.so mnx.mac .TH DE 9 .CD "de \(en disk editor" .SX "de\fR [\fB\(enw\fR] \fIblock_device" .SX "de \(enr \fIfile .FL "\(enr" "Recover a file that has been removed" .FL "\(enw" "Enable writing, so device can be modified" .EX "de \(enr /usr/ast/prog.c" "Undo the effects of: \fIrm /usr/ast/prog.c\fR" .EX "de \(enw /dev/fd0" "Edit \fI/dev/fd0\fR for writing" .PP The \fIde\fR program allows a system administrator to examine and modify a \s-2MINIX\s0 file system device. Commands are available to move to any address on the disk and display the disk block contents. This information may be presented in one of three visual modes: as two-byte words, as ASCII characters or as a bit map. The disk may be searched for a string of characters. If the \fB\(enw\fR option is given, \fIde\fR will open the device for writing and words may be modified. Without this flag, writing is prohibited. Lost blocks and files can be recovered using a variety of commands. The \fB\(enr\fR option supports automated recovery of files removed by \fIunlink\fR. .SS "Positioning" .PP Disks are divided into blocks (also called \*(OQzones\*(CQ) of 1024 bytes. \fIDe\fR keeps a current address on the disk as a block number and a byte offset within the block. In some visual modes the offset is rounded off, for example, in \*(OQword\*(CQ mode the offset must be even. .PP There are different types of blocks on a file system device, including a super block, bit maps, i-nodes and data blocks. \fIDe\fR knows the type of the current block, but will allow most positioning commands and visual modes to function anywhere on the disk. .PP The \fIf\fR command (or PGDN on the keypad) moves forward to the next block, similarly \fIb\fR (PGUP) moves backwards one block. \fIF\fR (END) moves to the last block and \fIB\fR (HOME) moves to the first block. .PP The arrow keys (or \fIu\fR, \fId\fR, \fIl\fR, and \fIr\fR) change the current address by small increments. The size of the increment depends on the current display mode, as shown below. The various sizes suit each display and pointers move on the screen to follow each press of an arrow key. .HS .if t .ta .75iR 1.5iR 2.25iR 3.0iR 3.75iR .if n .ta .75i 1.5i 2.25i 3.0i 3.75i .nf \fB Mode Up Down Left Right\fR Word \(mi2 +2 \(mi32 +32 Block \(mi64 +64 \(mi1 +1 Map \(mi256 +256 \(mi4 +4 .fi .HS The \fIg\fR command allows movement to any specified block. Like all commands that take arguments, a prompt and subsequent input are written to the bottom line of the screen. Numerical entry may be decimal, octal or hexadecimal, for example 234, \(mi1, 070, 0xf3, \(miX3C. .PP While checking an i-node one may want to move to a block listed as a zone of the file. The \fIG\fR command takes the contents at the current address in the device as a block number and indirectly jumps to that block. .PP The address may be set to the start of any i-node using the \fI\fR command and supplying an i-node number. The \fII\fR command maps a given file name into an i-node address. The file must exist on the current device and this device must be mounted. .SS "The Display" .PP The first line of the display contains the device name, the name of the current output file (if one is open) and the current search string. If \fIde\fR is being run with the \fB\(enw\fR option then the device name is flagged with \*(OQ(w).\*(CQ If a string is too long to fit on the line it is marked with \*(OQ...\*(CQ. .PP The second line contains the current block number, the total number of blocks, and the type of the current block. The types are: boot, super, i-node bit map, zone bit map, i-nodes and data block. If the current address is within a data block then the string \*(OQin use\*(CQ is displayed if the block corresponds to a set in the zone bit map. .PP The third line shows the offset in the current block. If the current address is within either the i-node or zone bit maps then the i-node or block number corresponding to the current bit is shown. If the current address is within an i-node then the i-node number and \*(OQin use\*(CQ status is displayed. If the address is within a bit map or i-node block, but past the last usable entry, then the string \*(OQpadding\*(CQ is shown. .PP The rest of the screen is used to display data from the current block. There are three visual display modes: \*(OQword,\*(CQ \*(OQblock,\*(CQ and \*(OQmap.