISK a workstation using a batchfile or commandfile like:

    echo DFSee FDISK generic workstation >  dfsfdisk.log
    dfsdos -b newmbr                 1  clean
    dfsdos -b create primary bmgr
    dfsdos -b startable 1
    dfsdos -b create logical fat  6  1  -1,c MAINT
    dfsdos -b create primary hpfs *  1  +0   WARP

    This will create a disk with bootmanager (image prepared with DFSIBMGR),
    a small maintenance partition at the end of the disk minus 1 cylinder
    and a primary partition filling the rest of the disk.

    Note: This can be done using a native DFSee script (like makepart.dfs)
          too and this will perform much quicker when run from a diskette
          because the executable file only gets loaded once.
          See item 46 for an example.
_______________________________________________________________________________

21) Automatically FDISK a server-machine using a batchfile or commandfile like:

    echo DFSee FDISK RAID  server          >  dfsfdisk.log
    dfsdos -b newmbr                   *  clean
    dfsdos -b create primary bmgr
    dfsdos -b startable 1
    dfsdos -b create primary hpfs 300  1  0  SYSTEM
    dfsdos -b create logical fat  200  1
    dfsdos -b create logical hpfs *    1  0  RESTORE
    dfsdos -b create logical hpfs *    2
    dfsdos -b create logical fat  *    3
    dfsdos -b setboot 0:SYSTEM
    dfsdos -b setboot m:advanced
_______________________________________________________________________________

22) Make a clean master boot record, getting rid of all old partitions

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      newmbr 1 clean                    ;Create fresh MBR on disk 1 with
                                        ;clean, empty partition table
_______________________________________________________________________________

23) Restore saved backup of all the important partition sectors from a file

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      prestore * a:\dfspsave

    Each of the available *.PDn files will be restored to the same disk
    it was created from. All saved sectors will be restored and, when
    not using batch mode, the user will be prompted for each of them
    allowing a more selective restore.
_______________________________________________________________________________

24) Restore PSAVE file of one disk, to a different one, clone partition tables

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      prestore 3 a:\dfspsave.pd1

    Assuming a PSAVE has been run with at least one disk present, the file
    dfspsave.pd1 will contain all important partition sectors for disk 1.
    This will be restored to the specified disknumber 3.
_______________________________________________________________________________

25) Create a detailed overview of all your disks and partitions in a text file

    Command                             Explanation

    DFS  -log:diskpart                  ;Start DFS and open a logfile
      part -Verbose -alloc

    This can also be run directly from the command-line, as in:

    DFS.EXE  -log:diskpart  -Q  part -V -a
_______________________________________________________________________________

26) Clone a physical disk to another (identical) one, including all data

    Command                             Explanation

    DFS  -log:dskclone                  ;Start DFS and open a logfile
      disk   2                          ;select/open the TARGET disk
      clone  -disk:1                    ;clone disk-1 to disk-2

    This can also be run directly from the command-line (batch mode!), using:

    DFS.EXE  -log:dskclone  -b  -Q  disk 2#clone -disk:1
_______________________________________________________________________________

27) Clone partition from another partition (data only, no partition table)

    Command                             Explanation

    DFS  -log:pclone                    ;Start DFS and open a logfile
      part  7                           ;select/open the TARGET partition
      clone  -part:1                    ;clone part-1 to part-7


    This could be used to clone the BMGR to another disk, including all
    code and configuration data.
_______________________________________________________________________________

28) Resize (truncate) the first partition, making 500 MiB available

    Command                             Explanation

    DFS  -log:truncate                  ;Start DFS and open a logfile
      part  1                           ;select/open the partition
      resize -free:500                  ;truncate to current size minus 500MiB
_______________________________________________________________________________

29) Create an imagefile for a partition, using CLONE instead of SIM

    Step 1: Create a dummy image file at the destination
    Stap 2: Open the created dummy and CLONE an existing partition to it

    echo dummy > v:\part05_backup.img
    DFS  -log:imgclone
      im  v:\part05_backup.img
      clone  -part:05
      q

    Note: The resulting image will be as large as the partition!
          In real life, SIM is the better alternative.
_______________________________________________________________________________

30) Expand an HPFS partition using DFSee and CHKDSK (updated for 4.28)

    While testing the TRUNCATE command for HPFS, where CHKDSK is needed to
    fixup the allocation bitmaps, I found that it also works the other way!

    a) Make some freespace AFTER your HPFS partition (using DFSee delete)
    b) Wipe this freespace to all binary zeroes (to avoid garbage info)
    c) Delete the HPFS partition, and create it again in the same place
       but with a larger size. (using the freespace from step a)
    d) Use the 'RESIZE -max' command to update the HPFS internal size info
    e) Reboot, to allow OS/2 to notice the changed partition and LVM info
    f) Run CHKDSK on the partition, this will expand the allocation bitmaps
       to use the whole new partition-size for the HPFS filesystem.

