      DFSee version 6.11 25-08-2004  (c) 1994-2004: Jan van Wijk
 =========================[ www.dfsee.com ]==========================

_______________________________________________________________________________

C O N T E N T S:
_______________________________________________________________________________

  Command reference    = overview FAT specific commands
  Detailed description = description for every command


  Note: All generic commands can be found in DFSCMDS.TXT, for example:

        ALLOC,  CHECK,  CLONE,  RESIZE,  RECOVER,  SAVETO,  SCAN,  WIPE

_______________________________________________________________________________

C O M M A N D   R E F E R E N C E:
_______________________________________________________________________________

FAT specific commands

Active filesystem : FAT, specific commands are:

 \[path-spec]    = find and show ROOT or file/directory relative to root
 BOOTINI  [part] = Find the (first) boot.ini file present in the filesystem
 DELFIND  [name] = Find deleted files with DIR-entry containing (partial) name
 FATSELECT [fat] = Select fat to be used (cached), fat = 1 or 2; default is 1
 FATSHOW  [*|nr] = Display contents of the FAT from memory, [nr]= # of entries
 FATSIM  img [f] = Save FAT table contents for FAT 'f' (1 or 2) to an imagefile
 FATWRIM img [f] = Restore an imagefile with the FAT table to FAT 'f' (1 or 2)
 FILEFIND [name] = Find normal files with DIR-entry containing (partial) name
 FINDROOT        = Find and list possible FAT32 Rootdirectory clusters/sectors
 FIXBOOT  [os|2] = Fix FAT(32) bootsector from part-info or spares for OS 'os'
 SETROOT [s|.nn] = Set FAT32 Rootdirectory LSN to sector [s] or listvalue [.nn]
 SPACE   [clust] = Show allocation for specified cluster or current LSN 'this'
 SUBFIND   [opt] = Find subdirectories (.. entry) from start or current lsn

 For an up-to-date list of commands, use the '?' command

 FAT specific sector types  (see ??? command)
             '1' = First  FAT area      '2' = Second FAT area
             '3' = Start 12-Bits FAT    '4' = Start 16-Bits FAT
             '8' = Start 32-Bits FAT
             '\' = Root directory
             'd' = Sub  directory       'D' = Directory data
             'I' = File data
             'X' = Bad sector-area

_______________________________________________________________________________

D E T A I L E D   D E S C R I P T I O N:
_______________________________________________________________________________

 BOOTINI  [part] = Find the (first) boot.ini file present in the filesystem

 Purpose:       Display, and optionally FIX the Windows BOOT.INI file

 Parameters:    part        optional   partition-number to be used for the
                                       current partition in the 'default='
                                       line in the BOOT.INI file.
                                       Specify '*' to use the value as
                                       calculated by DFSee ...

 Remarks: When found, some info of the file will be displayed, and the line
          containing the DEFAULT partition to be booted will be displayed
          including the 'partition(W)' partition index. It should look like:

              default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

          Below that line, the partition-index calculated by DFSee is shown.
          This is based on the assumption you want to boot to an installed
          Windows-NT/W2K/XP in THIS SAME partition! For booting to other
          partitions with Windows installed, use the value shown in the
          'BI' column that is included in the 'part -s' display.

          Incorrect values for the default partition-index will lead to
          boot failures with messages like:

              Windows could not start because the following file
              is missing or corrupt: Windows\system32\Hal.dll

          The specified or calculated value will be substituted for the
          partition-index in the default line.

          Of course you need to reboot to test if this fix worked ...

          Note: This is not a full 'REPAIR' of your BOOT.INI, just the
                minimum update to allow booting Windows again! You need
                to properly edit boot.ini once Windows is running again,
                or use 'bootcfg /rebuild' from the recovery-console that
                can be started from regular Windows installation CDs.

                When there is damage to the BOOT.INI file beyond an incorrect
                partition-index, fixing it this way might not be possible.
_______________________________________________________________________________

 CHECK  [drive] = Check filesystem integrity for drive-letter (CHKDSK)

 Purpose:       Perform a filesystem check, and report the errors found

 Parameters:    none

 Output:        Two lines for each sector in error that is found, the first
                lists the sector-number, where it is referenced from and a
                short description. The second line is an error description.