\*(CQ The \fIv\fR command followed by \fIw\fR, \fIb\fR, or \fIm\fR sets the current display mode. .PP In \*(OQword\*(CQ mode 16 words, of two bytes each, are shown in either base 2, 8, 10 or 16. The current base is displayed to the far right of the screen. It can be changed using the \fIo\fR command followed by either an \fIh\fR (hexadecimal), \fId\fR (decimal), \fIo\fR (octal) or \fIb\fR (binary). .PP \fIDe\fR knows where i-nodes are, and will display the contents in a readable format, including the \fIrwx\fR bits, the user name and the time field. If the current page is at the beginning of the super block, or an executable file or an \fIar\fR archive, then \fIde\fR will also inform the user. In all other cases the contents of the 16 words are shown to the right as equivalent ASCII characters. .PP In \*(OQblock\*(CQ mode a whole block of 1024 bytes is displayed as ASCII characters, 64 columns by 16 lines. Control codes are shown as highlighted characters. If the high order bit is set in any of the 1024 bytes then an \*(OQMSB\*(CQ flag is shown on the far right of the screen, but these bytes are not individually marked. .PP In \*(OQmap\*(CQ mode 2048 bits (256 bytes) are displayed from the top to the bottom (32 bits) and from the left to the right of the screen. Bit zero of a byte is towards the top of the screen. This visual mode is generally used to observe the bit map blocks. The number of set bits displayed is written on the far right of the screen. .SS "Searching" .PP A search for an ASCII string is initiated by the \fI/\fR command. Control characters not used for other purposes may be entered in the search string, for example CTRL-J is an end-of-line character. The search is from the current position to the end of the current device. .PP Once a search string has been defined by a use of \fI/\fR, the next search may be initiated with the \fIn\fR command, (a \fI/\fR followed immediately by an ENTER is equivalent to an \fIn\fR). .PP Whenever a search is in progress \fIde\fR will append one \fI.\fR to the prompt line for every 500 blocks searched. If the string is found between the end of the file system and the actual end of the device, then the current address is set to the end of the file system. .PP Some of the positioning commands push the current address and visual mode in a stack before going to a new address. These commands are \fIB\fR, \fIF\fR, \fIg\fR, \fIG\fR, \fIi\fR, \fII\fR, \fIn\fR, \fIx\fR and \fI/\fR. The \fIp\fR (previous) command pops the last address and visual mode from the stack. This stack is eight entries deep. .SS "Modifying the File System" .PP The \fIs\fR command will prompt for a data word and store it at the current address on the disk. This is used to change information that can not be easily changed by any other means. .PP The data word is 16 bits wide, it may be entered in decimal, octal or hexadecimal. Remember that the \fB\(enw\fR option must be specified for the \fIs\fR command to operate. Be careful when modifying a mounted file system. .SS "Recovering Files" .PP Any block on the disk may be written to an output file. This is used to recover blocks marked as free on the disk. A write command will request a file name the first time it is used, on subsequent writes the data is appended to the current output file. .PP The name of the current output file is changed using the \fIc\fR command. This file should be on a different file system, to avoid overwriting an i-node or block before it is recovered. .PP An ASCII block is usually recovered using the \fIw\fR command. All bytes will have their most significant bit cleared before being written to the output file. Bytes containing '\\0' or '\\177' are not copied. The \fIW\fR command writes the current block (1024 bytes exactly) to the output file. .PP When a file is deleted using \fIunlink\fR the i-node number in the directory is zeroed, but before its removal, it is copied into the end of the file name field. This allows the i-node of a deleted file to be found by searching through a directory. The \fIx\fR command asks for the path name of a lost file, extracts the old i-node number and changes the current disk address to the start of the i-node. .PP Once an i-node is found, all of the freed blocks may be recovered by checking the i-node zone fields, using 