Virtual OS/2 International Consumer Education
VOICE Home Page: http://www.os2voice.org
February 2002

[Newsletter Index]
[Previous Page] [Next Page]
[Feature Index]

editor@os2voice.org


DFSee "Swiss Army knife of disk tools"

By Paul Floyd © February 2002

What is DFSEE?

In the author (Jan van Wijk)'s own words, it is a "Swiss Army knife of disk tools". What it isn't, however, is a panacea for for data recovery. Whilst it may save your bacon in case of a trashed partition table or HPFS corruption, the only way to be sure that your data is safe is to make backups. However, there are times when even backups aren't enough. Even if you make regular backups, there are always times when everything goes pear-shaped just before a backup is due.

DFS is a very complicated tool. For this reason, it is a good idea to learn some of its capabilities before attempting to recover from a disaster. For instance, it has the capability of making backups of your partition tables. Obviously, if you want to restore your partition tables, you have to have made backups beforehand. In simple terms, its functionality encompasses fdisk, format and chkdsk. In addition, DFSEE has many functions that are useful for general purpose maintenance and running of computers. This includes batch mode activities (creating bootable partitions, setting Boot Manager options...). Some of the features are more cosmetic, such as the display of disk usage. In this article, I'll concentrate more on the interactive usage.

DFSEE runs on DOS, MDOS, OS/2 and NT. It supports all possible FAT partitions, as well as HPFS, JFS and NTFS. It can configure Boot Manager options and LVM options.

Obtaining and Running DFS

You can download DFS from http://www.fsys.demon.nl/dfsee.htm. Versions prior to 4.00 were free. Current versions (as of writing, 4.10) are shareware, priced at €20) (you can use it for evaluation purposes though). DFSEE is the name of the tool, but dfs.exe is the name of the OS/2 executable, so I use the two names interchangeably.

You can register DFSee at http://shop.mensys.nl/catalogue/mns_DFSee.html. dfsee.zip contains everything that you need - all the exes are standalone. They will also fit on a floppy diskette, allowing you to run them from a DOS or OS/2 floppy boot. As well as the exes, there are a few batch files for common actions, and quite extensive text files (plain ASCII) describing how to use DFS. These text files cover both the commands available, and a 'howto' file that describes 13 common scenarios of DFS usage.

The first thing that you should do is to unzip dfsee.zip onto a floppy disk (in fact, I keep two such floppies, just to be on the safe side). If you install DFS only on your hard disk, then it won't be much use there if you can't access your hard disk. DFS has two modes of operation. Firstly, there is a batch mode. To see the help screen, use the -h option. To pass batch commands, simply pass the commands to DFS as parameters. The default is to separate multiple commands with the '#' token. If you type "dfs" without any parameters, DFS will display a user interface.


By default, it will show some basic information about your computer in its main window, with a command prompt at the bottom of the screen (this resembles the tedit editor, or the e DOS editor).

Each time that you type a command, the output scrolls through the main window, which has a 4000 line buffer. 4000 lines may sound a lot, but DFS can output a huge amount of information about a system. For that reason, it can also output the information to a log file. For instance, the dfsee.zip package includes a few scripts. One of them, 'dfsquick.[bat|cmd]', when run on my PC, generates a logfile that is 108292 bytes long (1866 lines). 'dfsinfo.cmd' generates a logfile that is 561989 bytes long (9762 lines), though I ran this on my hard disk, and disk 1 was locked. Running dfs V3.42 generates a file that is 398058 bytes long (6413 lines). For reference, I have 3 disks, 21G, with the following number of partitions: 1 FAT16, 1 FAT32, 3 HPFS, 2 NTFS, 2 Ext2fs, 1 Linux Swap, 2 Solaris UFS and 1 FreeBSD UFS. The split is about 60/40 OS/2+Windows / unices. DFS won't give much information about partitions that it does not understand (like BeFS and UFS).

On a large disk, the log for a comprehensive checkup can easily run to over a megabyte and tens of thousands of lines. This information goes from a basic directory listing to hex dumps of boot sectors to 'usage maps' showing the percent usage of the regions of a partition



The user interface is text mode, using ASCII. For that reason, viewing the log file on other systems might not be pretty. Here is DFSee in Windows (cygwin vim running on NT 4. ):


You can improve the presentation a bit with the -a and -f:no options. When you first run DFS, you will be presented with an overview of the disks and partitions in your system (you can stop this with -q or change the default with the -m option). The first part of the output looks a bit like the Partition Magic screen. This is followed by more summary information: version of DFS, geometry and size of disks, and a list of warnings and errors that DFS finds (discrepancies between partition table CHS and LBA entries, partitions not on cylinder boundaries, bootable partitions on drives other than the first and so on).

