      DFSee version 9.11 22-08-2008  (c) 1994-2008: Jan van Wijk
 =========================[ www.dfsee.com ]==========================

_______________________________________________________________________________

C O N T E N T S:
_______________________________________________________________________________

  Note on the format
  Examples of DFS usage
_______________________________________________________________________________

N O T E   O N   T H E   F O R M A T:
_______________________________________________________________________________

I will write most examples in the form of a DFSee 'scenario' that begins
with starting DFSee, and then lists the commands to be used.

Starting DFS could be DFSOS2.EXE, DFSDOS.EXE or DFSWIN.EXE (NT/2000/XP),
in the example I will use one of them, just fill in whatever you use ...

Also, on commands I might add some comment at the end of the line, preceded
with a ';' character. You can include that on the actual command, it will be
echoed to the screen (and possible log file) but otherwise has no effect.
_______________________________________________________________________________

E X A M P L E S:
_______________________________________________________________________________

 1) Make a backup of all the important partition sectors in a file

    Note: It is advisable to use the DFSDISK script for this unless
          special parameters are required. This will produce all
          the required backup and information files for recovery.
          (see HOWTO item number 3)

    For other purposes, the PSAVE command can be used directly:

    DFS                                 ;Start DFS and scan physical disks
      psave * a:\dfspsave  Backup of partitioning sectors
      q

    Where the last part (Backup of ...) can be any comment you like

    It can be restored at any time using the PRESTORE command. This will
    either restore all sectors, or just selected ones. See DFSFDISK.TXT


    To run this command directly from the (operating system) command line:

    DFSxxx.EXE  psave  *  a:\dfspsave  Backup of partitioning sectors


    The PSAVE command is also contained in the DFSTART script that can be
    used to make a backup of all your partitioning information after changes.
    It is also part of the DFSDISK script used for disaster analysis.
    So you can also run DFSTART or DFSDISK (not both :-) to get the backup.
_______________________________________________________________________________

 2) Create logfile to keep DFSee output for analysis (or to send to me :-)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log  filename                     ;append logging to 'filename.log'
      ...

    or even simpler:

    DFS -l:filename
      ...

    Where you fill in a meaningful filename, like part of your name ...

    Do NOT use output redirection (DFS xxxx > filename.log) because that
    will cause a lot of garbage to be logged into the file.
_______________________________________________________________________________

 3) Collect information to perform a manual un-fdisk (find all boot sectors):

    This is automated in the scripts DFSDISK.BAT (DOS/WinNT versions) and
    DFSDISK.CMD (OS/2 version). These collect info for every physical disk.

    For analysis, zip the resulting log and PSAVEd files and send it to me:

                  support@dfsee.com

    Add as many details as you can remember about the original disk layout,
    partition types, sizes etc. I'll use some of my spare time to take
    a look at it, which might take some time!
_______________________________________________________________________________

 4) Recover a 'lost' NTFS partition where the bootsector is damaged and
    the partition is not recognized by NT anymore (assuming 3rd partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log recover
      part 3
      fs NTFS
      fixboot
_______________________________________________________________________________

 5) Recover a 'lost' JFS partition where the bootsector is damaged and
    the partition is not recognized by OS/2 anymore (assuming 2nd partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log recover
      part 2
      fs JFS
      fixboot
_______________________________________________________________________________

 6) Recover a 'lost' HPFS partition where the bootsector is damaged and
    the partition is not recognized by OS/2 anymore (assuming 1st partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log recboot
      part 1
      fs HPFS
      fixboot
_______________________________________________________________________________

 7) Recover a 'lost' or damaged HPFS spareblock (sector 11) when the
    partition is not recognized by OS/2 anymore (assuming 1st partition):

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      log reCSpare
      part 1
      fs HPFS
      findcp
      fixspare

    Note: with a damaged spareblock you can get various error messages from
          OS/2 about codepages or other things. However when starting DFSee
          and selecting the partition it will tell the spareblock is damaged.
_______________________________________________________________________________

 8) Save and restore (parts of) a disk or volume

    The "sim" command can be used to save a complete disk, including partition
    information to one (very large!) file on a different (network) drive.
    To save the entire unit (opened disk/partition or volume) use:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      sim img-name 0 $

    It can be restored using the "wrim" command, but will only work perfectly
    if the destination disk has the same geometry as the source disk.
    ('heads' and 'sectors' the same like "255, 63", cylinders same or larger).
    This can be used to clone one workstation to multiple machines.
    Note:From DFS version 4.14 this can be done more easily using CLONE cmd

    It can also be very useful to save a single sector (like the bootsector)
    when you are experimenting with the filesystem.

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 04                           ;select the partition
      sim bootsecX 0 1                  ;save bootsector to file bootsecX.img
_______________________________________________________________________________

 9) Create a trace-logfile to allow analysis of DFSee internal problems

    This is to allow analysis of traps or other unexpected behaviour by DFSee
    and will create a possibly LARGE logfile containing functional trace
    information on what DFSee is doing.

    There are three ways to create such a trace, the simplest one will start
    functional tracing right from the start and might create a HUGE file:


    Command                             Explanation

    DFS  -111                           ;Start DFS with trace to DFS-111.log
      ...                               ;execute any DFSee command that
                                        ;shows the problem being analysed

    As an alternative, you can start DFSee with a regular logfile, and
    start the functional-trace later in the scenario. This reduces the
    size of the resulting logfile.


    Command                             Explanation

    DFS  -l:problem1                    ;Start DFS with trace to problem1.log
      ...                               ;execute any DFSee command that
      ...                               ;leads towards the problem
      trace -t 100                      ;start trace with timestamps
      ...                               ;execute the 'problematic' command(s)


    Finally you can start DFSee without any logging, and just before the
    problematic command start functional-trace to a specified logfile:


    Command                             Explanation

    DFS                                 ;Start DFS
      ...                               ;execute any DFSee command that
      ...                               ;leads towards the problem
      trace -t problem2                 ;start trace to problem2.log
      ...                               ;execute the 'problematic' command(s)


    In all cases, zip the resulting logfile(s) and send with a description of the
    problematic DFSee behaviour (hang, trap, crash ...) to:

        support@dfsee.com
_______________________________________________________________________________

10) Undelete a file on HPFS or NTFS; Find the files using:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      delfind                           ;find ALL deleted files
      export   undel01                  ;save found fnode info to a file
      delshow                           ;optionally list them (ALL !)
      delshow  *test*%100               ;or just a selection, here only 100%
                                        ;recoverable with 'test' in the name

    Use "recover" command to copy the deleted files to a directory, see (11)
_______________________________________________________________________________

11) Recover a selection of the found "undeletable" files (NTFS or HPFS)

    First find the possibly deleted files using DELFIND, see (9)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      import   undel01                  ;restore found info from file
      delshow  *inst*                   ;list files with 'inst' in the name
      recover  X:\undel  *inst*         ;recover same ones to X:\undel\  dir

    Notes: - It's best to use a different drive to avoid overwriting

           - The wildcard used on 'delshow' and 'recover' can contain
             multiple wildcard characters, and deals with the FULL PATH and
             filename, so you can include (parts of) the directory too.

           - You can also undelete a single file using the 'saveto' command
             and specifying the files sequence number: .NNNNN shown at the
             left of the 'list' output.
_______________________________________________________________________________

12) Update the HPFS bad sector list with the results of a DFS scan

    Find all sectors that are unreadable:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      scan                              ;find unreadable sectors
      export b badguys                  ;save in an ASCII file badguys.lsn

    Now replace the internal bad sector list with the new modified one:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      import b badguys                  ;get the bad sector list from file
      fixbs                             ;and insert in HPFS badsector list


    Notes: - You can do this in one step too, no need to export/import
_______________________________________________________________________________

13) Show all detected anomalies in the SLT (like allocation errors)
    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part  nn                          ;select a partition
      check                             ;build SLT and report all errors
_______________________________________________________________________________

14) Display the FAT for a diskette in drive A:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      vol a
      fatshow
_______________________________________________________________________________

15) Display the FAT Root directory for partition C:
    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part C                            ; select the partition
      d                                 ; next is bootsector
      d                                 ; next is root directory
_______________________________________________________________________________

16) Save the master boot record (MBR) on a different PC connected with a
    parallel laplink cable and running the LPT tool:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      disk 1
      sim [lpt.exe]d:\images\mbr.img 0 1
_______________________________________________________________________________

17) Restore the master boot sector from a different PC connected with LPT:

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      disk 1
      wrim [lpt.exe]d:\images\mbr.img 0 1
_______________________________________________________________________________

18) Resolve original name of OS/2 HPFS FILExxxx.CHK files (created by CHKDSK)

    When CHKDSK recovers files it will place them in a FOUND.xxx directory in
    the root directory. This directory contains one or more recovered files
    with names like FILE0001.CHK
    The original name of the file is still in the Fnode, it can be shown
    using the following DFSee HPFS commands (assuming partition 03) :

