DE.9
上传用户:jnzhq888
上传日期:2007-01-18
资源大小:51694k
文件大小:13k
- .CD "de (en disk editor"
- .SX "defR [fB(enwfR] fIblock_device"
- .SX "de (enr fIfile
- .FL "(enr" "Recover a file that has been removed"
- .FL "(enw" "Enable writing, so device can be modified"
- .EX "de (enr /usr/ast/prog.c" "Undo the effects of: fIrm /usr/ast/prog.cfR"
- .EX "de (enw /dev/fd0" "Edit fI/dev/fd0fR for writing"
- .PP
- The fIdefR program allows a system administrator to examine and modify
- a s-2MINIXs0 file system device.
- Commands are available to move to any address on the disk
- and display the disk block contents. This information may
- be presented in one of three visual modes: as two-byte words,
- as ASCII characters or as a bit map. The disk may be searched
- for a string of characters. If the fB(enwfR option is given,
- fIdefR will open the device for writing and words may be
- modified.
- Without this flag, writing is prohibited.
- Lost blocks and files can be recovered using a variety of
- commands. The fB(enrfR option supports automated recovery of
- files removed by fIunlinkfR.
- .SS "Positioning"
- .PP
- Disks are divided into blocks (also called *(OQzones*(CQ) of 1024
- bytes. fIDefR keeps a current address on the disk as a
- block number and a byte offset within the block. In some
- visual modes the offset is rounded off, for example, in
- *(OQword*(CQ mode the offset must be even.
- .PP
- There are different types of blocks on a file system device,
- including a super block, bit maps, i-nodes and data blocks.
- fIDefR knows the type of the current block, but will allow
- most positioning commands and visual modes to function
- anywhere on the disk.
- .PP
- The fIffR command (or PGDN on the keypad) moves forward to the
- next block, similarly fIbfR (PGUP) moves backwards one block.
- fIFfR (END) moves to the last block and fIBfR (HOME) moves to the
- first block.
- .PP
- The arrow keys (or
- fIufR, fIdfR, fIlfR, and fIrfR) change the current
- address by small increments. The size of the increment
- depends on the current display mode, as shown below. The
- various sizes suit each display and pointers move on the
- screen to follow each press of an arrow key.
- .HS
- .if t .ta .75iR 1.5iR 2.25iR 3.0iR 3.75iR
- .if n .ta .75i 1.5i 2.25i 3.0i 3.75i
- .nf
- fB Mode Up Down Left RightfR
- Word (mi2 +2 (mi32 +32
- Block (mi64 +64 (mi1 +1
- Map (mi256 +256 (mi4 +4
- .fi
- .HS
- The fIgfR command allows movement to any specified block.
- Like all commands that take arguments, a prompt and
- subsequent input are written to the bottom line of the
- screen. Numerical entry may be decimal, octal or
- hexadecimal, for example 234, (mi1, 070, 0xf3, (miX3C.
- .PP
- While checking an i-node one may want to move to a block
- listed as a zone of the file. The fIGfR command takes the
- contents at the current address in the device as a block
- number and indirectly jumps to that block.
- .PP
- The address may be set to the start of any i-node using
- the fIfR command and supplying an i-node number. The fIIfR
- command maps a given file name into an i-node address.
- The file must exist on the current device and this
- device must be mounted.
- .SS "The Display"
- .PP
- The first line of the display contains the device name,
- the name of the current output file (if one is open) and
- the current search string. If fIdefR is being run with
- the fB(enwfR option then the device name is flagged with *(OQ(w).*(CQ
- If a string is too long to fit on the line it is marked with *(OQ...*(CQ.
- .PP
- The second line contains the current block number, the
- total number of blocks, and the type of the current block.
- The types are: boot, super, i-node bit map, zone bit map,
- i-nodes and data block.
- If the current address is
- within a data block then the string *(OQin use*(CQ is displayed
- if the block corresponds to a set in the zone bit map.
- .PP
- The third line shows the offset in the current block. If
- the current address is within either the i-node or zone bit
- maps then the i-node or block number corresponding to the
- current bit is shown. If the current address is within an
- i-node then the i-node number and *(OQin use*(CQ status is displayed.
- If the address is within a bit map or i-node block, but past
- the last usable entry, then the string *(OQpadding*(CQ is shown.