Next there is a table that gives the same information as the graphical partition display, but with names and numbers.

The meaning of the 9 columns is as follows:

id
Partition ID. DFS always refers to partitions in the physical order that they appear, by order of disks.
PD
Physical Disk
Vol
Drive letter assigned
Type
Primary or Logical, plus the partition type (a value from 0 to 255) description. A short description of the partition. Note that sometimes, a partition ID is used by more than one OS, so DFS might get it wrong (as it does with partition 03 above, which is Solaris UFS, not LinuxSwap).
Format
The disk format of the partition. Again, this isn't 100% reliable for partitions other than FAT/HPFS/NTFS/Ext2fs (partition 12 above is FreeBSD UFS, not "ÕÞ-"!).
Creator
Name of the OS or tool that created the partition.
Label info
A text label (optional) that the partition has.
BM-Name
OS/2 Boot Manager name (optional, only if BM is installed).
Size MB
Partition size in megabytes.
At the bottom of the screen, there is a status line with a line counter and some indications about how to scroll through the output. Below that is a line where you can type input. This line has a command history, so that you can scroll through previous commands.

Before you do anything else!!!

You've already made yourself a "DFSEE diskette"? Good! Pop it in your floppy drive, run DFS and at the command line type psave * ptable Paul's PC (replace "Paul's PC" with something suitable). This will create a file called "ptable.pt[drive number]" on the floppy disk. My PC has 3 disks, so I get ptable.pd1, ptable.pd2 and ptable.pd3. You can now heave a small sigh of relief, since you now have a backup of all of the partition tables (and even the chained extended partitions).

You need to refresh your backups every time that you change your PC's partitioning (add/delete partition, change partition type, grow/shrink partition). If ever you need to restore your partition tables, use the prestore command. It will prompt you for confirmation for all of the partition tables (including extended) that it restores.

DFS basics

So now you should be ready to start learning the DFS commands. If you don't like taking risks with such a powerful tool, you can run DFS with the -R option in order to run it in read-only mode.

When DFS is running, it is modal. When it starts up, it is in disk mode. If you type "part 2", then it will print out information pertaining to the selected partition, and switch into the appropriate partition mode. In my case, partition 2 is my OS/2 boot partition, so "part 2" puts me into HPFS mode.

DFS has fairly extensive online help. Typing "?" will print out a list of commands that are relevant to the current mode. So, if you are in "disk mode", then "?" will tell you about things like creating and deleting partitions. If you are in a partition mode, then "?" will tell you about things like checking and repairing the partition.

The "??" help command tells you about commands that apply in all circumstances. These commands include things like manipulating sectors (e.g., to copy part of a disk to a file on another disk or vice versa, or even an entire disk image, like Ghost or Drive Image).

The "???" help command displays a description of the meanings of the abbreviations that DFS uses in its various modes. All of these help items are quite short, and you should refer to the various .txt files that come with the package.

The two most important commands are "disk" and "part". Both take one parameter, either the disk number, or the partition number (both starting from 1, see above for a description of how the partitions are numbered). "disk" will cause DFS to print out a summary of the disk. e.g.