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 03                           ;Select partition 'id' (must be HPFS)
      \found.000\file0001.chk           ;Search and display Fnode for .CHK

    Now 15 characters of the original name are shown as "Fnode Name String"


    Note: This will only work with the older CHKDSK versions, the newer ones
          create a binary CHKDSK.LOG in the root directory of the checked
          drive, and use a different naming scheme where the original name
          is reflected already. It is NOT in the FNODE anymore.
          To read the CHKDSK.LOG use the PMCHKLOG.EXE program that is supplied
          by IBM (and documented somewhat with the Warp-4 fixpack 8 readme)
          Last time I looked (May 2003) it was still available at:

             ftp://service.boulder.ibm.com/ps/products/os2/fixes/chklogpk.exe

          This is a self extracting file with all needed files.
          This really should have been part of the OS distribution by now!
_______________________________________________________________________________

19) Show freespace areas (HPFS, FAT, NTFS)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      slt $
_______________________________________________________________________________

20) Automatically FDISK a workstation using a batch file or command file like:

    echo DFSee FDISK generic workstation >  dfsfdisk.log
    dfsdos -b newmbr                 1  clean
    dfsdos -b create primary bmgr
    dfsdos -b startable 1
    dfsdos -b create logical fat  6  1  -1,c MAINT
    dfsdos -b create primary hpfs *  1  +0   WARP

    This will create a disk with boot manager (image prepared with DFSIBMGR),
    a small maintenance partition at the end of the disk minus 1 cylinder
    and a primary partition filling the rest of the disk.

    Note: This can be done using a native DFSee script (like makepart.dfs)
          too and this will perform much quicker when run from a diskette
          because the executable file only gets loaded once.
          See item 46 for an example.
_______________________________________________________________________________

21) Automatically FDISK a server machine using a batch file or command file like:

    echo DFSee FDISK RAID  server          >  dfsfdisk.log
    dfsdos -b newmbr                   *  clean
    dfsdos -b create primary bmgr
    dfsdos -b startable 1
    dfsdos -b create primary hpfs 300  1  0  SYSTEM
    dfsdos -b create logical fat  200  1
    dfsdos -b create logical hpfs *    1  0  RESTORE
    dfsdos -b create logical hpfs *    2
    dfsdos -b create logical fat  *    3
    dfsdos -b setboot 0:SYSTEM
    dfsdos -b setboot m:advanced
_______________________________________________________________________________

22) Make a clean master boot record, getting rid of all old partitions

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      newmbr 1 clean                    ;Create fresh MBR on disk 1 with
                                        ;clean, empty partition table
_______________________________________________________________________________

23) Restore saved backup of all the important partition sectors from a file

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      prestore * a:\dfspsave

    Each of the available *.PDn files will be restored to the same disk
    it was created from. All saved sectors will be restored and, when
    not using batch mode, the user will be prompted for each of them
    allowing a more selective restore.
_______________________________________________________________________________

24) Restore PSAVE file of one disk, to a different one, clone partition tables

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      prestore 3 a:\dfspsave.pd1

    Assuming a PSAVE has been run with at least one disk present, the file
    dfspsave.pd1 will contain all important partition sectors for disk 1.
    This will be restored to the specified disknumber 3.
_______________________________________________________________________________

25) Create a detailed overview of all your disks and partitions in a text file

    Command                             Explanation

    DFS  -l:diskpart                    ;Start DFS and open a logfile
      part -V -a

    This can also be run directly from the command line, as in:

    DFS.EXE  -l:diskpart  -Q  part -V -a
_______________________________________________________________________________

26) Clone a physical disk to another (identical) one, including all data

    Command                             Explanation

    DFS  -l:dskclone                    ;Start DFS and open a logfile
      disk   2                          ;select/open the TARGET disk
      clone  -d:1                       ;clone disk-1 to disk-2

    This can also be run directly from the command line (batch mode!), using:

    DFS.EXE  -l:dskclone  -b  -Q  disk 2#clone -d:1
_______________________________________________________________________________

27) Clone partition from another partition (data only, no partition table)

    Command                             Explanation

    DFS  -l:pclone                      ;Start DFS and open a logfile
      part  7                           ;select/open the TARGET partition
      clone  -p:1                       ;clone part-1 to part-7


    This could be used to clone the BMGR to another disk, including all
    code and configuration data.
_______________________________________________________________________________

28) Resize (truncate) the first partition, making 500 MiB available

    Command                             Explanation

    DFS  -l:truncate                    ;Start DFS and open a logfile
      part  1                           ;select/open the partition
      resize -f:500                     ;truncate to current size minus 500MiB
_______________________________________________________________________________

29) Create an imagefile for a partition, using CLONE instead of SIM

    Step 1: Create a dummy image file at the destination
    Stap 2: Open the created dummy and CLONE an existing partition to it

    echo dummy > v:\part05_backup.img
    DFS  -l:imgclone
      im  v:\part05_backup.img
      clone  -p:05
      q

    Note: The resulting image will be as large as the partition!
          In real life, SIM is the better alternative.
_______________________________________________________________________________

30) Expand an HPFS partition using DFSee and CHKDSK (updated for 4.28)

    While testing the TRUNCATE command for HPFS, where CHKDSK is needed to
    fixup the allocation bitmaps, I found that it also works the other way!

    a) Make some freespace AFTER your HPFS partition (using DFSee delete)
    b) Wipe this freespace to all binary zeroes (to avoid garbage info)
    c) Delete the HPFS partition, and create it again in the same place
       but with a larger size. (using the freespace from step a)
    d) Use the 'RESIZE -m' command to update the HPFS internal size info
    e) Reboot, to allow OS/2 to notice the changed partition and LVM info
    f) Run CHKDSK on the partition, this will expand the allocation bitmaps
       to use the whole new partition size for the HPFS filesystem.

    When the partition has been accessed, it is better to execute the steps
    (c) and (d) from a bootable DOS diskette using DFSDOS. Otherwise you might
    get problems (traps) while shutting down OS/2 for the reboot.
    This is caused by out of date information in several caches.

    As an alternative for testing with minimal risk, you could create a new
    (larger) partition and CLONE the smaller one to that location.
    The scenario for that (and as I used it) is:

    a) Make a new partition, larger than the current one at different location
    b) Wipe this new partition to all binary zeroes (to avoid garbage info)
    c) Reboot, to allow OS/2 to notice the changed partition and LVM info
    d) For LVM systems, create a new volume "from existing partition"
    e) Clone the source HPFS partition to this new, larger, location
    f) Use the 'RESIZE -m' command to update the HPFS internal size info
    g) Run CHKDSK on the partition, this will expand the allocation bitmaps
       to use the whole new partition size for the HPFS filesystem.

       Note that the reboot/LVM step has been moved to an earlier stage here
       to avoid any risk of clearing the bootsector. (by LVM.EXE)


    Note: I am not sure if there is a limit to how much you can expand your
          HPFS partition. All experiences and info on that is welcome!
          My largest test was expanding a 2000 MiB eComStation bootable
          partition to a new size of 3500 MiB, the result was a working
          HPFS partition!
_______________________________________________________________________________

31) Using a DOS boot diskette for DFSDOS.EXE

    5.XX TIP:  Do NOT USE EMM386 in combination with DFSDOS version 5.xx,
               as this is known to cause stability problems on some cases
               like a solid hang on startup of DFSDOS.EXE.

    4.XX TIP:  Create a boot diskette using a memory manager such as EMM386
               to make well over 600 KiB of memory available.
    NOTE:      only needed for DFSDOS version 4.xx !!!
               version 5.xx runs in 200 KiB free ...
_______________________________________________________________________________

32) Change the filename in an HPFS directory and Fnode

    This is sometimes needed to get rid of a file that has 'illegal'
    characters in the name like '>' or other strange characters
    created in a different codepage.

    High-level:

    a) Find the FNODE for the file       ('find' command or '\path+filename')
    b) Update Shortname if needed        ('H .' + 'edit' command)
    c) Check and write back              ('show' + 'write' command)
    d) Find related directory block      ('u' + 'd' command)
    e) Find the long-filename in there   ( 'H . ' + some 'd' commands)
    f) Edit the long-filename in there   ('edit' command)
    g) Check and write back              ('show' + 'write' command)

    Low-level: change '\tmp\filename.bad' to 'filename.txt'

    DFS.EXE
      part  03
      \tmp\filename.bad
      h  .
      edit  -p:16  -a:"txt"
      show
      write  .
      u
      d                         ;display the DIR-block
                                ;if BTree pointers are listed, select
                                ;the right block using a ".nnn" cmd
                                ;Note the alphabetic ordering of names
      H  .                      ;Display first of possible 4 sectors
      d                         ;use "d" or <Enter> until the sector
      d                         ;with the filename in it is found
      edit  -p:0xa4  -a:"txt"
      show
      write  .
      q
_______________________________________________________________________________

33) Reboot to a different operating system partition (IBM BootManager installed)

    OS/2 or eComStation installations with IBM BootManager installed can use
    the standard SETBOOT.EXE program to reboot to any bootable partition.