    When the partition has been accessed, it is better to execute the steps
    (c) and (d) from a bootable DOS diskette using DFSDOS. Otherwise you might
    get problems (traps) while shutting down OS/2 for the reboot.
    This is caused by out-of-date information in several caches.

    As an alternative for testing with minimal risk, you could create a new
    (larger) partition and CLONE the smaller one to that location.
    The scenario for that (and as I used it) is:

    a) Make a new partition, larger than the current one at different location
    b) Wipe this new partition to all binary zeroes (to avoid garbage info)
    c) Reboot, to allow OS/2 to notice the changed partition and LVM info
    d) For LVM systems, create a new volume "from existing partition"
    e) Clone the source HPFS partition to this new, larger, location
    f) Use the 'RESIZE -max' command to update the HPFS internal size info
    g) Run CHKDSK on the partition, this will expand the allocation bitmaps
       to use the whole new partition-size for the HPFS filesystem.

       Note that the reboot/LVM step has been moved to an earlier stage here
       to avoid any risk of clearing the bootsector. (by LVM.EXE)


    Note: I am not sure if there is a limit to how much you can expand your
          HPFS partition. All experiences and info on that is welcome!
          My largest test was expanding a 2000 MiB eComstation bootable
          partition to a new size of 3500 MiB, the result was a working
          HPFS partition!
_______________________________________________________________________________

31) Using a DOS boot diskette for DFSDOS.EXE

    5.XX TIP:  Do NOT USE EMM386 in combination with DFSDOS version 5.xx,
               as this is known to cause stability problems on some cases
               like a solid hang on startup of DFSDOS.EXE.

    4.XX TIP:  Create a boot diskette using a memory manager such as EMM386
               to make well over 600 KiB of memory available.
    NOTE:      only needed for DFSDOS version 4.xx !!!
               version 5.xx runs in 200 KiB free ...
_______________________________________________________________________________

32) Change the filename in an HPFS directory and Fnode

    This is sometimes needed to get rid of a file that has 'illegal'
    characters in the name like '>' or other strange characters
    created in a different codepage.

    High-level:

    a) Find the FNODE for the file       ('find' command or '\path+filename')
    b) Update shortname if needed        ('H .' + 'edit' command)
    c) Check and write back              ('show' + 'write' command)
    d) Find related directory block      ('u' + 'd' command)
    e) Find the long-filename in there   ( 'H . ' + some 'd' commands)
    f) Edit the long-filename in there   ('edit' command)
    g) Check and write back              ('show' + 'write' command)

    Low-level: change '\tmp\filename.bad' to 'filename.txt'

    DFS.EXE
      part  03
      \tmp\filename.bad
      h  .
      edit  -p:16  -a:"txt"
      show
      write  .
      u
      d                         ;display the DIR-block
                                ;if BTree pointers are listed, select
                                ;the right block using a ".nnn" cmd
                                ;Note the alpabetic ordering of names
      H  .                      ;Display first of possible 4 sectors
      d                         ;use "d" or <Enter> until the sector
      d                         ;with the filename in it is found
      edit  -p:0xa4  -a:"txt"
      show
      write  .
      q
_______________________________________________________________________________

33) Reboot to a different operating-system partition (IBM bootmanager installed)

    OS/2 or eComStation installations with IBM bootmanager installed can use
    the standard SETBOOT.EXE program to reboot to any bootable partition.

    You can do the same using the DFSee program. Added benefit is that you
    can use it from a Windows partition as well (to boot back to OS/2) and
    that you can have an extra confirmation step if you like.


    Example to boot from eComStation to an XP partition called "WinXP":

    Create a new program-object by locating any existing program icon,
    right-click and select "Create another -> Program" and fill in:

    Path and filename:   H:\T\DFSOS2.EXE
    Parameters:          -w+ setboot -iba:WinXP
    Working Directory:   h:\t

    Session type should be "OS/2 Window" (or "eCS Window") type of program.
    For the icon you can use DFS.ICO or DFSEE.ICO from the distribution ZIP
    file, or any other icon you like.

    As setup like this ("-w+") it will ask for a confirmation (are you sure)
    If you want to skip that too, just add the "-B" switch to the parameters
    and specify to start the program "minimized".


    Example to boot back to "eComStation" from the XP partition:

    In Windows (NT, W2K, XP) just create a 'shortcut' to the DFSWIN.EXE program
    and specify the right parameters, example: "-w+ setboot -iba:eComStation"


    For Windows-9x you can do the same using DFSLDOS.EXE, however that also
    requires the Windows-9x reboot program DFSDOSX.EXE to be present, this
    will perform a regular Windows shutdown and reboot after the right
    bootmanager info has been set to boot into the wanted partition.

    Note that DFSLDOS does NOT support a windowed user-interface so any "-w+"
    option will be ignored, and the confirmation is a simple text message.