- .PP
- The rest of the screen is used to display data from the
- current block. There are three visual display modes:
- *(OQword,*(CQ *(OQblock,*(CQ and *(OQmap.*(CQ
- The fIvfR command followed by
- fIwfR, fIbfR, or fImfR sets the current display mode.
- .PP
- In *(OQword*(CQ mode 16 words, of two bytes each, are shown in
- either base 2, 8, 10 or 16. The current base is displayed
- to the far right of the screen. It can be changed using the
- fIofR command followed by either an fIhfR (hexadecimal), fIdfR
- (decimal), fIofR (octal) or fIbfR (binary).
- .PP
- fIDefR knows where i-nodes are, and will display the
- contents in a readable format, including the fIrwxfR bits,
- the user name and the time field. If the current page
- is at the beginning of the super block, or an executable
- file or an fIarfR archive, then fIdefR will also inform
- the user. In all other cases the contents of the 16
- words are shown to the right as equivalent ASCII
- characters.
- .PP
- In *(OQblock*(CQ mode a whole block of 1024 bytes is displayed
- as ASCII characters, 64 columns by 16 lines. Control codes
- are shown as highlighted characters. If the high order bit
- is set in any of the 1024 bytes then an *(OQMSB*(CQ flag is shown
- on the far right of the screen, but these bytes are not
- individually marked.
- .PP
- In *(OQmap*(CQ mode 2048 bits (256 bytes) are displayed from the
- top to the bottom (32 bits) and from the left to the right
- of the screen. Bit zero of a byte is towards the top of the
- screen. This visual mode is generally used to observe
- the bit map blocks. The number of set bits displayed is
- written on the far right of the screen.
- .SS "Searching"
- .PP
- A search for an ASCII string is initiated by the fI/fR command.
- Control characters not used for other purposes may be
- entered in the search string, for example CTRL-J is an end-of-line
- character. The search is from the current position to
- the end of the current device.
- .PP
- Once a search string has been defined by a use of fI/fR, the
- next search may be initiated with the fInfR command, (a fI/fR
- followed immediately by an ENTER is equivalent to an fInfR).
- .PP
- Whenever a search is in progress fIdefR will append
- one fI.fR to the prompt line for every 500 blocks searched. If the
- string is found between the end of the file system and the
- actual end of the device, then the current address is set to
- the end of the file system.
- .PP
- Some of the positioning commands push the current address
- and visual mode in a stack before going to a new address.
- These commands are
- fIBfR, fIFfR, fIgfR, fIGfR, fIifR, fIIfR, fInfR, fIxfR and
- fI/fR.
- The fIpfR
- (previous) command pops the last address and visual mode
- from the stack. This stack is eight entries deep.
- .SS "Modifying the File System"
- .PP
- The fIsfR command will prompt for a data word and store it at
- the current address on the disk. This is used to change
- information that can not be easily changed by any other
- means.
- .PP
- The data word is 16 bits wide, it may be entered in decimal,
- octal or hexadecimal. Remember that the fB(enwfR option must
- be specified for the fIsfR command to operate. Be careful
- when modifying a mounted file system.
- .SS "Recovering Files"
- .PP
- Any block on the disk may be written to an output file.
- This is used to recover blocks marked as free on the
- disk. A write command will request a file name the first
- time it is used, on subsequent writes the data is appended
- to the current output file.
- .PP
- The name of the current output file is changed using the
- fIcfR command. This file should be on a different file system,
- to avoid overwriting an i-node or block before it is
- recovered.
- .PP
- An ASCII block is usually recovered using the fIwfR command.
- All bytes will have their most significant bit cleared before
- being written to the output file. Bytes containing '\0'
- or '\177' are not copied. The fIWfR command writes the current
- block (1024 bytes exactly) to the output file.
- .PP
- When a file is deleted using fIunlinkfR the i-node number
- in the directory is zeroed, but before its removal, it is
- copied into the end of the file name field. This allows
- the i-node of a deleted file to be found by searching
- through a directory. The fIxfR command asks for the path
- name of a lost file, extracts the old i-node number and
- changes the current disk address to the start of the
- i-node.
- .PP
- Once an i-node is found, all of the freed blocks may be
- recovered by checking the i-node zone fields, using 'G'
- to go to a block, writing it back out using 'w', going
- back to the i-node with fIpfR and advancing to the next
- block. This file extraction process is automated by using
- the fIXfR command, which goes through the i-node, indirect
- and double indirect blocks finding all the block pointers
- and recovering all the blocks of the file.