    You can do the same using the DFSee program. Added benefit is that you
    can use it from a Windows partition as well (to boot back to OS/2) and
    that you can have an extra confirmation step if you like.


    Example to boot from eComStation to an XP partition called "WinXP":

    Create a new program object by locating any existing program icon,
    right-click and select "Create another -> Program" and fill in:

    Path and filename:   H:\T\DFSOS2.EXE
    Parameters:          -w+ setboot -i:WinXP
    Working Directory:   h:\t

    Session type should be "OS/2 Window" (or "eCS Window") type of program.
    For the icon you can use DFS.ICO or DFSEE.ICO from the distribution ZIP
    file, or any other icon you like.

    As setup like this ("-w+") it will ask for a confirmation (are you sure)
    If you want to skip that too, just add the "-B" switch to the parameters
    and specify to start the program "minimized".


    Example to boot back to "eComStation" from the XP partition:

    In Windows (NT, W2K, XP) just create a 'shortcut' to the DFSWIN.EXE program
    and specify the right parameters, example: "-w+ setboot -i:eComStation"


    For Windows-9x you can do the same using DFSLDOS.EXE, however that also
    requires the Windows-9x reboot program DFSDOSX.EXE to be present, this
    will perform a regular Windows shutdown and reboot after the right
    IBM BootManager info has been set to boot into the wanted partition.

    Note that DFSLDOS does NOT support a windowed user interface so any "-w+"
    option will be ignored, and the confirmation is a simple text message.

    From a command line the reboot is initiated (without confirmation) using:

           DFSLDOS  -B setboot  -i:eComStation

    To create a shortcut on the Desktop that does the same (with confirmation):

    Right-click on the Desktop, select "New->Shortcut"
    In "Command line" field: "c:\tools\dfsldos.exe setboot -i:eComStation"
    Use [Next] to select a Name, then an Icon and [Finish] ...

    Make sure DFSLDOS.EXE and DFSDOSX.EXE are in the specified directory.

    DFSLDOS.EXE is in a separate download from the DFSee website, and will
    not be maintained. The latest available version is 5.04
_______________________________________________________________________________

34) Copy files from a damaged or inaccessible NTFS, HPFS or FAT partition

    Sometimes you lose access to NTFS files because of some kind of crash,
    a failed update or whatever.  DFSee is often still capable of finding
    files within the NTFS filesystem and copy them to another disk.

    This can be very useful to save a few very important files before
    reinstalling or trying other recovery methods.


    DFS.EXE  -l:myproj
      part  02
      filefind  .java
      list -f   *myproj*
      recover   a: *myproj*
      q

    This will first find all filenames containing ".java" in their name
    on partition number 2 (must be NTFS, HPFS or FAT) and then list all
    those that also have "myproj" somewhere in the full path specification.
    Finally the same files as displayed by list are recovered by copying
    them to the diskette in A:

    The 'recover' could use a more specific wildcard, like *myproj*dialogs*
    based on your judgement of the "list -f" output.
    You can also recover them in several groups to make the files fit on
    more than one diskette ...

    Make sure the diskette has enough space to hold all the files to recover,
    a disk full situation will cause an ungraceful failure!

    Of course you can recover to any volume (driveletter, path) that you have
    access to when running DFSee. It could be another disk-partition or a
    network drive or whatever ...
_______________________________________________________________________________

35) Copy files from a damaged or inaccessible HPFS or FAT partition (DIRFIND)

    This is an alternative to scenario (34) that works on HPFS and FAT and
    could be a lot faster too because it searches the directory structures
    instead of the entire partition. It uses DIRFIND instead of FILEFIND.

    DFS.EXE  -l:myimages
      part  15
      dirfind  s  \  -l:*.jpg
      recover d:\images *.jpg
      q

    This will first find, then list and finally recover ALL .JPG files
    from partition 15 to the directory 'D:\images\' on driveletter D:
    Any paths (subdirectories) from the source partition 15 will be
    preserved when possible, or be replaced by unique numbers.

    Note: This requires DFSee version 4.27 or later.
_______________________________________________________________________________

36) Show (only) the disk geometry or MBR-identification for all disks

    Some recently added options of the 'PART' command can be used to
    display the disk geometry for all disks, without showing any warnings
    or the complete table.

    part  -g  -w- -t-

    -g     = read disks (refresh) and show geo
    -w-    = do NOT show any warnings
    -t-    = do NOT show the partition table display

    So, from the command line, to display it and directly quit again:

    DFS.EXE  -Q  part -g -w- -t-

    That will display the geo and automatically quit.
    Or if you want it in a logfile:

    DFS.EXE  -l:geometry  -Q  part -g -w- -t-

    Will put it in 'geometry.log'

    Another new option will include a one line description of the boot code
    found in the MBR for each disk:

    part  -m  -w- -t-

    -m     = read disks (refresh) show geo AND show MBR description
    -w-    = do NOT show any warnings
    -t-    = do NOT show the partition table display


    So, from the command line, to display it and directly quit again:

    DFS.EXE  -Q  part -m -w- -t-
_______________________________________________________________________________

37) Expand an NTFS partition using DFSee and Windows 'check' (updated for 4.28)

    The scenario listed in (30) for HPFS works for NTFS as well, with some
    minor changes due to the 'other operating system' involved.
    Actually it is even easier because I found that an explicit 'check'
    operation is often not needed because Windows (XP) will do that at
    startup automatically.

    WARNING: Do NOT resize the NTFS partition you are booted from!
             I strongly advise to use the OS/2 version, or the DOS version
             DFSDOS.EXE from a DOS boot diskette (requires 700 KiB free mem)

    a) Make some freespace AFTER your NTFS partition (using DFSee delete)
    b) Wipe this freespace to all binary zeroes (to avoid garbage info)
    c) Delete the NTFS partition, and create it again in the same place
       but with a larger size. (using the freespace from step a)
    c2 On an LVM system, use the 'LVM' command to update the recorded size
    d) Use the 'RESIZE -m' command to update the NTFS internal size info
    e) Reboot to Windows (tested with XP, but NT and and W2K should be OK too)
    f) Run the 'check' option on the partition in the 'disk management' tool.
       I found that this step was not really needed, but it can't hurt and
       you can see if the partition is healthy after the resize.

    Of course the alternative as outlined in scenario (30) with using a newly
    created partition and CLONE works too, it is just a different way to get
    that larger partition table entry for the filesystem to be resized.

    Note: I am not sure if there is a limit to how much you can expand your
          NTFS partition. I have tested a 4GiB NTFS data partition, and resized
          that succesfully to 6GiB. The resulting filesystem was accessible by
          the XP operating system. I will run another test expanding a bootable
          Windows-XP that is now 3.5GiB to take up 6GiB ...

          Update 30-07-2002: Resize of a bootable Windows-XP fails, maybe
          because it detects a different size at startup, and decides that
          this is a 'different' computer so the registration is not valid.

          Resizing back to the smaller size often does NOT work because the
          allocation information is incorrect for the larger size, and the
          whole area is considered to be 'in use'. So you have to prepare for
          this by making an image or clone backup first, and restore that.
_______________________________________________________________________________

38) Show detailed information from .PDn file saved with PSAVE

    Although a lot of useful information from the files saved with PSAVE can
    be shown just by typing them (like 'type mysystem.pd1') sometimes you need
    to see exactly what is inside, before restoring with PRESTORE.
    This can be done by restoring it to a VIRTUAL disk inside DFSee, and use
    the normal available display commands on that.


    DFS.EXE
      virtual mysystem.pd1                      ; make disk just like the PD1
      map     -d                                ; show current disk as a map
      q

    Actually you can use any of the display commands to view that disk like
    PART, MAP, DISK, WALK, PL etc., but remember that the ONLY sectors present
    are the partition tables, LVM-info and bootsectors.
    So selecting a partition and looking inside will probably result in errors.

    This is also a good way for experimenting with DFSDISK results. Creating
    a VIRTUAL disk from one of the DFSDISK.PDx files is a great starting
    point for recovery tests without risking damaging your real disk.
_______________________________________________________________________________

39) Show (minor) differences between (cloned, HPFS) partitions using COMP

    As an example for using the compare command I will show you how to use that
    combined with a few LIST commands to show difference between two HPFS
    partitions, clones made a few days apart. The original is an eCS
    boot partition that has been used for a few days after the first cloning.

