      DFSee version 6.11 25-08-2004  (c) 1994-2004: Jan van Wijk
 =========================[ www.dfsee.com ]==========================

_______________________________________________________________________________

C O N T E N T S:
_______________________________________________________________________________

   Command reference    = overview of NTFS specific commands
   Detailed description = description for every command


  Note: All generic commands can be found in DFSCMDS.TXT, for example:

        ALLOC,  CHECK,  CLONE,  RESIZE,  RECOVER,  SAVETO,  SCAN,  WIPE

_______________________________________________________________________________

C O M M A N D   R E F E R E N C E:
_______________________________________________________________________________

NTFS specific commands

Active filesystem : NTFS, specific commands are:

 BOOTINI  [part] = Find the (first) boot.ini file present in the filesystem
 CA   [lsn][opt] = Check Allocation integrity for (current) MFT lsn
 DELFIND  [name] = Find deleted files, with MFT containing (partial) name
 FILEFIND [name] = Find normal files,  with MFT containing (partial) name
 FINDROOT [n][~] = find the Root directory without using the superblock
                   starting the search at LSN [n]; [~] = use 8.3 names
 FIXBOOT         = Recover NTFS bootsector from the spare-copy, if available
 MFT             = Translate and display 'this' LSN as an MFT record nr
 MFT  mft-recnr  = Calculate LSN for MFT record-nr and perform default display
 MIR [mft-recnr] = Calculate LSN for MFT-mirror record-nr, do default display
 MFTEXT          = Find all external MFT records (continuation for base-MFT)
 PATH     [n][~] = Show all path-components for MFT, upto root [use 8.3] name

 For an up-to-date list of commands, use the '?' command

 NTFS specific sector types  (see ??? command)

             'f' = MFT regular File     'z' = MFT deleted File
             'D' = MFT regular Dir      'y' = MFT deleted Dir
             'd' = Directory index

             For an up-to-date list, use the '???" command
_______________________________________________________________________________

D E T A I L E D   D E S C R I P T I O N:
_______________________________________________________________________________

 BOOTINI  [part] = Find the (first) boot.ini file present in the filesystem

 Purpose:       Display, and optionally FIX the Windows BOOT.INI file

 Parameters:    part        optional   partition-number to be used for the
                                       current partition in the 'default='
                                       line in the BOOT.INI file.
                                       Specify '*' to use the value as
                                       calculated by DFSee ...

 Remarks: When found, some info of the file will be displayed, and the line
          containing the DEFAULT partition to be booted will be displayed
          including the 'partition(W)' partition index. It should look like:

              default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

          Below that line, the partition-index calculated by DFSee is shown.
          This is based on the assumption you want to boot to an installed
          Windows-NT/W2K/XP in THIS SAME partition! For booting to other
          partitions with Windows installed, use the value shown in the
          'BI' column that is included in the 'part -s' display.

          Incorrect values for the default partition-index will lead to
          boot failures with messages like:

              Windows could not start because the following file
              is missing or corrupt: Windows\system32\Hal.dll

          The specified or calculated value will be substituted for the
          partition-index in the default line.

          Of course you need to reboot to test if this fix worked ...

          Note: This is not a full 'REPAIR' of your BOOT.INI, just the
                minimum update to allow booting Windows again! You need
                to properly edit boot.ini once Windows is running again,
                or use 'bootcfg /rebuild' from the recovery-console that
                can be started from regular Windows installation CDs.

                When there is damage to the BOOT.INI file beyond an incorrect
                partition-index, fixing it this way might not be possible.
_______________________________________________________________________________

 CA   [lsn][opt] = Check Allocation for (current) MFT lsn

 Purpose:       Check allocation integrity for current MFT

 Parameters:    lsn         optional   LSN of the MFT record
                opt         optional   Options:  v   = Verbose, show progress

 Output:        ¯           Start of one file-extent (fragmented file)
                ú           One cluster, small green dot: allocation OK
                þ           One cluster, big red dot: allocation error

                Also a summary is given with the number of (failed) sectors

 Remarks:       MFT-entry may be for a regular file (sectors must be ALLOCATED)
                or for a deleted file (sectors must be FREE)
_______________________________________________________________________________

 CHECK   [drive] = Check filesystem integrity for drive-letter (CHKDSK)

 Purpose:       Perform a filesystem check, and report the errors found

 Parameters:    none

 Output:        Two lines for each sector in error that is found, the first
                lists the sector-number, where it is referenced from and a
                short description. The second line is an error description

                For NTFS the reported arrors are:

                0x00000001  Linked to some structure, but not in allocation-map
                0x00000002  Allocated in allocation-map, but no known link
                0x00000004  Some NTFS error detected (to be refined ...)


 Remarks:       Some of the errors are generic, but most are filesystem
                specific. The generic ones are also listed with the 'SLT'
                command in dfscmds.txt.
_______________________________________________________________________________

 CL             = Translate and display 'this' LSN as a cluster number

 Purpose:       Find out what cluster-number corresponds to current LSN

 Parameters:    none

 Output:        The cluster number, or an error message when invalid
_______________________________________________________________________________

 CL clust [cmd] =Translate specified cluster-number to LSN, display using 'cmd'

 Purpose:       Display data using a cluster-number instead of an LSN

 Parameters:    clust   mandatory  The cluster-number of interest

                cmd     optional   DFS generic command to execute with clust
                                   as its first and only parameter (like 'H')

 Output:        The output for the cmd, when no explicit cmd is specified this
                will be the DFS default for the corresponding LSN, usually a
                display of that sector(s) in an appropriate format.
_______________________________________________________________________________

 DELFIND [name] = Find deleted files, limit to MFT records containing [name]

 Purpose:       Find deleted files, with name starting at current LSN

 Parameters:    name        optional   part of filename wanted, not a true
                                       wildcard, but may start and end in
                                       a '*' character

 Output:        Find-result list (as "find -type:z") on screen and in memory

 Remarks:       All deleted files, or the ones where the MFT record contains the
                specified UNICODE string, will be found and added to the list.