disk 2
DFSee wNT version : 4.10 executing: disk 2
Registration info : Registration file is not present!
LogGeo disk 2 Cyl : 1110 H:255 S:63 = 7.84 Mb Disksize : 011018D6 = 8707 Mb
Shown sector LSN : 00000000 = Master Boot Rec Cyl: 0 H: 0 S: 1 = 00000000
MBR informational : 8E30DBBC Possible NT Disk Administrator disk-signature
Position Fl|BeginCHS|Tp| EndCHS | BR-offset |sectors [Partition Table ]
+==+--------+==+--------+------------+-----------+
-001BE- 52 00 01 01 00 1b fe 3f 3f 3f 00 00 00 01 b0 0f 00 [À??ÀÀª???ÀÀÀ?ªñÀ]
-001CE- 52 80 00 01 40 07 fe 3f 9f 40 b0 0f 00 60 88 17 00 [-À?@Àª?â@ªñÀ`Û?À]
-001DE- 52 00 00 01 a0 82 fe bf 45 a0 38 27 00 26 72 67 00 [ÀÀ?ßÚª+Eß8'À&rgÀ]
-001EE- 52 00 00 81 46 05 fe ff ff c6 aa 8e 00 10 6e 81 00 [ÀÀ|F?ªá᪼-À?n|À]
+==+--------+==+--------+------------+-----------+
Partition index 0 : Type 1b = FAT32
Begin sector PSN : 0000003F = Cyl: 0 H: 1 S: 1
End sector PSN : 000FB03F = Cyl: 63 H:254 S:63
Bootsect. offset : 0000003F Sectors : 000FB001 = 502 Mb
Partition index 1 : Type 07 = Inst-FSys <-------------------- Active/Bootable
Begin sector PSN : 000FB040 = Cyl: 64 H: 0 S: 1
End sector PSN : 0027389F = Cyl: 159 H:254 S:63
Bootsect. offset : 000FB040 Sectors : 00178860 = 753 Mb
Partition index 2 : Type 82 = LinuxSwap
Begin sector PSN : 002738A0 = Cyl: 160 H: 0 S: 1
End sector PSN : 008EAAC5 = Cyl: 581 H:254 S:63
Bootsect. offset : 002738A0 Sectors : 00677226 = 3310 Mb
Partition index 3 : Type 05 = Extended
Begin sector PSN : 008EAAC6 = Cyl: 582 H: 0 S: 1
End sector PSN : 011018D5 = Cyl: 1109 H:254 S:63 CHS Cyl:1023 H:254 S:63
Bootsect. offset : 008EAAC6 Sectors : 00816E10 = 4142 Mb
ReadWrite Store 1 : PhysDisk : 2 PartId 00 = -- mode=FDISK 271201-164840
RC:0 <Enter> : 008EAAC6 u=00000000 x=002738A0 this=00000000 Base=00000000
The first part is a summary. The second part is the the disk's partition table, in hex. The third part is a text description of the partition table. Lastly, there is a summary of the state of DFS.

What if the disk is munged?

If your partition table has been hosed, then DFS might get all of the partition table information data wrong. You can use the "diskgeo" command to specify the CHS values for the disk. Relatively minor damage to the partition table can prevent you from running some tools like Partition Magic, or even fdisk. Ideally, if your partition table gets damaged, then all you do is boot from your OS/2 diskettes (or CD or emergency partition) and you restore the partition table backups that you made with the DFS part command. With the part command, you select a partition to work with. DFS will switch to a mode corresponding to the partition filesystem (FAT, HPFS, NTFS or AUX for other filesystems).

What if the filesystem is corrupt?

You can force DFS to treat a partition as a certain type by using the "FS partition-type" command (e.g., "FS HPFS"). You might need to do this if the partition table says that a partition is HPFS, but the partition itself is damaged such that DFS cannot recognize it as HPFS.

I won't repeat all of the tasks that you can perform with DFS that are described in the documentation that comes with the package. The most interesting ones are as follows:

fixboot
repair partition bootsector
fixspare
repair HPFS spare block
dirty
twiddle the dirty flag

Restoring files

There are three circumstances in which I can think you might want to use DFS to recover files. Firstly, restoring accidentally deleted files on a healthy partition. Secondly, recovering files from a corrupt partition. Thirdly, recovering chkdsk files that OS/2 created on an automatically (or manually) chkdsk'ed partition.

Accidentally deleted files

The sequence of commands that you need to perform is
part <id>
Select the partition.
delfind
Find files flagged as deleted.
delsave <path> [pattern]
Copy the files.
Note that <path> should be on a partition other than <id>.
You can use a wildcarded pattern to filter the files.

Personally, I've also had success using "File Phoenix" for this purpose. It is very important that you minimize your disk activity between the moment that you've accidentally deleted files and trying to recover them. Every time that OS/2 writes to the disk, it could potentially be reusing sectors that belonged to your deleted files, thereby reducing your chances of recovery.

Recovering from a corrupt partition

If you have a partition that chkdsk can't repair, and you want to try to
recover as many files as possible. There are several DFS fix commands that
might help (fixroot, fixes, fixcp, fixbs, fixspare and fixboot). If you
still can't access the partition, then try something like this
part <id>
select the partition
find -o:* -t:f
find all files on the partition this will probably be slow!
delshow
see a list of found files
delsave <path> *
save all the files to <path>

I've used this once, and it saved around 99% of the files that were on the partition. A few large files were not recovered.