                For FAT the reported arrors are:

                0x00000001  Linked to some structure, but not in allocation-map
                0x00000002  Allocated in allocation-map, but no known link
                0x00000004  Allocation chain ends in a free cluster
                0x00000008  Allocation chain ends in a cluster with bad sectors
                0x00000010  Cluster value is invalid for current volume
                0x00000020  Cluster chain is too long for specified item

 Remarks:       Some of the errors are generic, but most are filesystem
                specific. The generic ones are also listed with the 'SLT'
                command in dfscmds.txt.
_______________________________________________________________________________

 CL             = Translate and display 'this' LSN as a cluster number

 Purpose:       Find out what cluster-number corresponds to current LSN

 Parameters:    none

 Output:        The cluster number, or an error message when invalid
_______________________________________________________________________________

 CL clust [cmd] = Translate specified cluster-nr to LSN, display using 'cmd'

 Purpose:       Display data using a cluster-number instead of an LSN

 Parameters:    clust   mandatory  The cluster-number of interest

                cmd     optional   DFS generic command to execute with clust
                                   as its first and only parameter (like 'H')

 Output:        The output for the cmd. When no explicit cmd is specified this
                will be the DFS default for the corresponding LSN, usually a
                display of that sector(s) in an appropriate format.
_______________________________________________________________________________

 DELFIND  [name] = Find deleted files with DIR-entry containing (partial) name

 Purpose:       Find deleted files, with name starting at current LSN

 Parameters:    name        optional   part of filename wanted, no wildcard

 Options:       -c      Start find from current sector instead of start

 Output:        Find-result list

 Remarks:       All deleted files, directory-entries where the name starts with
                the 0xe5 (å) character, will be found and added to the list.

                There is NO RECOVERY possible yet for deleted files, allthough
                the DAVETO and RECOVER commands will work, the resulting files
                will be CORRUPT due to missing allocation information for
                deleted files on FAT.

                List can be manipulated as usual, best viewed with "delshow"
_______________________________________________________________________________

 FATSELECT [fat]= Select fat to be used (cached), fat = 1 or 2; default is 1

 Purpose:       Update the in-memory FAT from the specified FAT from disk

 Parameters:    fat     optional   Number of the disk-FAT, either 1 or 2

 Output:        none

 Remarks:       FAT12, FAT16 and FAT32 formats are supported
_______________________________________________________________________________

 FATSHOW  [*|nr] = Display contents of the FAT from memory, [nr] entries

 Purpose:       List all FAT-entries separately for analysis

 Parameters:    nr      optional   Number of FAT-entries to show.
                                   * = all entries, default is 160.

 Output:        A list of FAT-entries with 8 values in each line, <free>
                <bad> and <eof> values are shown as such.

 Remarks:       A pseudo-graphical display of the FAT can be made using 'ALLOC'
_______________________________________________________________________________

 FATSIM  img [f] = Save FAT table contents for FAT 'f' (1 or 2) to an imagefile

 Purpose:       Save the complete file allocation table (FAT) to an imagefile

 Parameters:    img     mandatory  Name of the imagefile to create
                f       optional   Number of the disk-FAT, 1 or 2 (default 1)

 Options:       -z   or -zip  Enable LZW compression on the image-file

 Output:        Message indicating success or failure
_______________________________________________________________________________

 FATWRIM img [f] = Restore an imagefile with the FAT table to FAT 'f' (1 or 2)

 Purpose:       Restore the complete file allocation table from an imagefile

 Parameters:    img     mandatory  Name of the imagefile to restore
                f       optional   Number of the disk-FAT, 1 or 2 (default 1)

 Output:        Message indicating success or failure

 Remarks:       This is a potentially dangerous operation, also usually both
                FATs on the disk need to be in-sync. So 2 FATWRIMs are needed.
                The used imagefile should have the right size, and preferably
                be created with the FATSIM cmd from the same (size) partition
_______________________________________________________________________________

 FILEFIND [name] = Find normal files with DIR-entry containing (partial) name

 Purpose:       Find one or more directory entries for specified filename

 Parameters:    name    optional   Filename, or part of the name to find
                                   this is not a true wildcard, but can be
                                   any part of the 11-character 8.3 name.
                                   When you specify '*.xxx' or '*.y*' it
                                   will search for files with extension
                                   'xxx' or 'y*' respectively.

 Options:       -c      Start find from current sector instead of start

 Output:        Find progress and result

 Remarks:       The result is a list of sector-numbers of directory entries.
                A 'list -f' will list them, showing the sector-number for
                the directories and the index for the entry in that sector.

                You can select a single file from the list using the .NNNN
                syntax, and use the "saveto" command to recover that file.