    From a command-line the reboot is initiated (without confirmation) using:

           DFSLDOS  -B setboot  -iba:eComStation

    To create a shortcut on the desktop that does the same (with confirmation):

    Right-click on the Desktop, select "New->Shortcut"
    In "Command line" field: "c:\tools\dfsldos.exe setboot -iba:eComStation"
    Use [Next] to select a Name, then an Icon and [Finish] ...

    Make sure DFSLDOS.EXE and DFSDOSX.EXE are in the specified directory.

    DFSLDOS.EXE is in a separate download from the DFSee website, and will
    not be maintained. The latest available version is 5.04
_______________________________________________________________________________

34) Copy files from a damaged or inaccessible NTFS, HPFS or FAT partition

    Sometimes you lose access to NTFS files because of some kind of crash,
    a failed update or whatever.  DFSee is often still capable of finding
    files within the NTFS filesystem and copy them to another disk.

    This can be very useful to save a few very important files before
    reinstalling or trying other recovery methods.


    DFS.EXE  -log:myproj
      part  02
      filefind  .java
      list -f   *myproj*
      recover   a: *myproj*
      q

    This will first find all filenames containing ".java" in their name
    on partition number 2 (must be NTFS, HPFS or FAT) and then list all
    those that also have "myproj" somewhere in the full path specification.
    Finally the same files as displayed by list are recovered by copying
    them to the diskette in A:

    The 'recover' could use a more specific wildcard, like *myproj*dialogs*
    based on your judgement of the "list -f" output.
    You can also recover them in several groups to make the files fit on
    more than one diskette ...

    Make sure the diskette has enough space to hold all the files to recover,
    a disk-full situation will cause an ungraceful failure!

    Of course you can recover to any volume (driveletter, path) that you have
    access to when running DFSee. It could be another disk-partition or a
    network drive or whatever ...
_______________________________________________________________________________

35) Copy files from a damaged or inaccessible HPFS or FAT partition (DIRFIND)

    This is an alternative to scenario (34) that works on HPFS and FAT and
    could be a lot faster too because it searches the directory-structures
    instead of the entire partition. It uses DIRFIND instead of FILEFIND.

    DFS.EXE  -log:myimages
      part  15
      dirfind  s  \  -l:*.jpg
      recover d:\images *.jpg
      q

    This will first find, then list and finally recover ALL .JPG files
    from partition 15 to the directory 'D:\images\' on driveletter D:
    Any paths (subdirectories) from the source partition 15 will be
    preserved when possible, or be replaced by unique numbers.

    Note: This requires DFSee version 4.27 or later.
_______________________________________________________________________________

36) Show (only) the disk geometry or MBR-identification for all disks

    Some recently added options of the 'PART' command can be used to
    display the disk geometry for all disks, without showing any warnings
    or the complete table.

    part  -g  -w- -t-

    -g     = read disks (refresh) and show geo
    -w-    = do NOT show any warnings
    -t-    = do NOT show the partition table display

    So, from the command-line, to display it and directly quit again:

    DFS.EXE  -Q  part -geo -w- -t-

    That will display the geo and automatically quit.
    Or if you want it in a logfile:

    DFS.EXE  -log:geometry  -Q  part -geo -w- -t-

    Will put it in 'geometry.log'

    Another new option will include a one-line description of the bootcode
    found in the MBR for each disk:

    part  -m  -w- -t-

    -m     = read disks (refresh) show geo AND show MBR description
    -w-    = do NOT show any warnings
    -t-    = do NOT show the partition table display


    So, from the commandline, to display it and directly quit again:

    DFS.EXE  -Q  part -mbr -w- -t-
_______________________________________________________________________________

37) Expand an NTFS partition using DFSee and Windows 'check' (updated for 4.28)

    The scenario listed in (30) for HPFS works for NTFS as well, with some
    minor changes due to the 'other operating system' involved.
    Actually it is even easier because I found that an explicit 'check'
    operation is often not needed because Windows (XP) will do that at
    startup automatically.

    WARNING: Do NOT resize the NTFS partition you are booted from!
             I strongly advise to use the OS/2 version, or the DOS version
             DFSDOS.EXE from a DOS boot-diskette (requires 700 KiB free mem)

    a) Make some freespace AFTER your NTFS partition (using DFSee delete)
    b) Wipe this freespace to all binary zeroes (to avoid garbage info)
    c) Delete the NTFS partition, and create it again in the same place
       but with a larger size. (using the freespace from step a)
    c2 On an LVM system, use the 'LVM' command to update the recorded size
    d) Use the 'RESIZE -max' command to update the NTFS internal size info
    e) Reboot to Windows (tested with XP, but NT and and W2K should be OK too)
    f) Run the 'check' option on the partition in the 'disk management' tool.
       I found that this step was not really needed, but it can't hurt and
       you can see if the partition is healthy after the resize.