'G' to go to a block, writing it back out using 'w', going back to the i-node with \fIp\fR and advancing to the next block. This file extraction process is automated by using the \fIX\fR command, which goes through the i-node, indirect and double indirect blocks finding all the block pointers and recovering all the blocks of the file. .PP The \fIX\fR command closes the current output file and asks for the name of a new output file. All of the disk blocks must be marked as free, if they are not the command stops and the file must be recovered manually. .PP When extracting lost blocks \fIde\fR will maintain \*(OQholes\*(CQ in the file. Thus, a recovered sparse file does not allocate unused blocks and will keep its efficient storage scheme. This property of the \fIX\fR command may be used to move a sparse file from one device to another. .PP Automatic recovery may be initiated by the \fB\(enr\fR option on the command line. Also specified is the path name of a file just removed by \fIunlink\fR. \fIDe\fR determines which mounted file system device held the file and opens it for reading. The lost i-node is found and the file extracted by automatically performing an \fIx\fR and an \fIX\fR command. .PP The recovered file will be written to \fI/tmp\fR. \fIDe\fR will refuse to automatically recover a file on the same file system as \fI/tmp\fR. The lost file must have belonged to the user. If automatic recovery will not complete, then manual recovery may be performed. .SS "Miscellaneous" .PP The user can terminate a session with \fIde\fR by typing \fIq\fR, CTRL-D, or the key associated with SIGQUIT. .PP The \fIm\fR command invokes the \s-2MINIX\s0 \fIsh\fR shell as a subprocess. .PP For help while using \fIde\fR use \fIh\fR. .SS "Command Summary" .LP .ta 0.25i 1.0i 1.5i .nf .sp PGUP b Back one block PGDN f Forward one block HOME B Goto first block END F Goto last block UP u Move back 2/64/256 bytes DOWN d Move forward 2/64/256 bytes LEFT l Move back 32/1/4 bytes RIGHT r Move forward 32/1/4 bytes g Goto specified block G Goto block indirectly i Goto specified i-node I Filename to i-node / Search n Next occurrence p Previous address h Help EOF q Quit m \s-2MINIX\s0 shell v Visual mode (w b m) o Output base (h d o b) c Change file name w Write ASCII block W Write block exactly x Extract lost directory entry X Extract lost file blocks s Store word .fi .sp NOTES: When entering a line in response to a prompt from \fIde\fR there are a couple of editing characters available. The previous character may be erased by typing CTRL-H and the whole line may be erased by typing CTRL-U. ENTER terminates the input. If DELETE or a non-ASCII character is typed then the command requesting the input is aborted. .PP The commands \fIG\fR, \fIs\fR and \fIX\fR will only function if the current visual display mode is \*(OQword.\*(CQ The commands \fIi\fR, \fII\fR and \fIx\fR change the mode to \*(OQword\*(CQ on completion. The commands \fIG\fR and \fI/\fR change the mode to \*(OQblock\*(CQ. These restrictions and automatic mode conversions are intended to aid the user. .PP The \*(OQmap\*(CQ mode uses special graphic characters, and only functions if the user is at the console. .PP \fIDe\fR generates warnings for illegal user input or if erroneous data is found on the disk, for example a corrupted magic number. Warnings appear in the middle of the screen for two seconds, then the current page is redrawn. Some minor errors, for example, setting an unknown visual mode, simply ring the bell. Major errors, for example I/O problems on the file system device cause an immediate exit from \fIde\fR. .PP The i-node and zone bit maps are read from the device when \fIde\fR starts up. These determine whether \*(OQin use\*(CQ or \*(OQnot in use\*(CQ is displayed in the status field at the top of the screen. The bit maps are not re-read while using \fIde\fR and will become out-of-date if observing a mounted file system. .PP \fIDe\fR requires termcap definitions for \*(OQcm\*(CQ and \*(OQcl\*(CQ. Furthermore, \*(OQso\*(CQ and \*(OQse\*(CQ will also be used if available. The ANSI strings generated by the keypad arrows are recognized, as well as any single character codes defined by \*(OQku\*(CQ, \*(OQkd\*(CQ, \*(OQkl\*(CQ and \*(OQkr\*(CQ. .SS "Author" .PP The \fIde\fR program was written by Terrence Holm.