Recovering chkdsk files

See dfshowto.txt for a description of this.

Changing partition types

In their (in)finite wisdom, with Windows 95 refresh 2, Microsoft added the 'large disk extended partition' type 0x0F. Until then, extended partitions had used 0x05 as partition ID. This is all well and good, except that OS/2 does not support large disk extended partitions. This means that if you use either Windows fdisk, or a tool that is MS-centric (like Partition Magic), then they may convert your extended partitions to type 0x0F. And the next time that you boot, shock horror, all your FAT and HPFS logical partitions become invisible to OS/2.

The solution to this is to change the partition type. The DFS command to do this is settype. For instance, to change an extended partition from type 0x0F (15 decimal) to 0x05, the partition being the 4th one on the 1st disk, use the command settype 4 1 5 15.

Other Capabilities as mentioned above, DFS can manipulate LVM and Boot Manager. Since I don't personally use LVM (I have Warp 4 client only), I can't comment on this functionality. Here is an example of the 'part' output for a disk containing Boot Manager:

Boot capability : Bootable by OS/2 boot-manager as: OS2Warp


and issuing a command to change the name in Boot Manager:

DFSee OS2 version : 4.11 executing: setname 1 OS2Warp3
Set as BM-name 'OS2Warp3' for partition 01 (C:) ? [Y/N] : y
Disk or volume cannot be locked for writing (open files). Write anyway ? [Y/N]
Execute autoshow : 'part -r'
DFSee OS2 version : 4.11 executing: part -r
Registration info : Registration file is not present!
Number of disks : 1
LogGeo disk 1 Cyl : 933 H: 16 S:32 = 0.25 Mb Disksize : 00074A00 = 233 Mb
id
PD
Vol
Type, description
Format
Creator
Label Info
BM-Name
Size Mb
01
1
*C:
Prim 07 Inst-FSys
HPFS
OS2 20.0
OS2
OS2Warp3
202.0
02
1
*--
Prim 4f QNXv4-3rd
ð¼
OBERON
·Û1
Oberon
30.0
03
1
*--
Prim 0a Boot-Mgr
BMGR
fdisk
«OS2Warp »
1.0
04
1
Pri/Log FreeSpace
-- -- --
-- -- --
-- -- --
0.2

Latest Update

Since I started writing this, DFSEE 4.11 has been released, adding the ability to resize FAT partitions. I haven't tested this at all yet.

Problems, glitches

In general, DFS seems to work very well. I did notice that some of the comments in the accompanying text files referred to previous versions of DFS (e.g., 4.05). I also had problems running the 'dfsinfo.cmd' script. Running it on its own brought up an fdisk screen. Running it from within DFS causes the correct output to go to the dfsinfo.log, but rather than scrolling in the DFS window, the UI is blocked with a "Press [Space-bar] to continue ..." message. In either case, the applications seem to be in the background and do not accept any keyboard input.

References:
DFSee
Developer: FSYS software homepage - http://www.fsys.demon.nl
Price: Shareware. Can be purchased from Mensys: http://shop.mensys.nl/catalogue/mns_DFSee.html
Single user: 20 Euro's (about US $18) This will allow full use of the program by a single person for use on his own computer system(s). It is meant for individuals and can be compared to a simple SHAREWARE registration, getting you (email) support and assistance.
Single, professional license: 150 Euro's (about US $135) This will allow full use of the program by a single professional for use on all of his (and his customers) computer systems. Typical use would be for a company specializing in roll-out or datarecovery services. Note that each professional in such a company needs a seperate licence
Other multi-user licenses are available. See web site.

Another review of DFSEE http://www.scoug.com/os24u/2001/scoug012.dfseetutorial.html
A mailing list for DFSEE support. http://groups.yahoo.com/group/dfsee-support/
You might also get help in either comp.os.os2.setup.misc and c.o.o.setup.storage on usenet.
A description of partition tables http://users2.ev1.net/~mranish/part/primer.htm
Partitioning for multiboot http://math.uwb.edu.pl/~mariusz/dualboot/


[Feature Index]
editor@os2voice.org
[Previous Page] [Newsletter Index] [Next Page]
VOICE Home Page: http://www.os2voice.org