                List can be manipulated as usual, best viewed with "delshow" or
                the equivalent "list -f". The 'recover' command can be used
                to recover multiple files in one go.

                Note: Operations using the sector-list on FAT/FAT32 like SAVETO
                      are limitted to 64 GiB partitions by design!
_______________________________________________________________________________

 FINDROOT       = Find and list possible FAT32 Rootdirectory clusters/sectors

 Purpose:       Find possible rootdirectory clusters/sectors when the FAT32
                rootdirectory reference in the bootsector is missing or damaged.

 Parameters:    none

 Output:        One line for each possible root directory cluster/sector

 Remarks:       All found sectors will be put in the sectorlist as well, and
                can be saved for later use with the 'export' command.
                The 'list +f' command can be used to display them, and
                individual ones can be displayed from the sectorlist by
                selecting them with .NNNNN command. Note: this might reuse
                the sectorlist for the directory shown, so make sure you
                have saved the original one to be restored with 'import'.
_______________________________________________________________________________

 FIXBOOT  [os|2] = Fix FAT(32) bootsector from part-info or spares for OS 'os'

 Purpose:       Fix corrupted bootsector for a FAT or FAT32 partition

 Parameters:    os | 2  optional  2 = specify 1 or 2 sector spare-copy, FAT32

                              or  x = Code for desired operating system to boot

                                  I or P   IBM/PC-DOS with IBMBIO/IBMDOS.COM
                                  M        MSDOS      with IO/MSDOS.SYS
                                  O        OS/2       with OS2BOOT
                                  N        Win-NT     with NTLDR       (FAT16)
                                  W        Win-9x     not implemented  (FAT16)
                                  9        Win-9x     with WINBOOT.SYS (FAT32)

                                  The default is 'M' for MS-DOS.
                                  OS is only relevant for FAT partitions
                                  that need to be bootable.

 Options:       -s      optional  Force a copy of the SPARE bootsector (FAT32)

 Output:        Progress and confirmation info

 Remarks:       For FAT32 with a damaged bootsector this will try to copy a
                spare bootsector, either a single one when no parameter, or
                both sectors when the parameter '2' is specified.
                If the bootsector at sector 0 is not damaged, you can force
                copying the SPARE sector by using the '-s' option.

                Otherwise a valid bootsector will be created based on above
                mentioned bootsector code and size-info from the partition
                table and locations of the FAT areas and Root directory.

                The partition table info (type and size) must still be valid,
                or valid FATs and Root directory must be present, or both.

                OS '9' will be forced when there is a 2nd bootsector with a
                valid FAT32 signature (and freespace info).
                OS '9' is NOT VALID yet for FAT16 partitions (to be refined)
_______________________________________________________________________________

 SETROOT [s|.nn] = Set FAT32 Rootdirectory LSN to sector [s] or listvalue [.nn]

 Purpose:       Set the (DFSee internal) value for the root-directory sector

 Parameters:    s|.nn   optional   sectornumber (hex) or a .NNNNN value from
                                   the sectorlist, from a FINDROOT command

 Output:        Message indicating success or failure

 Remarks:       This can be done after finding possible root-directories with
                the FINDROOT command, and will be made eefective with the
                next FIXBOOT command
_______________________________________________________________________________

 SPACE  [clust] = Show allocation for specified cluster or current LSN 'this'

 Purpose:       Show size and fragmentation of allocated space for a cluster

 Parameters:    clust   optional   Cluster number

 Output:        A list of allocation-chunks with LSNs and sizes

 Remarks:       none
_______________________________________________________________________________

 SUBFIND   [opt] = Find subdirectories (.. entry) from start or current lsn

 Purpose:       Find all starting-sectors for subdirectory clusters

 Parameters:    none

 Options:       -c      Start find from current sector instead of start

 Output:        Find progress and result

 Remarks:       The result will be a list of sector-numbers of directory sectors.
                A 'list +f' will list them, showing the cluster numbers for the
                directories. You can save the list using the 'export' command.
                Selecting a single entry from the list with the ".nnn" command
                will display that particular directory, showing the files.
                Selecting a single file from that list, again using the ".nnn"
                command will show the direectory-entry information for that
                file. You can use the "saveto" command to recover that file.

                Note that selecting from the initial list, and displaying
                directory info, builds a NEW list destroying the find-result.
                You can use the 'export' and 'import' commands to save that
                find-result and work with other entries in the list later.

_______________________________________________________________________________