    DFS.EXE -l:compeCS
      part  15                                  ; select first clone
      comp  -p:19  -list                        ; compare to other, create list
      list  +f
      list  +fi
      q

    There was 2.5 MiB worth of differences, but removing all the lines with
    'unidentified data' from the list output reduces that to just a few files.

    Changes between the two are updates to config.sys, replaced kernel and
    the DANI drivers. Rest listed are dynamic often changed files ...

    ========= Example output (edited logfile) for this scenario =============

      DFSee-OS2 version : 5.00 executing: comp -p:19 -l

      Compare area from :
      alternate Store 2 : Partition (part)  19 = '  '    mode = HPFS
      TO current  store :
      DEFAULT = Store 1 : Partition (part)  15 = '  '    mode = HPFS

      Sectors to handle : 003E8200 =    2000 MiB to start sect: 00000000

      Compare to area on: same disk, buffer  8064 sect = 4032 KiB
      First sector todo : 00000000
      Progress  4 MiB/. : 00000000  .......................................
      1920 MiB+ 4 MiB/. : 003BEC80  .....................
      Last sector done  : 003E81FF size 003E8200 =    2000 MiB
      Elapsed time is   : 152 seconds, throughput 13.16 MiB/sec

      Different sectors : 000012E1 =    2417 KiB

      The compared areas are NOT identical

      DFSee-OS2 version : 5.00 executing: list -f (and -f:i, combined in log)

      .00006 = 0003012E : f 100% 1024   B \IBMCOM\LANTRAN.LOG
      .00007 = 0003012F : f 100% 2048 KiB \os2\system\SWAPPER.DAT
      .00010 = 00092D3D : z 100%  255 KiB \os2\OS2SYS.###
      .00012 = 00092D7A : z 100%  512   B \IBMLAN\LSSHARE.###
      .00014 = 000938C3 : f 100%  915 KiB \os2krnl.dbg
      .00016 = 00093A19 : z 100% 1024   B \os2\eCSClock\ALARM.###
      .00017 = 00093A58 : f 100%   67 KiB \os2\boot\DaniS506.ADD
      .00018 = 00093A59 : f 100%   26 KiB \os2\boot\DaniATAP.FLT
      .00019 = 00093A79 : z 100%  512   B \mptn\ETC\TCPOS2.###
      .00020 = 000A295E : f 100%   12 KiB \IBMLAN\LOGS\NET.AUD
      .00027 = 000AC6EA : f 100%  830 KiB \os2krnl
      .00052 = 000AC9AF : z  50% 1024   B \os2\eCSClock\ALARM.###
      .00053 = 000AC9B0 : f 100%  512   B \mptn\ETC\TCPOS2.INI
      .00054 = 000AC9B1 : z 100% 1024   B \os2\eCSClock\ALARM.###
      .00055 = 000AC9B2 : f 100%  512   B \IBMLAN\LSSHARE.INI
      .00060 = 000AD253 : f 100% 1024   B \os2\eCSClock\ALARM.LST
      .00061 = 000AD254 : z 100%    0   B \os2\OS2.!!!
      .00062 = 000AD255 : z 100%    0   B \os2\OS2SYS.!!!
      .04525 = 000B0B6B : z 100% 1152 KiB \os2\OS2.###
      .04526 = 000B71D8 : f 100% 1152 KiB \os2\OS2.INI
      .04527 = 000CB3CA : f 100%  255 KiB \os2\OS2SYS.INI
      .04528 = 000D68B7 : f 100%   35 KiB \POPUPLOG.OS2
      .04638 = 001F07A4 : D 100% 2048   B \Desktop\
      .04639 = 001F07A5 : D 100% 2048   B \Nowhere\
      .04644 = 001F08F9 : f 100%    9 KiB \Config.Sys

    ========= End     output (edited logfile) for this scenario =============
_______________________________________________________________________________

40) SETBOOT to other partition, changing LVM driveletters too (2 C: drives)

    On a system with two LVM-aware operating systems installed, both with
    assigned instead of calculated drive-letters it is not possible to have
    two separate C: drives, one visible, the other hidden, and switch between
    them using IBM BootManager (as often used before LVM)."

    It IS possible however, to assign the driveletter C: to the partition you
    want to boot to, after removing it from the current one and then reboot to
    that new C: drive using a SETBOOT.

    This can be automated in a single DFSee command (a so called multi-command)

    As an example, assume there are 3 primary partitions:
    1  IBM BootManager
    2  eCS-test partition, also installed as C:
    3  eCS-GA, installed as primary C:

    The command to switch from eCS-GA to the eCS-test would be:

    DFS -w+ -Q lvm -B 3 -l- #lvm -B 2 -l:C #setboot -i:C


    And to switch back from eCS-test to the eCS-GA:

    DFS -w+ -Q lvm -B 2 -l- #lvm -B 3 -l:C #setboot -i:C


    In the example, the LVM will be executed without questions asked, and
    the setboot will ask a confirmation first. Note that if you decide NOT to
    boot at this point, that the C: driveletter has changed!
    This might cause problems with LVM or other disk-tooling.

    An example to switch without any questions asked:

    DFS -b -Q lvm 2 -l- #lvm 3 -l:C #setboot -i:C

    These commands can easily be put in a small batch file (.CMD) or even
    into the 'parameters' field of a program object on the Desktop.
_______________________________________________________________________________

41) Display contents of a .PDx file (from PSAVE) as a DFS table (and map)

    dfs virtual -B dfsdiski.pd1
    dfs virtual -B dfsdiski.pd1#map -d

    These commands return to the operating system command line, to stay
    within DFSee for further displays, use:

    dfs -Q- virtual -B dfsdiski.pd1
_______________________________________________________________________________

42) Convert all partitions of a system to LVM-volumes, no questions asked

    dfs -b vcu
_______________________________________________________________________________

43) Convert any new partitions to volumes, but keep existing ones the same

    dfs -b lvm * -V
_______________________________________________________________________________

44) Examine (and possibly change) all LVM related values for the volumes
    using an interactive dialog window. (can also be started with <F8>)

    dfs
      lvm
      q

    To run this directly from the OS command line, and quit the DFSee
    executable after the last volume is handled, use:

    dfs -w lvm

    Note: You can either use the <Enter> key or the <PgUp> and <PgDn> keys
          in the dialog windows to get to the next (or previous) volume.
          Once the last volume has been done, the LVM dialog is ended.
_______________________________________________________________________________

45) Put ALL existing volumes on the IBM BootManager menu, with dialog window
    and confirmation for each one (allowing more manual changes)

    dfs
      lvm * -menu
      q
_______________________________________________________________________________

46) Use a native DFSee script to partition a new system (also see 20 & 21)
    In this case a BootManager image is installed as well, and this requires
    the file DFSIBMGR.IMG to be present. (created with DFSIBMGR cmd).
    It will also create the needed LVM-info on the fly using the new
    -L option for the create command and the new "LVM" functionality.

    dfs run makepart wsname

    This will be an 'interactive' run where you will be prompted for
    confirmations for each command, and can change any values using
    the LVM dialog as well. For an unattended run (no questions) use:

    dfs -b run makepart wsname

    In both cases the 'makepart.dfs' file contains:

    ;----------- start of script
    ;Workstation partitioning: BMGR, OS2, MAINT and Data partitions
    ;
    log ws$1
    ;
    newmbr 1 clean
    cr  pri  bmgr  1     -d:1  -L:"-D -V"
    cr  pri  hpfs  800   -d:1  -L:"-D -v:'OS2'   -l:C -menu"
    cr  log  hpfs  100   -d:1  -L:"-D -v:'MAINT' -l:M -menu"
    cr  log  hpfs        -d:1  -L:"-D -v:'DATA'  -l:D"
    startable 1
    ;
    part -r
    ;----------- end of script
_______________________________________________________________________________

47) Perform a CHECK on all partitions, creating a check.log file

    dfs -l:check part -c
_______________________________________________________________________________

48) Convert partitions to volumes, using industry-standard drive-letter
    assignments. This is useful if the boot OS is DOS and HPFS, FAT32
    or NTFS partitions need to be assigned driveletters too.
    In this example a logfile 'convert.log' will be created too, and the
    processing will be 'silent' (no output to the screen).

    dfsdos -b -q -Q -l:convert part -i#vcu
_______________________________________________________________________________

49) Delete a file from an NTFS filesystem that the normal NT/W2K/XP
    programs cannot handle. (possibly due to filename problems)

    This is sometimes needed to get rid of a file that has 'illegal'
    characters in the name or has an extreme long filename.

    High-level:

    a) Select the NTFS volume in question based on drive-letter     (VOL)
    b) Search for the file, using (part of) the filename       (FILEFIND)
    c) Select the right one and show file-details as double-check  (.NNN)
    d) Clear the 'MFT-record' for this file                        (WIPE)

    e) Have Windows perform a CHKDSK to update the directory information
       and allocation for the file. This will release the used space for
       the file and remove the name from the directory it was in.