    Of course the alternative as outlined in scenario (30) with using a newly
    created partition and CLONE works too, it is just a different way to get
    that larger partition-table entry for the filesystem to be resized.

    Note: I am not sure if there is a limit to how much you can expand your
          NTFS partition. I have tested a 4GiB NTFS data partition, and resized
          that succesfully to 6GiB. The resulting filesystem was accessible by
          the XP operating system. I will run another test expanding a bootable
          Windows-XP that is now 3.5GiB to take up 6GiB ...

          Update 30-07-2002: Resize of a bootable Windows-XP fails, maybe
          because it detects a different size at startup, and decides that
          this is a 'different' computer so the registration is not valid.

          Resizing back to the smaller size often does NOT work because the
          allocation information is incorrect for the larger size, and the
          whole area is considered to be 'in use'. So you have to prepare for
          this by making an image or clone backup first, and restore that.
_______________________________________________________________________________

38) Show detailed information from .PDn file saved with PSAVE

    Although a lot of useful information from the files saved with PSAVE can
    be shown just by typing them (like 'type mysystem.pd1') sometimes you need
    to see exactly what is inside, before restoring with PRESTORE.
    This can be done by restoring it to a VIRTUAL disk inside DFSee, and use
    the normal available display commands on that.


    DFS.EXE
      virtual mysystem.pd1                      ; make disk just like the PD1
      map     -d                                ; show current disk as a map
      q

    Actually you can use any of the display commands to view that disk like
    PART, MAP, DISK, WALK, PL etc., but remember that the ONLY sectors present
    are the partition-tables, LVM-info and bootsectors.
    So selecting a partition and looking inside will probably result in errors.

    This is also a good way for experimenting with DFSUNFD results. Creating
    a VIRTUAL disk from one of the DFSUNFD.PDx files is a great starting
    point for recovery tests without risking damaging your real disk.
_______________________________________________________________________________

39) Show (minor) differences between (cloned, HPFS) partitions using COMP

    As an example for using the compare command I will show you how to use that
    combined with a few LIST commands to show difference between two HPFS
    partitions, clones made a few days apart. The original is an eCS
    boot-partition that has been used for a few days after the first cloning.

    DFS.EXE -log:compecs
      part  15                                  ; select first clone
      comp  -p:19  -list                        ; compare to other, create list
      list  +f
      list  +fi
      q

    There was 2.5 MiB worth of differences, but removing all the lines with
    'unidentified data' from the list output reduces that to just a few files.

    Changes between the two are updates to config.sys, replaced kernel and
    the DANI drivers. Rest listed are dynamic often changed files ...

    ========= Example output (edited logfile) for this scenario =============

      DFSee-OS2 version : 5.00 executing: comp -p:19 -l

      Compare area from :
      alternate Store 2 : Partition (part)  19 = '  '    mode = HPFS
      TO current  store :
      DEFAULT = Store 1 : Partition (part)  15 = '  '    mode = HPFS

      Sectors to handle : 003E8200 =    2000 MiB to start sect: 00000000

      Compare to area on: same disk, buffer  8064 sect = 4032 KiB
      First sector todo : 00000000
      Progress  4 MiB/. : 00000000  .......................................
      1920 MiB+ 4 MiB/. : 003BEC80  .....................
      Last sector done  : 003E81FF size 003E8200 =    2000 MiB
      Elapsed time is   : 152 seconds, throughput 13.16 MiB/sec

      Different sectors : 000012E1 =    2417 KiB

      The compared areas are NOT identical

      DFSee-OS2 version : 5.00 executing: list -f (and -f:i, combined in log)

      .00006 = 0003012E : f 100% 1024   B \IBMCOM\LANTRAN.LOG
      .00007 = 0003012F : f 100% 2048 KiB \os2\system\SWAPPER.DAT
      .00010 = 00092D3D : z 100%  255 KiB \os2\OS2SYS.###
      .00012 = 00092D7A : z 100%  512   B \IBMLAN\LSSHARE.###
      .00014 = 000938C3 : f 100%  915 KiB \os2krnl.dbg
      .00016 = 00093A19 : z 100% 1024   B \os2\eCSClock\ALARM.###
      .00017 = 00093A58 : f 100%   67 KiB \os2\boot\DaniS506.ADD
      .00018 = 00093A59 : f 100%   26 KiB \os2\boot\DaniATAP.FLT
      .00019 = 00093A79 : z 100%  512   B \mptn\ETC\TCPOS2.###
      .00020 = 000A295E : f 100%   12 KiB \IBMLAN\LOGS\NET.AUD
      .00027 = 000AC6EA : f 100%  830 KiB \os2krnl
      .00052 = 000AC9AF : z  50% 1024   B \os2\eCSClock\ALARM.###
      .00053 = 000AC9B0 : f 100%  512   B \mptn\ETC\TCPOS2.INI
      .00054 = 000AC9B1 : z 100% 1024   B \os2\eCSClock\ALARM.###
      .00055 = 000AC9B2 : f 100%  512   B \IBMLAN\LSSHARE.INI
      .00060 = 000AD253 : f 100% 1024   B \os2\eCSClock\ALARM.LST
      .00061 = 000AD254 : z 100%    0   B \os2\OS2.!!!
      .00062 = 000AD255 : z 100%    0   B \os2\OS2SYS.!!!
      .04525 = 000B0B6B : z 100% 1152 KiB \os2\OS2.###
      .04526 = 000B71D8 : f 100% 1152 KiB \os2\OS2.INI
      .04527 = 000CB3CA : f 100%  255 KiB \os2\OS2SYS.INI
      .04528 = 000D68B7 : f 100%   35 KiB \POPUPLOG.OS2
      .04638 = 001F07A4 : D 100% 2048   B \Desktop\
      .04639 = 001F07A5 : D 100% 2048   B \Nowhere\
      .04644 = 001F08F9 : f 100%    9 KiB \Config.Sys