                The [name] selection aims at the FILENAME part only. To select
                on part of the full-path for the file, use the wildcard select
                parameters on the DELSHOW and RECOVER commands

                The [name] is NOT case-sensitive, and there is a slight chance
                of 'false-hits' when other parts of the MFT contains this string

                List can be manipulated as usual, best viewed with "delshow"
_______________________________________________________________________________

 FILEFIND [name] = Find normal files, limit to MFT records containing [name]

 Purpose:       Find not-deleted files. Where the name contains a wildcard,
                the found files can be copied to another disk using the
                RECOVER or SAVEAS commands, just as with deleted files.

 Parameters:    name        optional   part of filename wanted, not a true
                                       wildcard, but may start and end in
                                       a '*' character

 Options:       -c          start from current sector, not start of volume

 Output:        Find-result list (as "find -type:f") on screen and in memory

 Remarks:       All deleted files, or the ones where the MFT record contains the
                specified UNICODE string, will be found and added to the list.

                The [name] selection aims at the FILENAME part only. To select
                on part of the full-path for the file, use the wildcard select
                parameters on the DELSHOW and RECOVER commands.

                The [name] is NOT case-sensitive, and there is a slight chance
                of 'false-hits' when other parts of the MFT contains this string

                List can be manipulated as usual, best viewed with "delshow" or
                the equivalent "list -f"
_______________________________________________________________________________

 FINDROOT [n][~] = find the Root directory without using the bootrec info
                   starting the search at LSN [n]; [~] = use 8.3 names

 Purpose:       Find the MFT for the ROOT directory, even if parts of
                the volume, including the boot record, are damaged.

 Parameters:    n           optional   Start LSN for the search

                ~           optional   Use the short 8.3 name when available

 Output:        Search-list starting at the first MFT record encountered up to
                the MFT record for the ROOT directory when found.

 Remarks:       none
_______________________________________________________________________________

 FIXBOOT        = Recover NTFS bootsector from the spare-copy (saved by format)

 Purpose:       Fix corrupted bootsector for an NTFS partition

 Parameters:    none

 Output:        Progress and confirmation info

 Remarks:       This will locate the copy of the bootsector saved by format,
                and when found copy it to the bootsector location (sector 0)

                The partition-table info (type and size) must still be valid!
_______________________________________________________________________________

 MFT            = Translate and display 'this' LSN as an MFT record number

 Purpose:       Calculate and display the MFT-record number from current LSN

 Parameters:    none

 Output:        The mft-record number, or 0xFFFFFFFF when not in an MFT record
_______________________________________________________________________________

 MFT [mft-recnr] = Calculate LSN for MFT record-nr and perform a default display

 Purpose:       Display a sector, probably an MFT-record, by specifying its
                MFT number. The logical sector-number is based on the MFT-0
                pointer in the boot-record an a calculated sectors-per-mft.

 Parameters:    mft-recnr          The record number for the MFT record
                                   0 is the first MFT, regarding the MFT itself

 Output:        Display of the MFT record contents, or an error message
_______________________________________________________________________________

 MIR [mft-recnr] = Calculate LSN for MFT-mirror record-nr, do default display

 Purpose:       Display a sector by specifying its MFT number as an index
                into the MFT-mirror area. (effect as 'MFT' command)

 Parameters:    mft-recnr          The record number for the MFT record

 Output:        Display of the MFT record contents, or an error message

 Remarks:       The MFT mirror area only contains a subset (usually 16 records)
                The main purpose for the MFT mirror is as a backup for the
                important (system) files like the MFT and root directory.
_______________________________________________________________________________

 MFTEXT         = Find all external MFT records (continuation for base-MFT)

 Purpose:       Quickly find all MFT records that are continuations for others

 Parameters:    none

 Output:        Standard find-progress, and one line per hit

 Remarks:       Continuation MFT records link back to the base-MFT. This link
                will be recorded in the 'up' shortcut. (command 'u')
                From the base MFT-record, the first external continuation MFT
                will be recorded in the 'eXtra' shortcut (command 'x')

                Existence of a continuation record is a sure sign for very
                heavy fragmentation of the file in question.
_______________________________________________________________________________

 PATH    [n][~] = Show all path-components for MFT, up to root [use 8.3] name

 Purpose:       Show the directory-branch that contains current file/dir

 Parameters:    n           optional   Start LSN for the search

                ~           optional   Use the short 8.3 name when available

 Output:        One line for each found 'parent' directory, up to the root

 Remarks:


 NTFS remarks:

 Date and time-information in the NTFS filesystem is stored as a time-offset
 in units of 100ns starting on 1st of January 1601. It is  a 64-bit number.
 The date and time is stored as a Universal Co-ordinated Time (UTC/GMT) and
 displayed as such by DFSee. If you want timestamps to correspond to your
 local timezone, you can set the 'TZDFSEE' environment variable to a signed
 number of minutes, being the offset to GMT.

_______________________________________________________________________________