- .PP
- The fIXfR command closes the current output file and asks
- for the name of a new output file. All of the disk blocks
- must be marked as free, if they are not the command stops
- and the file must be recovered manually.
- .PP
- When extracting lost blocks fIdefR will maintain *(OQholes*(CQ in
- the file. Thus, a recovered sparse file does not allocate
- unused blocks and will keep its efficient storage scheme.
- This property of the fIXfR command may be used to move a sparse
- file from one device to another.
- .PP
- Automatic recovery may be initiated by the fB(enrfR option on
- the command line. Also specified is the path name of a
- file just removed by fIunlinkfR. fIDefR determines which
- mounted file system device held the file and opens it for
- reading. The lost i-node is found and the file extracted by
- automatically performing an fIxfR and an fIXfR command.
- .PP
- The recovered file will be written to fI/tmpfR. fIDefR will
- refuse to automatically recover a file on the same file
- system as fI/tmpfR. The lost file must have belonged to the
- user. If automatic recovery will not complete, then manual
- recovery may be performed.
- .SS "Miscellaneous"
- .PP
- The user can terminate a session with fIdefR by typing
- fIqfR, CTRL-D, or the key associated with SIGQUIT.
- .PP
- The fImfR command invokes the s-2MINIXs0 fIshfR shell as a subprocess.
- .PP
- For help while using fIdefR use fIhfR.
- .SS "Command Summary"
- .LP
- .ta 0.25i 1.0i 1.5i
- .nf
- .sp
- PGUP b Back one block
- PGDN f Forward one block
- HOME B Goto first block
- END F Goto last block
- UP u Move back 2/64/256 bytes
- DOWN d Move forward 2/64/256 bytes
- LEFT l Move back 32/1/4 bytes
- RIGHT r Move forward 32/1/4 bytes
- g Goto specified block
- G Goto block indirectly
- i Goto specified i-node
- I Filename to i-node
- / Search
- n Next occurrence
- p Previous address
- h Help
- EOF q Quit
- m s-2MINIXs0 shell
- v Visual mode (w b m)
- o Output base (h d o b)
- c Change file name
- w Write ASCII block
- W Write block exactly
- x Extract lost directory entry
- X Extract lost file blocks
- s Store word
- .fi
- .sp
- NOTES:
- When entering a line in response to a prompt from fIdefR
- there are a couple of editing characters available. The
- previous character may be erased by typing CTRL-H and the
- whole line may be erased by typing CTRL-U. ENTER terminates
- the input. If DELETE or a non-ASCII character is typed
- then the command requesting the input is aborted.
- .PP
- The commands fIGfR, fIsfR and fIXfR will only function if
- the current visual display mode is *(OQword.*(CQ
- The commands
- fIifR, fIIfR and fIxfR change the mode to *(OQword*(CQ on
- completion. The commands fIGfR and fI/fR change the mode
- to *(OQblock*(CQ. These restrictions and automatic mode
- conversions are intended to aid the user.
- .PP
- The *(OQmap*(CQ mode uses special graphic characters, and
- only functions if the user is at the console.
- .PP
- fIDefR generates warnings for illegal user input or if
- erroneous data is found on the disk, for example a
- corrupted magic number. Warnings appear in the middle
- of the screen for two seconds, then the current page
- is redrawn. Some minor errors, for example, setting
- an unknown visual mode, simply ring the bell. Major
- errors, for example I/O problems on the file system
- device cause an immediate exit from fIdefR.
- .PP
- The i-node and zone bit maps are read from the device
- when fIdefR starts up. These determine whether *(OQin use*(CQ
- or *(OQnot in use*(CQ is displayed in the status field at
- the top of the screen. The bit maps are not re-read
- while using fIdefR and will become out-of-date if
- observing a mounted file system.
- .PP
- fIDefR requires termcap definitions for *(OQcm*(CQ and *(OQcl*(CQ.
- Furthermore, *(OQso*(CQ and *(OQse*(CQ will also be used if available.
- The ANSI strings generated by the keypad arrows are recognized,
- as well as any single character codes defined by *(OQku*(CQ,
- *(OQkd*(CQ, *(OQkl*(CQ and *(OQkr*(CQ.
- .SS "Author"
- .PP
- The fIdefR program was written by Terrence Holm.