    ========= End     output (edited logfile) for this scenario =============
_______________________________________________________________________________

40) SETBOOT to other partition, changing LVM driveletters too (2 C: drives)

    On a system with two LVM-aware operating systems installed, both with
    assigned instead of calculated drive-letters it is not possible to have
    two separate C: drives, one visible, the other hidden, and switch between
    them using bootmanager (as often used before LVM)."

    It IS possible however, to assign the driveletter C: to the partition you
    want to boot to, after removing it from the current one and then reboot to
    that new C: drive using a SETBOOT.

    This can be automated in a single DFSee command (a so-called multi-command)

    As an example, assume there are 3 primary partitions:
    1  bootmanager
    2  eCS-test partition, also installed as C:
    3  eCS-GA, installed as primary C:

    The command to switch from eCS-GA to the ecS-test would be:

    DFS -w+ -Q lvm -B 3 -l- #lvm -B 2 -l:C #setboot -ibd:C


    And to switch back from eCS-test to the ecS-GA:

    DFS -w+ -Q lvm -B 2 -l- #lvm -B 3 -l:C #setboot -ibd:C


    In the example, the LVM will be executed without questions asked, and
    the setboot will ask a confirmation first. Note that if you decide NOT to
    boot at this point, that the C: driveletter has changed!
    This might cause problems with LVM or other disk-tooling.

    An example to switch without any questions asked:

    DFS -b -Q lvm 2 -l- #lvm 3 -l:C #setboot -ibd:C

    These commands can easily be put in a small batch file (.CMD) or even
    into the 'parameters' field of a program-object on the desktop.
_______________________________________________________________________________

41) Display contents of a .PDx file (from PSAVE) as a DFS table (and map)

    dfs virtual -B dfsunfdi.pd1
    dfs virtual -B dfsunfdi.pd1#map -d

    These commands return to the operating-system command-line, to stay
    within DFSee for further displays, use:

    dfs -Q- virtual -B dfsunfdi.pd1

    This example uses an outputfile from the new (version 5.02) DFSUNFD
_______________________________________________________________________________

42) Convert all partitions of a system to LVM-volumes, no questions asked

    dfs -b vcu
_______________________________________________________________________________

43) Convert any new partitions to volumes, but keep existing ones the same

    dfs -b lvm * -V
_______________________________________________________________________________

44) Examine (and possibly change) all LVM related values for the volumes
    using an interactive dialog-window. (can also be started with <F8>)

    dfs
      lvm
      q

    To run this directly from the OS command-line, and quit the DFSee
    executable after the last volume is handled, use:

    dfs -w lvm

    Note: You can either use the <Enter> key or the <PgUp> and <PgDn> keys
          in the dialog-windows to get to the next (or previous) volume.
          Once the last volume has been done, the LVM dialog is ended.
_______________________________________________________________________________

45) Put ALL existing volumes on the bootmanager menu, with dialog-window
    and confirmation for each one (allowing more manual changes)

    dfs
      lvm * -menu
      q
_______________________________________________________________________________

46) Use a native DFSee script to partition a new system (also see 20 & 21)
    In this case a BootManager image is installed as well, and this requires
    the file 'dfsibmgr.img' to be present. (created with DFSIBMGR cmd).
    It will also create the needed LVM-info on the fly using the new
    -L option for the create command and the new "LVM" functionality.

    dfs run makepart wsname

    This will be an 'interactive' run where you will be prompted for
    confirmations for each command, and can change any values using
    the LVM dialog as well. For an unattended run (no questions) use:

    dfs -b run makepart wsname

    In both cases the 'makepart.dfs' file contains:

    ;----------- start of script
    ;Workstation partitioning: BMGR, OS2, MAINT and Data partitions
    ;
    log ws$1
    ;
    newmbr 1 clean
    cr  pri  bmgr  1     -disk:1  -L:"-D -V"
    cr  pri  hpfs  800   -disk:1  -L:"-D -v:'OS2'   -l:C -menu"
    cr  log  hpfs  100   -disk:1  -L:"-D -v:'MAINT' -l:M -menu"
    cr  log  hpfs        -disk:1  -L:"-D -v:'DATA'  -l:D"
    startable 1
    ;
    part -r
    ;----------- end of script
_______________________________________________________________________________

47) Perform a CHECK on all partitions, creating a check.log file

    dfs -l:check part -c
_______________________________________________________________________________

48) Convert partitions to volumes, using industry-standard drive-letter
    assignments. This is useful if the boot OS is DOS and HPFS, FAT32
    or NTFS partitions need to be assigned driveletters too.
    In this example a logfile 'convert.log' will be created too, and the
    processing will be 'silent' (no output to the screen).

    dfsdos -b -q -Q -l:convert part -i#vcu
_______________________________________________________________________________

49) Delete a file from an NTFS filesystem that the normal NT/W2K/XP
    programs cannot handle. (possibly due to filename problems)

    This is sometimes needed to get rid of a file that has 'illegal'
    characters in the name or has an extreme long filename.

    High-level:

    a) Select the NTFS volume in question based on drive-letter     (VOL)
    b) Search for the file, using (part of) the filename       (FILEFIND)
    c) Select the right one and show file-details as double-check  (.NNN)
    d) Clear the 'MFT-record' for this file                        (WIPE)

    e) Have Windows perform a CHKDSK to update the directory information
       and allocation for the file. This will release the used space for
       the file and remove the name from the directory it was in.


    As an example, when the filename contains the unique "bad-bad file" and
    there is only one such file on volume G:, the following

    // to be refined ...

    DFSWIN.EXE  -log:delfile
      vol  g
      filefind "very-badguy"                ;find the files
      .0                                    ;select the right one  (or only)
      wipe  z . 2                           ;wipe MFT record clean (note . !)
      q

    Take good care with the WIPE command syntax, it has THREE parameters
    the second is a DOT and the third is the number TWO.


    When this is finished, the command:

    CHKDSK  G:  /f

    should be run from a command-prompt. Make sure the volume (here G:) is not
    in use at that time by any program or the CHKDSK will complain ...
    In the output, you are likely to see references to the filename of the file
    you are removing since the directory entry will be removed, and you should
    also see some space being recovered for the file's data area.
_______________________________________________________________________________

50) Correct "does not start on cylinder boundary" error for the first primary
    partition on a disk that has been moved from the first cylinder to make
    space for something else. Partition-Magic will NOT align it properly in
    this case. It will stay aligned on head 1, sect 1 while it should be at
    head 0, sect 1. We need to move the whole partition towards the beginning
    of the disk, over one track distance (1 track, usually 63 sectors = 0x3f).

    As an example, to re-align a 3000 MiB FAT32 partition that is PID 2 now:

    DFSDOS.EXE  -log:align
      delete 2                          ;delete current partition-table entry
      cr pri fat32  size                ;create it again, aligned
      part 2                            ;select the recreated partition
      clone -part:2  -from:1,track      ;move by cloning, over 1 track

    Note: This correction is mainly cosmetic, there are hardly any tools or
          operating systems that have a real problem with this non-alignment.
_______________________________________________________________________________

51) Clone a physically damaged disk to a new one, to allow recovery on that.
    This will cause minimal use of the damaged disk, and allows for a second
    chance if the recovery should fail for some reason. You need an extra disk
    as a destination for the clone, and it needs to be the same size or larger
    to make a complete copy of the original damaged disk.

    To CLONE a physically damaged disk for recovery, the following
    options are recommended for maximum reliability:

    -E:i    to continue cloning after read errors (incl retries)
    -b:1    to force single sectors reads, this is very slow but
            will result in a minimum number of unreadable sectors

    You might also want to change the number of retries on sector read-errors
    from the default of 0 (no retries). To use retries to have a larger chance
    of recovering hard to read sectors after many retries ...
    To change this, you need to use the global -A: switch at startup, example:

    DFSOS2.EXE  -A:3

    Note: there have been a few reports of DFSDOS.EXE hanging after cloning
          many bad-sectors using a retries (with -A:5).

    So assuming your damaged disk is placed as the 2nd disk in a system,
    and a new one is available as disk number 3, the cloning would be:


    DFSOS2.EXE  -log:clone2
      disk  3                           ;select DESTINATION disk
      clone  -E:i  -b:1  -d:2           ;clone from DAMAGED disk
      q


    Of course you can use any of the DFSxxx.EXE versions ...

    The resulting logfile could become large if many read-errors occur, but
    could be very useful afterwards to check where the bad spots have been.