    As an example, when the filename contains the unique "bad-bad file" and
    there is only one such file on volume G:, the following

    // to be refined ...

    DFSWIN.EXE  -l:delfile
      vol  g
      filefind "very-badguy"                ;find the files
      .0                                    ;select the right one  (or only)
      wipe  z . 2                           ;wipe MFT record clean (note . !)
      q

    Take good care with the WIPE command syntax, it has THREE parameters
    the second is a DOT and the third is the number TWO.


    When this is finished, the command:

    CHKDSK  G:  /f

    should be run from a command prompt. Make sure the volume (here G:) is not
    in use at that time by any program or the CHKDSK will complain ...
    In the output, you are likely to see references to the filename of the file
    you are removing since the directory entry will be removed, and you should
    also see some space being recovered for the file's data area.
_______________________________________________________________________________

50) Correct "does not start on cylinder boundary" error for the first primary
    partition on a disk that has been moved from the first cylinder to make
    space for something else. Partition-Magic will NOT align it properly in
    this case. It will stay aligned on head 1, sect 1 while it should be at
    head 0, sect 1. We need to move the whole partition towards the beginning
    of the disk, over one track distance (1 track, usually 63 sectors = 0x3f).

    As an example, to realign a 3000 MiB FAT32 partition that is PID 2 now:

    DFSDOS.EXE  -l:align
      delete 2                          ;delete current partition table entry
      cr pri fat32  size                ;create it again, aligned
      part 2                            ;select the recreated partition
      clone  -p:2  -f:1,h  -!-          ;move by cloning, over 1 track (head)
                                        ;bypassing the CLONE dialog

    Note: This correction is mainly cosmetic, there are hardly any tools or
          operating systems that have a real problem with this misalignment.
_______________________________________________________________________________

51) Clone a physically damaged disk to a new one, to allow recovery on that.
    This will cause minimal use of the damaged disk, and allows for a second
    chance if the recovery should fail for some reason. You need an extra disk
    as a destination for the clone, and it needs to be the same size or larger
    to make a complete copy of the original damaged disk.

    To CLONE a physically damaged disk for recovery, the following
    options are recommended for maximum reliability:

    -E:i    to continue cloning after read errors (incl retries)
    -b:1    to force single sectors reads, this is very slow but
            will result in a minimum number of unreadable sectors
            Note: not needed anymore in DFSee version 7.09 and later
                  since these automatically reduce buffer-size when
                  bad-sectors are encountered.

    You might also want to change the number of retries on sector read errors
    from the default of 0 (no retries). To use retries to have a larger chance
    of recovering hard to read sectors after many retries ...
    To change this, you need to use the global -A: switch at startup, example:

    DFSOS2.EXE  -A:3

    Note: there have been a few reports of DFSDOS.EXE hanging after cloning
          many bad sectors using a retries (with -A:5).

    So assuming your damaged disk is placed as the 2nd disk in a system,
    and a new one is available as disk number 3, the cloning would be:


    DFSOS2.EXE  -l:clone2
      disk  3                           ;select DESTINATION disk
      clone  -E:i  -b:1  -d:2           ;clone from DAMAGED disk
      q


    Of course you can use any of the DFSxxx.EXE versions ...

    The resulting logfile could become large if many read errors occur, but
    could be very useful afterwards to check where the bad spots have been.

    Immediately after the cloning has completed, it is advised to change the
    partition types on the new disk to types NOT recognized by the operating
    system, to avoid automatic CHKDSK/SCANDISK operations. If you don't do
    this, recovery might be made very difficult or even impossible ...
    You might even need to do this on the damaged disk too, if still possible.

    Note that unreadable sectors on the destination disk will have
    a content of all 0xFE bytes, easy to recognize as invalid ...
_______________________________________________________________________________

52) Find files on a damaged FAT partition
    Since the FAT filesystem does not have a data structure for each file,
    like NTFS and HPFS do, it is harder to find files. There is a SUBFIND
    command however that will find all sectors that have ".." directory entry
    Together with the (new) -d option on the LIST command (implies -l-) this
    can be used to create a listing of all files in those subdirectories.

    DFSDOS.EXE  -l:fnames
      part 1                            ;select a FAT partition
      subfind                           ;find subdirectory sectors
      list -d                           ;list contents, but keep list.


    The resulting 'fnames.log' can be used to find missing files by name, and
    they can be recovered by redisplaying the directory in question and then
    use the .NNN command plus a SAVETO command to copy the filedata.

    Note:
    On older versions this was impossible because listing a directory
    would destroy the search result list, replacing it with the files
    in the displayed directory.
_______________________________________________________________________________

53) Fix a "WARNING : Logical partition extends beyond EBR extended-container"

    This warning will be given together with the partition ID (PID).


    There are two ways to fix this problem:

    You can change it interactively using the PTE command, type the command:

     PTE   -p:PID

    on the DFSee command line, where PID is the DFSee partition ID for the
    partition (taken from the warning or left column in "part" display).

    Now you will see a display of the partition table for that partition.
    Note the value that it shows (in blue text) in the "end cyl" field.
    The value in yellow on green is the same or exactly 1023. (int13 limited).

    Using the <PgUp> key, you will see the previous partition table, with
    the extended-container for the partition in question.

    On this display it should show the same value for the "end cylinder"
    but in this case it will be LESS (that is what the warning is about).
    If you type the correct value over the displayed value in the input field
    (yellow on green) and <Tab> to the next field, it will be updated.
    The related fields will be updated as well to keep everything consistent.

    If the shown values seem OK, press <Enter> to write the changes to disk.


    The second method is simply deleting the partition with "DELETE PID"
    and create it again using the right type, size and so on ...
    This will recreate it without damaging any data.
_______________________________________________________________________________

54) Make a multiple partition JFS LVM-volume accessible again
    Sometimes LVM information gets damaged by disk-tools or by system crashes.
    For multiple partition JFS volumes, this often results in OS/2 or eCS not
    assigning a drive-letter anymore because the LVM info is not consistent.
    To recover this, you need to update the LVM-information on EACH of the
    involved partitions, making them consistent again.

    The most important requirements for such a volume are:
    - The LVM partition names for each partition in the set must be different
    - The LVM volume name recorded with each one must be exactly equal
    - The assigned drive-letter recorded with each one must be identical

    As an example, if you have a large JFS volume that has 3 partitions
    residing on DFSee partition IDs (PID) 03, 05 and 14, you can create
    consistent LVM information using:


    DFSDOS.EXE  -l:jfsmulti
      lvm  03   -v:"jfs 3 part multi" -p:"disk1-multipart-1"  -l:K
      lvm  05   -v:"jfs 3 part multi" -p:"disk1-multipart-2"  -l:K
      lvm  14   -v:"jfs 3 part multi" -p:"disk2-multipart-3"  -l:K


    Note: Recovering LVM-info this way will only work if the LVM-signature
    sectors and related information, which resides at the END of each
    partition is still intact. If that is damaged too, it will be nearly
    impossible to recover the JFS volume. You might be able to use LVM.EXE
    with a "create from existing partition" selecting each of the partitions
    in turn, but that should be done in the exact same order as originally.
_______________________________________________________________________________

55) Shorten LVM disk-, Volume- and Partition names to 19 positions maximum

    This may be needed when long names have been created using LVM.EXE,
    it can cause display problems with 'lvm /query' and it causes all
    sorts of problems for tools using the LVM-API (like eCS 1.1 install)

    To avoid problems, these names should not have more than 19 characters.
    DFSee will give a warning on the 'PART' command for each disk and
    partition with a name longer than 19 characters.

    To shorten all volume names and partition names for all partitions use:

    lvm  -P-  *                         ;shorten volume+partition names
    lvm  -P-  -n                        ;shorten disk names

    Or, if you want to have the chance to edit the disknames:

    lvm  -n                             ;shorten disk names, with prompt

    To edit the volume and partition names, just start the lvm dialog
    interactively and edit each name as appropriate and use the <PgDn>
    key to get to each partition in turn:

    lvm                                 ;start interactive lvm dialog
_______________________________________________________________________________

56) Create a compact partition listing, suitable for email and newsgroups

    This may be needed when you want to post an overview of the most
    important partition information to a newsgroup or email it.

    Typical DFSee output is 80 characters wide and might contain special
    characters so it easily causes all sorts of formatting problems like
    line-wrapping when displayed or handled by an email or news program.

