DFSee concepts, demo and Q&A

Jan van Wijk

How to use the DFSee program more
effectively by understanding its capabilities
and some of the internal workings

Presentation contents

Who am I

DFSee functional and technical view

DFSee architecture and working

Accessing 'sectors' in 'stores'

Different types of media

Virtual disks, for analysis purposes

Generic implementation plus FS (mode) specific

Examples using DFSee ...

What is DFSee, functional view

DFSee is an OS neutral utility comparable to FDISK, LVM, Partition Magic, Drive-Image Norton-Ghost, Undelete and more ...

Main areas of functionality:

Backup and restore of partitioning information

Search missing partitions and recreate them

FDISK/LVM create and maintain partitions

Imaging, disk-areas to/from (compressed) files

Cloning, disk-areas to/from other disk-areas

FS-specific: Check, Display, Undelete and Fix

What is DFSee, technical view

DFSee is a tool to examine and possibly
modify data on a variety of storage media

Types of storage supported:

Physical disks, as supported by the OS

Disk partitions on partitionable media

Volumes (driveletters on PC) or Devices on Linux

Regular files, like RAW images

Data can be viewed RAW or formatted for:

FDISK usage, partition-tables bootsectors, LVM-info

Filesystem structures, FAT, HPFS, NTFS, JFS, EXT2 ...

DFSee versions and user interface

DFSee is available in an OS/2 (eCS), DOS
Windows-NT/W2K/XP and a Linux version.

It is a non-graphical text based program, able to run in simple environments like
a boot-diskette or bootable CDROM

Most functions can be run from a MENU
interface with additional dialogs

Much more through a command-line

Output can go to the screen AND a logfile

DFSee architecture

DFSee considers all storage as a collection
of sectors (typical 512 bytes) called a STORE

Many generic commands are available to work any type of FS or disk (DFSCMDS.TXT)

On opening, DFSee will analyse the first
sector(s) and select a suitable mode with
specific commands and menu selections

For the 6.xx versions, the modes are:
FDISK, FAT, HPFS, NTFS, JFS, EXT2 ...

The DFSee STORE concept

DFSee store nr 0 (system)
Collection of sectors 0 .. N

DFSee store nr 2 (alternate)
Collection of sectors 0 .. N

DFSee store nr 1 (default)
Collection of sectors 0 .. N

Open/Read/Write from DFSee functions

PC-style
Driveletter

Linux
Device

Physical disk

Virtual disk

RAW

image

Disk partition

Store concept, details

A store can be associated with a medium
using an OPEN menu-item or command

The store keeps additional information like
the geometry and some statistics

See the STORE command/menu-item for details

Partitions on (virtual) disks are supported by defining a non-zero 'base' sector number as
the disk-sector considered to be 'sector 0'

See the BASE command/menu-item for details

Virtual disks in DFSee

Exists in MEMORY within DFSee only

Behaves (almost) the same as a real disk

Can be created in 2 ways:

By specifying a size and/or disk geometry

By using a set of .Pdx files as a template
(often used with the DFSDISKI.* result files)

Can be used to:

Learn DFSee commands and functions

Test recovery scenarios and scripts

DFSee concepts, demo and Q&A

Questions ?

DFSee concepts

DFSee architecture and functionality demonstration

DFSee concept architecture store disk partition filesystem

Updated for Warpstock 2005, Hershey

Jan van Wijk

2004-10-15T05:04:41