    Immediately after the cloning has completed, it is advised to change the
    partition types on the new disk to types NOT recognized by the operating
    system, to avoid automatic CHKDSK/SCANDISK operations. If you don't do
    this, recovery might be made very difficult or even impossible ...
    You might even need to do this on the damged disk too, if still possible.

    Note that unreadable sectors on the destination disk will have
    a content of all 0xFE bytes, easy to recognize as invalid ...
_______________________________________________________________________________

52) Find files on a damaged FAT partition
    Since the FAT filesystem does not have a datastructure for each file,
    like NTFS and HPFS do, it is harder to find files. There is a SUBFIND
    command however that will find all sectors that have ".." directory entry
    Together with the (new) -d option on the LIST command (implies -l-) this
    can be used to create a listing of all files in those subdirectories.

    DFSDOS.EXE  -log:fnames
      part 1                            ;select a FAT partition
      subfind                           ;find subdirectory sectors
      list -d                           ;list contents, but keep list.


    The resulting 'fnames.log' can be used to find missing files by name, and
    they can be recovered by re-displaying the directory in question and then
    use the .NNN command plus a SAVETO command to copy the filedata.

    Note:
    On older versions this was impossible because listing a directory
    would destroy the search-result list, replacing it with the files
    in the displayed directory.
_______________________________________________________________________________

53) Fix a "WARNING : Logical partition extends beyond EBR extended-container"

    This warning will be given together with the partition-ID (PID).


    There are two ways to fix this problem:

    You can change it interactively using the PTE command, type the command:

     PTE   -p:PID

    on the DFSee command-line, where PID is the DFSee partition-ID for the
    partition (taken from the warning or left column in "part" display).

    Now you will see a display of the partition-table for that partition.
    Note the value that it shows (in blue text) in the "end cyl" field.
    The value in yellow-on-green is the same or exactly 1023. (int13 limited).

    Using the <PgUp> key, you will see the previous partition-table, with
    the extended-container for the partition in question.

    On this display it should show the same value for the "end cylinder"
    but in this case it will be LESS (that is what the warning is about).
    If you type the correct value over the displayed value in the input field
    (yellow on green) and <Tab> to the next field, it will be updated.
    The related fields will be updated as well to keep everything consistent.

    If the shown values seem OK, press <Enter> to write the changes to disk.


    The second method is simply deleting the partition with "DELETE PID"
    and create it again using the right type, size and so on ...
    This will re-create it without damaging any data.
_______________________________________________________________________________

54) Make a multi-partition JFS LVM-volume accessible again
    Sometimes LVM information gets damaged by disk-tools or by system crashes.
    For multiple-partition JFS volumes, this often results in OS/2 or eCS not
    assigning a drive-letter anymore because the LVM info is not consistent.
    To recover this, you need to update the LVM-information on EACH of the
    involved partitions, making them consistent again.

    The most important requirements for such a volume are:
    - The LVM partition names for each partition in the set must be different
    - The LVM volume name recorded with each one must be exactly equal
    - The assigned drive-letter recorded with each one must be identical

    As an example, if you have a large JFS volume that has 3 partitions
    residing on DFSee partition IDs (PID) 03, 05 and 14, you can create
    consistent LVM information using:


    DFSDOS.EXE  -log:jfsmulti
      lvm  03   -v:"jfs 3 part multi" -p:"disk1-multipart-1"  -l:K
      lvm  05   -v:"jfs 3 part multi" -p:"disk1-multipart-2"  -l:K
      lvm  14   -v:"jfs 3 part multi" -p:"disk2-multipart-3"  -l:K


    Note: Recovering LVM-info this way will only work if the LVM-signature
    sectors and related information, which resides at the END of each
    partition is still intact. If that is damaged too, it will be nearly
    impossible to recover the JFS volume. You might be able to use LVM.EXE
    with a "create from existing partition" selecting each of the partitions
    in turn, but that should be done in the exact same order as originally.
_______________________________________________________________________________

55) Shorten LVM disk-, Volume- and Partition-names to 19 positions maximum

    This may be needed when long names have been created using LVM.EXE,
    it can cause display problems with 'lvm /query' and it causes all
    sorts of problems for tools using the LVM-API (like eCS 1.1 install)

    To avoid problems, these names should not have more than 19 characters.
    DFSee will give a warning on the 'PART' command for each disk and
    partition with a name longer than 19 characters.

    To shorten all volumenames and partitionnames for all partitions use:

    lvm  -P-  *                         ;shorten volume+partition names
    lvm  -P-  -n                        ;shorten disk names

    Or, if you want to have the chance to edit the disknames:

    lvm  -n                             ;shorten disk names, with prompt

    To edit the volume and partitionnames, just start the lvm dialog
    interactively and edit each name as appropriate and use the <PgDn>
    key to get to each partition in turn:

    lvm                                 ;start interactive lvm dialog
_______________________________________________________________________________

56) Create a compact partition listing, suitable for email and newsgroups

    This may be needed when you want to post an overview of the most
    important partition information to a newsgroup or email it.