    The simplest way to get such a list is:

    DFS query

    and to get it into a file:

    DFS query > filename

    or, even better

    DFS -l query

    You can also reduce the output more by leaving out the copyright:

    DFS -B- -l:filename query

    Finally, since the "query" command is just a synonym for "part -C -m"
    you can also add other "part" options to the command, examples:

    DFS query -v                                ;verbose list all partitions
    DFS query -m- -d:2                          ;just disk 2
    DFS query -C- -m-                           ;the standard 'framed' table
    DFS query -t- -m- -w                        ;list warnings only
    DFS query 3                                 ;show partition 3
    DFS query -d:2 1,r                          ;show 1st partition on disk 2


    In all cases, the 'DFS' program can be either DFSDOS, DFSOS2 or DFSWIN
_______________________________________________________________________________

57) Set the default selection on the IBM BootManager menu

    With this you can force the IBM BootManager menu to always come up with the
    specified name/partition being selected, causing that to boot after the
    timeout even if you booted something else the last time.

    DFS.EXE
       setboot  -0:"sysname"          ;to set default selection to "sysname"
       q


    You can also reset it to always default to the 'last booted' system.

    DFS.EXE
       setboot  -0-                   ;to set default to 'last booted'
       q


    You can do it directly from the command line too:

    DFS  setboot  -0-

    Note that the option is a ZERO not the letter O!
_______________________________________________________________________________

58) Updating the boot code in the MBR sector, NEWMBR

    This will replace the boot code called by the BIOS (first disk usually)
    by generic code from DFSee. Doing this will get rid of any unwanted
    code there like boot managers or even worse virii.



    DFS.EXE
       newmbr  1                      ;refresh boot code in MBR on disk 1
       q


    You can also erase ALL partitions by clearing the partition table:

    DFS.EXE
       newmbr  1  -c                  ;refresh code and clean table
       q


    From the DFSee menu you can do the same using:

      Mode=FDISK -> New MBR Code KEEP tables  -> 1 .. select disk

    or, to erase the partition table too:

      Mode=FDISK -> New MBR Code Erase tables -> 1 .. select disk


    That menu entry both REPLACES the boot code called by BIOS to startup
    your system (mostly important for the first disk) and it completely
    erases the partition table in that same MBR sector.

    And although it does not really are the other  partition tables in
    any extended boot records (EBR) for you logical partitions,
    it does make all of those invisible since the reference to them
    in the MBR-table is gone.

    It does NOT erase any LVM or other information though, the command
    is limited to the very first sector on the disk only (MBR).
_______________________________________________________________________________

59) Remove LVM information from existing partition(s)


    You can't completely remove the LVM info from ONE partition
    using DFSee, but there are two methods that come close:

    A) Remove all RELEVANT info from the LVM info for a partition
    This will delete everything that is normally used or displayed for
    an LVM volume. As an example, for partition 06:

            lvm 06  -D  -v-  -p-  -l-  -m-  -i-

    After applying it will NOT be considered a volume anymore.
    However, the LVM sector for the partition will still contain the
    disk name, the partition size, and LVM signature and a valid CRC.
    Using this partition with DFSee, LVM.EXE or LVMGUI would look the
    same as using a freshly created partition without any LVM info.


    B) Remove (erase!) all LVM sectors for a disk

    This will set the LVM-info and LVM-signature sectors to ZERO!

            pclear  ls  -d:n

    Where 'n' is the disk-number or '*' for all disks.

    Both commands are documented in DFSFDISK.TXT.

_______________________________________________________________________________

60) Find and recover a SINGLE deleted file (NTFS or HPFS)

    Command                             Explanation

    DFS                                 ;Start DFS and scan physical disks
      part 01                           ;select the right partition
      delfind  document                 ;find file with 'document' in name
      delshow  *document*               ;optional check, list files ...
      recover  x:\tmp                   ;recover all files to X:\tmp\  dir

    When there are more than one file listed, you can use a selection
    wildcard on the recover as well, as in:


      recover  x:\tmp *mydoc*           ;recover only files matching 'mydoc'


    Notes: - It's best to use a different drive to avoid overwriting

           - The wildcard used on 'delshow' and 'recover' can contain
             multiple wildcard characters, and deals with the FULL PATH and
             filename, so you can include (parts of) the directory too.

           - You can also undelete a single file using the 'saveto' command
             and specifying the files sequence number: .NNNNN shown at the
             left of the 'list' output.
_______________________________________________________________________________

61) Create a compressed backup of a RAW imagefile (like SVISTA .HDD)


    Command                             Explanation

    DFS  -d-                            ;start DFS, no physical disk scan
      sim  -I"warp4.hdd"                ;open RAW, create compressed image


    A faster way to do that fom the OS2 commandline using dialogs is:

      dfs -d- sim -I:"warp4.hdd"


    Or fully automated, no questions asked:

      dfs -d- -b -Q sim warp4 -z -m:620,m -I:"warp4.hdd"


    This would create multiple files, conveniently sized for backup to CDROM.

_______________________________________________________________________________

62) Restore a compressed backup to a RAW imagefile (like SVISTA .HDD)


    Command                             Explanation

    echo whatever > warp4.hdd
                                        ;create (nearly) empty file
    DFS  -d-                            ;start DFS, no physical disk scan
      im    warp4.hdd                   ;open nearly empty image
      base  0  0ffffffff                ;allow any size
      wrim  warp4.imz                   ;restore compressed one



    Note:
    There will be a quicker compound command like 'UNPACK' to automate
    that in one of the upcoming 7.xx minor releases

_______________________________________________________________________________

63) Edit a filename in a JFS directory structure, using thye HEX-editor

It is not very easy, but doable.
The way it works is navigate from the root directory towards
the offending filename, using DFSee display commands
and each time selecting the next level by using a '.NNN'
command to pick a specific entry (file/directory).

When the directory containing the incorrect filename is shown
you start the HEX-editor on the directory structure. (use <F2>)
and carefully edit the offending filename.

You must be aware that this are BTREE structures, so finding
any filename depends on the sort-order. This means you should
NOT change the alphabetic sort order of the entries, which may
happen easily when changing the first letter in a filename ...

If you DO happen to change the order, the file will still NOT be
accessible later (although it will probably not trap either).
It might be removed by CHKDSK in that case ...


The easiest way to get to the correct directory is using the DFSee
commandline that you get to using <F10> from the menu.

I will show an example below, to navigate to the file:

 j:\toolkit\h\pmwp.h

That is on a JFS partition of mine.
I will show each command to be entered to get there,
and (part of) the screen output that generates ...

You start with a command to select the partition, followed by
a few <Enter>'s to get to the ROOT directory display:

        DFS
         part 13
         <Enter>
         <Enter>
         <Enter>

Eventually resulting in a display like this:

++++++++++
DFSee  OS/2  8.14 : Executing: <Enter>
<snip>
FAT style Attrib. :      D                    Inode Links :
Parent   Inode nr : 0x00000002
1st link Filename :
Filename fullpath : \
File size (exact) : 0x00001000 =       4096
<snip>
Description for a : Directory    Btree Root + Internal nodes

 Nr  Page LSN  Block-nr  Split-point name (abbreviation)
 === ======== ========== ===============================
.000 00029F18 0x000053e3
++++++++++

The last line is the link to the real contents of the directory.
For a directory with many files there may be more than one
line, each with its own '.NNN. number (see later example).

So now we select that one link:

          .0

And get a complete directory listed:

+++++++++++++
DFSee  OS/2  8.14 : Executing: .0
CRC=96fb7246; LSN : 0x00029F18 = Dir  Btree+  Page Cyl 6119 H: 87 S:
<snip>
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
 === ======== =================== ==== =================== ========
.000Ú00B40008 07-12-2002 20:36:56 A                            4096
 ÄÄÄÁ                             D770 @home
.001Ú00B62E83 08-04-2007 11:10:20      08-04-2007 11:10:27      256
 ÄÄÄÁ                             D770 @info
<snip>
.013Ú00952988 11-09-2002 12:55:18 A    02-03-2007 16:58:50     8192
 ÄÄÄÁ                             D770 pkg
.014Ú00AC8E40 11-09-2002 13:08:46 A                            4096
 ÄÄÄÁ                             D770 toolkit
.015Ú00AF85E0 11-09-2002 13:09:26 A                            4096
 ÄÄÄÁ                             D770 toolkt13
<snip>
 === ======== =================== ==== =================== ========
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
+++++++++++++

So we see our directory 'toolkit' listed as number .014

Selecting that, using:

          .14

Results in the next level dirctory INODE:

+++++++++++++
DFSee  OS/2  8.14 : Executing: .14
CRC=f6eaef7e; LSN : 0x00AC8E40 = Directory   Inode Cyl 6855
<snip>
Description for a : Directory    Btree Root + Internal nodes

 Nr  Page LSN  Block-nr  Split-point name (abbreviation)
 === ======== ========== ===============================
.000 0048DFF0 0x00091bfe
+++++++++++++

And another <Enter> gets the actual contents:

+++++++++++++
CRC=c92ab0c2; LSN : 0x0048DFF0 = Dir  Btree+  Page Cyl 6423 H:209 S:
Dtree Pg Self @Bl : 0x00091BFE   Size: 0x0001 blocks = 0x00000008 =
Next     page @Bl : 0x00000000  sector LSN : 0x00000000
Previous page @Bl : 0x00000000  sector LSN : 0x00000000
Dtree page flags  : 0x02  0x09  Reserved-2 : 0xa67c      entries: 19

 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
 === ======== =================== ==== =================== ========
.000Ú00AC8E41 15-08-2005 19:18:30 A                             364
 ÄÄÄÁaccessed 11-03-2007 15:50:42  660 -README-
.001Ú00AC64E9 11-09-2002 13:08:46 A                            4096
 ÄÄÄÁ                             D770 bin
<snip>
.004Ú00AC9FB0 11-09-2002 13:08:54 A                            4096
 ÄÄÄÁ                             D770 dll
.005Ú00ACA6C0 11-09-2002 13:08:54 A                           12288
 ÄÄÄÁ                             D770 h
.006Ú00ADEDD8 11-09-2002 13:08:58 A                            4096
 ÄÄÄÁ                             D770 help
<snip>
 === ======== =================== ==== =================== ========
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
+++++++++++++

So we see our next level directory 'h' listed as number .005

Selecting that, using:

          .5

Results in the next level dirctory INODE:

+++++++++++++
DFSee  OS/2  8.14 : Executing: .5
CRC=a64710d3; LSN : 0x00ACA6C0 = Directory   Inode Cyl 6856
<snip>
Description for a : Directory    Btree Root + Internal nodes

 Nr  Page LSN  Block-nr  Split-point name (abbreviation)
 === ======== ========== ===============================
.000 004895F8 0x000912bf
.001 004898F8 0x0009131f PMSEI.H
.002 0048DDE8 0x00091bbd WPKEYBD.X
+++++++++++++

This is a bit more complicated than before, the INODE contains
a few 'splitpoints' that each link to a directory data structure.

You need to find the correct branch to follow by comparing
your filename (here 'pmwp.h') alphabetically with each entry,
until this entry is 'smaller' and the next extry is 'larger'

In our case that is between 'PMSEI.H' and 'WPKEYBD.X'
so our pmwp.h must be in the .001 branch ...

So selecting the correct 'branch' in the tree gets the actual contents:

          .1

+++++++++++++
CRC=7f563cb2; LSN : 0x004898F8 = Dir  Btree+  Page Cyl 6422 H:160 S:5
Dtree Pg Self @Bl : 0x0009131F   Size: 0x0001 blocks = 0x00000008 =
Next     page @Bl : 0x00091bbd  sector LSN : 0x0048dde8
Previous page @Bl : 0x000912bf  sector LSN : 0x004895f8
Dtree page flags  : 0x02  0x01  Reserved-2 : 0x0a23      entries: 123

 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
 === ======== =================== ==== =================== ========
.000Ú00ACFAEC 20-10-2000 00:19:00 A  R                         2723
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmsei.h
.001Ú00ACFAED 20-10-2000 00:18:00 A  R                        21594
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmshl.h
.002Ú00ACFAEE 20-10-2000 00:18:00 A  R                        51114
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmspl.h
.003Ú00ACFAEF 20-10-2000 00:18:00 A  R                       117836
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmstddlg.h
.004Ú00ACFAF0 20-10-2000 00:19:00 A  R                        11021
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmtypes.h
.005Ú00ACFAF1 20-10-2000 00:18:00 A  R                       176052
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmwin.h
.006Ú00ACFAF2 20-10-2000 00:18:00 A  R                        11131
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmwp.h
.007Ú00ACFAF3 16-10-2000 20:27:00 A  R                        29453
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmwsock.h
<snip>
.121Ú00AD3FD6 29-12-1999 02:25:00 A  R                        12671
 ÄÄÄÁaccessed 11-03-2007 15:50:50  660 wpjob.xh
.122Ú00AD3FD7 29-12-1999 02:19:00 A  R                        29067
 ÄÄÄÁaccessed 11-03-2007 15:50:50  660 wpkeybd.h
 === ======== =================== ==== =================== ========
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
+++++++++++++

So we see our next level, the wanted file 'pmwp.h' listed as number .006

We do NOT want to select that (would show file INODE) but instead
want to EDIT this directory strcuture to change the name.

Either use <F2> at this point to edit it sector-by-sector,
or to edit the whole 4096 byte structure as one object, use:

          edit  -s:8

It will pick up the sector-number to edit from the structure
that has just been displayed (last used, or 'this' value)

The HEX-editor will start and show a display like:

+++++++++++++++
[PgUp]   0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f [ItemUp]  [LineUp]
000000  bd 1b 09 00 00 00 00 00 bf 12 09 00 00 00 00 00 [................]
000010  02 7b 00 ff 80 01 23 0a 01 00 00 00 1f 13 09 00 [.{....#.........]
000020  05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 [................]
000030  15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 [........... !"#$]
000040  25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 [%&'()*+,-./01234]
000050  35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 [56789:;<=>?@ABCD]
000060  45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 [EFGHIJKLMNOPQRST]
000070  55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 [UVWXYZ[\]^_`abcd]
000080  65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 [efghijklmnopqrst]
000090  75 76 77 78 79 7a 7b 7c 7d 7e 7f 24 15 fc 18 fc [uvwxyz{|}~.$....]
0000A0  4c 73 04 00 ff 07 70 00 6d 00 73 00 65 00 69 00 [Ls....p.m.s.e.i.]
0000B0  2e 00 68 00 38 0c ff 04 05 7b 04 fc 1d 49 fc 1f [..h.8....{...I..]
0000C0  4d 73 04 00 ff 07 70 00 6d 00 73 00 68 00 6c 00 [Ms....p.m.s.h.l.]
0000D0  2e 00 68 00 fc 0f 49 fc 31 30 fc 0f 49 fc 29 0e [..h...I.10..I.).]
0000E0  4e 73 04 00 ff 07 70 00 6d 00 73 00 70 00 6c 00 [Ns....p.m.s.p.l.]
0000F0  2e 00 68 00 3f fc 2a fc 09 fc 3e fc 09 30 1c fc [..h.?.*...>..0..]
000100  4f 73 04 00 ff 0a 70 00 6d 00 73 00 74 00 64 00 [Os....p.m.s.t.d.]
000110  64 00 6c 00 67 00 2e 00 68 00 04 02 21 ff 02 08 [d.l.g...h...!...]
000120  50 73 04 00 ff 09 70 00 6d 00 74 00 79 00 70 00 [Ps....p.m.t.y.p.]
000130  65 00 73 00 2e 00 68 00 08 04 ff 06 05 aa 01 04 [e.s...h.........]
000140  51 73 04 00 ff 07 70 00 6d 00 77 00 69 00 6e 00 [Qs....p.m.w.i.n.]
000150  2e 00 68 00 34 fd 03 ff 04 1d d1 c7 36 ff 02 08 [..h.4.......6...]
000160  52 73 04 00 ff 06 70 00 6d 00 77 00 70 00 2e 00 [Rs....p.m.w.p...]
000170  68 00 41 00 0c 00 ff 04 1d d1 c7 11 ff 02 08 00 [h.A.............]
000180  53 73 04 00 ff 09 70 00 6d 00 77 00 73 00 6f 00 [Ss....p.m.w.s.o.]
000190  63 00 6b 00 2e 00 68 00 01 04 02 43 ff 02 08 04 [c.k...h....C....]
+++++++++++++++

Where our 'pmwp.h' filename is shown as UNICODE characters in
the lines marked 000160 and 000170.

You can change the name now either typing new hexadecimal values
on the left side of the edit-window, or using ASCII values on the right.
You switch between the two using the <TAB> key.

The edit position is where the normal cursor is, and the same
position in the other pane will be highlighted in purple ...

For changing the 'funny' characters to regular ASCII ones,
it may be the easiest to edit in HEX, making sure every
other byte in the filename is a zero (00).

make sure you do not modify any of the 'non-filename' bytes,
and that the sort-order remains the same when possible.

Changed bytes will be painted in yellow for convenience.

When done, hitting <Enter> will get you a confirmation dialog
to write the sector/object back to the disk ...

_______________________________________________________________________________


64) Delete a file from a JFS filesystem (undeleteable, strange characters etc)

The way it works is navigate from the root directory towards
the offending filename, using DFSee display commands
and each time selecting the next level by using a '.NNN'
command to pick a specific entry (file/directory).

When the directory containing the incorrect filename is shown
you select that by a last .NNN command, which will display
the INODE for the offending file.

At that point you WIPE a single sector (the INODE) to zeroes.
After a reboot, you do a 'chkdsk /f' on the drive and that
should tell you it removed the directory entry as well.



The easiest way to get to the correct directory is using the DFSee
commandline that you get to using <F10> from the menu.

I will show an example below, to navigate to the file:

 j:\toolkit\h\pmwp.h

That is on a JFS partition of mine.
I will show each command to be entered to get there,
and (part of) the screen output that generates ...

You start with a command to select the partition, followed by
a few <Enter>'s to get to the ROOT directory display:

        DFS
         part 13
         <Enter>
         <Enter>
         <Enter>

Eventually resulting in a display like this:

++++++++++
DFSee  OS/2  8.14 : Executing: <Enter>
<snip>
FAT style Attrib. :      D                    Inode Links :
Parent   Inode nr : 0x00000002
1st link Filename :
Filename fullpath : \
File size (exact) : 0x00001000 =       4096
<snip>
Description for a : Directory    Btree Root + Internal nodes

 Nr  Page LSN  Block-nr  Split-point name (abbreviation)
 === ======== ========== ===============================
.000 00029F18 0x000053e3
++++++++++

The last line is the link to the real contents of the directory.
For a directory with many files there may be more than one
line, each with its own '.NNN. number (see later example).

So now we select that one link:

          .0

And get a complete directory listed:

+++++++++++++
DFSee  OS/2  8.14 : Executing: .0
CRC=96fb7246; LSN : 0x00029F18 = Dir  Btree+  Page Cyl 6119 H: 87 S:
<snip>
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
 === ======== =================== ==== =================== ========
.000Ú00B40008 07-12-2002 20:36:56 A                            4096
 ÄÄÄÁ                             D770 @home
.001Ú00B62E83 08-04-2007 11:10:20      08-04-2007 11:10:27      256
 ÄÄÄÁ                             D770 @info
<snip>
.013Ú00952988 11-09-2002 12:55:18 A    02-03-2007 16:58:50     8192
 ÄÄÄÁ                             D770 pkg
.014Ú00AC8E40 11-09-2002 13:08:46 A                            4096
 ÄÄÄÁ                             D770 toolkit
.015Ú00AF85E0 11-09-2002 13:09:26 A                            4096
 ÄÄÄÁ                             D770 toolkt13
<snip>
 === ======== =================== ==== =================== ========
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
+++++++++++++

So we see our directory 'toolkit' listed as number .014

Selecting that, using:

          .14

Results in the next level dirctory INODE:

+++++++++++++
DFSee  OS/2  8.14 : Executing: .14
CRC=f6eaef7e; LSN : 0x00AC8E40 = Directory   Inode Cyl 6855
<snip>
Description for a : Directory    Btree Root + Internal nodes

 Nr  Page LSN  Block-nr  Split-point name (abbreviation)
 === ======== ========== ===============================
.000 0048DFF0 0x00091bfe
+++++++++++++

And another <Enter> gets the actual contents:

+++++++++++++
CRC=c92ab0c2; LSN : 0x0048DFF0 = Dir  Btree+  Page Cyl 6423 H:209 S:
Dtree Pg Self @Bl : 0x00091BFE   Size: 0x0001 blocks = 0x00000008 =
Next     page @Bl : 0x00000000  sector LSN : 0x00000000
Previous page @Bl : 0x00000000  sector LSN : 0x00000000
Dtree page flags  : 0x02  0x09  Reserved-2 : 0xa67c      entries: 19

 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
 === ======== =================== ==== =================== ========
.000Ú00AC8E41 15-08-2005 19:18:30 A                             364
 ÄÄÄÁaccessed 11-03-2007 15:50:42  660 -README-
.001Ú00AC64E9 11-09-2002 13:08:46 A                            4096
 ÄÄÄÁ                             D770 bin
<snip>
.004Ú00AC9FB0 11-09-2002 13:08:54 A                            4096
 ÄÄÄÁ                             D770 dll
.005Ú00ACA6C0 11-09-2002 13:08:54 A                           12288
 ÄÄÄÁ                             D770 h
.006Ú00ADEDD8 11-09-2002 13:08:58 A                            4096
 ÄÄÄÁ                             D770 help
<snip>
 === ======== =================== ==== =================== ========
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
+++++++++++++

So we see our next level directory 'h' listed as number .005

Selecting that, using:

          .5

Results in the next level dirctory INODE:

+++++++++++++
DFSee  OS/2  8.14 : Executing: .5
CRC=a64710d3; LSN : 0x00ACA6C0 = Directory   Inode Cyl 6856
<snip>
Description for a : Directory    Btree Root + Internal nodes

 Nr  Page LSN  Block-nr  Split-point name (abbreviation)
 === ======== ========== ===============================
.000 004895F8 0x000912bf
.001 004898F8 0x0009131f PMSEI.H
.002 0048DDE8 0x00091bbd WPKEYBD.X
+++++++++++++

This is a bit more complicated than before, the INODE contains
a few 'splitpoints' that each link to a directory data structure.

You need to find the correct branch to follow by comparing
your filename (here 'pmwp.h') alphabetically with each entry,
until this entry is 'smaller' and the next extry is 'larger'

In our case that is between 'PMSEI.H' and 'WPKEYBD.X'
so our pmwp.h must be in the .001 branch ...

So selecting the correct 'branch' in the tree gets the actual contents:

          .1

+++++++++++++
CRC=7f563cb2; LSN : 0x004898F8 = Dir  Btree+  Page Cyl 6422 H:160 S:5
Dtree Pg Self @Bl : 0x0009131F   Size: 0x0001 blocks = 0x00000008 =
Next     page @Bl : 0x00091bbd  sector LSN : 0x0048dde8
Previous page @Bl : 0x000912bf  sector LSN : 0x004895f8
Dtree page flags  : 0x02  0x01  Reserved-2 : 0x0a23      entries: 123

 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
 === ======== =================== ==== =================== ========
.000Ú00ACFAEC 20-10-2000 00:19:00 A  R                         2723
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmsei.h
.001Ú00ACFAED 20-10-2000 00:18:00 A  R                        21594
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmshl.h
.002Ú00ACFAEE 20-10-2000 00:18:00 A  R                        51114
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmspl.h
.003Ú00ACFAEF 20-10-2000 00:18:00 A  R                       117836
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmstddlg.h
.004Ú00ACFAF0 20-10-2000 00:19:00 A  R                        11021
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmtypes.h
.005Ú00ACFAF1 20-10-2000 00:18:00 A  R                       176052
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmwin.h
.006Ú00ACFAF2 20-10-2000 00:18:00 A  R                        11131
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmwp.h
.007Ú00ACFAF3 16-10-2000 20:27:00 A  R                        29453
 ÄÄÄÁaccessed 11-03-2007 15:50:49  660 pmwsock.h
<snip>
.121Ú00AD3FD6 29-12-1999 02:25:00 A  R                        12671
 ÄÄÄÁaccessed 11-03-2007 15:50:50  660 wpjob.xh
.122Ú00AD3FD7 29-12-1999 02:19:00 A  R                        29067
 ÄÄÄÁaccessed 11-03-2007 15:50:50  660 wpkeybd.h
 === ======== =================== ==== =================== ========
 Nr  InodeLSN Creation/LastAccess Attr Modified / Filename Filesize
+++++++++++++

So we see our next level, the wanted file 'pmwp.h' listed as number .006

We want to select that now, to show the file INODE, and erase it.

        .6

The display will be something like this:

++++++++++++++ pmwp.h INODE
CRC=224fa32a; LSN : 0x00ACFAF2 = File        Inode Cyl 6857 H:184 S:26 062E2CF1
Fileset  InoStamp : 0x45e72d6c = 01-03-2007 19:45:48
Inode self number : 0x00047352 = 291666     FileSet : 0x10  Generation : 203463
Owning User (Uid) : 0x00000000 = 0   (root)   Group : 0x06  6   (disk)
File Mode   (660) : 0x420481b0 = -rw-rw----
FAT style Attrib. :  A  R                     Inode Links : 1
File size (exact) : 0x00002B7B =      11131
Allocated  size   : 0x00003000 =      12288
Inode extent  @Bl : 0x00159F5C   Size: 0x0004 blocks = 0x00000020 =    16.0 KiB
Last Access time  : 18-04-2007 18:48:07       Last Status : 01-03-2007 15:22:39
Last Modify time  : 20-10-2000 00:18:00       Creation    : 20-10-2000 00:18:00
Description for a : Regular File Btree Root + Leaf nodes

 Allocation Check : OK         Saveto/Recover/Undelete of filedata is possible

 RelCluster Extent-size        Data-LSN
 ========== ================== ========
 C 00000000  000018 = 12.0 KiB 00AD3EA0
++++++++++++++

Now WIPE this INODE structure (one sector) using the command:

        wipe z . 1

After this you should reboot, and after that BEFORE accessing this
driveletter in any other way execute a CHKDSK:

        chkdsk j: /f

Where j: is the driveletter of the JFS filesystem in question.

As is often the case, this description looks a lot more
complicated that executing the actual procedure :-)

_______________________________________________________________________________

----------------------------[ www.dfsee.com ]-------------------------------