    Typical DFSee output is 80 characters wide and might contain special
    characters so it easily causes all sorts of formatting problems like
    line-wrapping when displayed or handled by an email or news program.

    The simplest way to get such a list is:

    DFS query

    and to get it into a file:

    DFS query > filename

    or, even better

    DFS -l query

    You can also reduce the output more by leaving out the copyright:

    DFS -B- -l:filename query

    Finally, since the "query" command is just a synonym for "part -C -m"
    you can also add other "part" options to the command, examples:

    DFS query -v                                ;verbose list all partitions
    DFS query -m- -d:2                          ;just disk 2
    DFS query -C- -m-                           ;the standard 'framed' table
    DFS query -t- -m- -w                        ;list warnings only
    DFS query 3                                 ;show partition 3
    DFS query -disk:2 1,r                       ;show 1st partition on disk 2


    In all cases, the 'DFS' program can be either DFSDOS, DFSOS2 or DFSWIN
_______________________________________________________________________________

57) Set the default selection on the IBM BootManager menu

    With this you can force the BootManager menu to always come up with the
    specified name/partition being selected, causing that to boot after the
    timeout even if you booted something else the last time.

    DFS.EXE
       setboot  -0:"sysname"          ;to set default selection to "sysname"
       q


    You can also reset it to always default to the 'last booted' system.

    DFS.EXE
       setboot  -0-                   ;to set default to 'last booted'
       q


    You can do it directly from the commandline too:

    DFS  setboot  -0-

    Note that the option is a ZERO not the letter O!
_______________________________________________________________________________

58) Updating the boot code in the MBR sector, NEWMBR

    This will replace the bootcode called by the BIOS (first disk usually)
    by generic code from DFSee. Doing this will get rid of any unwanted
    code there like bootmanagers or even worse virii.



    DFS.EXE
       newmbr  1                      ;refresh bootcode in MBR on disk 1
       q


    You can also erase ALL partitions by clearing the partition table:

    DFS.EXE
       newmbr  1  -clean              ;refresh code and clean table
       q


    From the DFSee menu you can do the same using:

      Mode=FDISK -> New MBR Code KEEP tables  -> 1 .. select disk

    or, to erase the partition table too:

      Mode=FDISK -> New MBR Code Erase tables -> 1 .. select disk


    That menu entry both REPLACES the bootcode called by BIOS to startup
    your system (mostly important for the first disk) and it completely
    erases the partition-table in that same MBR sector.

    And although it does not really are the other  partition-tables in
    any extended boot records (EBR) for you logical partitions,
    it does make all of those invisible since the reference to them
    in the MBR-table is gone.

    It does NOT erase any LVM or other information though, the command
    is limited to the very first sector on the disk only (MBR).
_______________________________________________________________________________

59) Remove LVM information from existing partition(s)


    You can't completely remove the LVM info from ONE partition
    using DFSee, but there are two methods that come close:

    A) Remove all RELEVANT info from the LVM info for a partition
    This will delete everything that is normally used or displayed for
    an LVM volume. As an example, for partition 06:

            lvm 06  -D  -v-  -p-  -l-  -m-  -i-

    After applying it will NOT be considered a volume anymore.
    However, the LVM sector for the partition will still contain the
    disk-name, the partition-size, and LVM signature and a valid CRC.
    Using this partition with DFSee, LVM.EXE or LVMGUI would look the
    same as using a freshly created partition without any LVM info.


    B) Remove (erase!) all LVM sectors for a disk

    This will set the LVM-info and LVM-signature sectors to ZERO!

            pclear  ls  -disk:n

    Where 'n' is the disk-number or '*' for all disks.

    Both commands are documented in DFSFDISK.TXT.

_______________________________________________________________________________

60) Find and recover a SINGLE deleted file (NTFS or HPFS)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      delfind  document                 ;find file with 'document' in name
      delshow  *document*               ;optional check, list files ...
      recover  x:\tmp                   ;recover all files to X:\tmp\  dir

    When there are more than one file listed, you can use a selection
    wildcard on the recover as well, as in:


      recover  x:\tmp *mydoc*           ;recover only files matching 'mydoc'


    Notes: - It's best to use a different drive to avoid overwriting

           - The wildcard used on 'delshow' and 'recover' can contain
             multiple wildcard characters, and deals with the FULL PATH and
             filename, so you can include (parts of) the directory too.

           - You can also undelete a single file using the 'saveto' command
             and specifying the files sequence-number: .NNNNN shown at the
             left of the 'list' output.
_______________________________________________________________________________

 ----------------------------[ www.dfsee.com ]-------------------------------
