This text tells you how to use DEBUG to find your way around a diskette or hard disk. Its main purpose is to guide you in the event you need to "unerase" a file. To begin, enter the DEBUG command at the DOS prompt. Subcommands of DEBUG are shown in this text following the hyphen prompt (-). You should not attempt this procedure unless you're willing to run the risk of trashing your disk, but if done carefully, it is safe. Notation -------- All numbers given in this text are in hex. You should have a hex calculator handy, or know how to do arithmetic in hex. The disk drive will be denoted "b", where A: is 0, B: is 1, etc. When you're asked to find a 2- or 3- byte number beginning at a certain offset, remember to treat the left-most byte as the least significant. For example, if a block of data looks like: 2B2A:0000 EB 42 90 50 53 41 20 31-2E 30 34 00 02 10 01 00 2B2A:0010 02 00 04 07 A3 F8 08 00-11 00 04 00 11 00 00 00 and you're asked to find the 2-byte value at offset 0011, you would say "0400", because you reverse the order of the bytes. Basic Disk Organization ----------------------- The disk contains the following data areas, in this order: BIOS Parameter Block (BPB) File Allocation Table (FAT) (Usually 2 copies of the FAT) Root Directory Files Area The disk is divided into Sectors, which are the smallest unit of storage that can be read or written to the disk. DOS gathers sectors into "Clusters", which contain a power of 2 sectors each. The BIOS Parameter block gives the sector size, and the number of sectors per cluster. It also gives the number and size of the FATs, and the number of 20-byte entries in the Root Directory. This information is all we need to know to begin navigating. The BIOS Parameter Block ------------------------ The first step is to read the BIOS parameter block, and extract some key information: -L 0 d 0 1 -D 0 L 20 This loads into offset 0 of storage from drive d, beginning at sector 0, for a length of 1 sector. Then data is dumped from storage location 0 for a length of 20 bytes. Sector 0 contains the BIOS Parameter Block, or BPB. Enter information from the BPB into a worksheet that looks like this: Offset Meaning Value 0B Bytes per sector ___ ___ (2 bytes) 0D Sectors per cluster ___ (1 byte) 0E Reserved sectors ___ ___ (2 bytes) 10 Number of FATs ___ (1 byte) 16 Sectors per Fat ___ ___ (2 bytes) 11 Number of dir. entries ___ ___ (2 bytes) 13 Total sectors in volume ___ ___ (2 bytes) Total Clusters in Volume ______ Calculate as follows: Total sectors in volume / Sectors per cluster, rounded up. Sector of Root Directory ______ Calculate as follows: Reserved sectors + (Number of FATs * Sectors per FAT) Number of Root Sectors ______ Calculate as follows: Number of dir. entries * 20 / Bytes per Sector Sector of Files Area ______ Calculate as follows: Sector of Root Directory + Number of Root Sectors Navigating to a Sub-Directory ----------------------------- Once you've filled out the worksheet above, you're ready to start traversing the directory tree. Begin by loading the root directory into memory: -L 0 d rs rl where d is the drive number, as usual, and rs is the Sector of Root Directory, and rl is the Number of Root Sectors. Then search for a subdirectory as follows: -S 0 L rl 'DIRNAME ' When you find the directory entry, dump it out like this: -D aaaa L 20 Where aaaa is the value displayed by the Search command. Look at offset +1A (location aaaa+1A) in the directory. There, you'll find the Cluster Number of the subdirectory. To convert from Cluster Number to Sector Number, subtract 2, then multiply by Sectors Per Cluster, then add Sector of Files Area. Repeat these steps for every subdirectory as you traverse the tree, where rs is the newly calculated Sector Number, and rl is the number of Sectors per Cluster. When you come to the directory that contains the file you're looking for, FILENAME.EXT in this example, search for it as follows: -S 0 L rl 'FILENAMEEXT' Notice that the dot between FILENAME and EXT is not part of the directory entry. If this file had been erased, its first byte would have been overlaid by an E5 character. In this case, search as follows: -S 0 L rl E5 'ILENAMEEXT' When you've found the directory entry of this file, display it using the command: -D aaaa l 20 To unerase the file, change the first character of the filename back to a legitimate character, as follows: -E aaaa 'F' Where F is the first character of the filename. Then, to write the change back to the disk, issue the command -W 0 d rs rl Where the d, rs, and rl parameters are *exactly* the same as the most recent L command. If you've erased a file, and the file is longer than a single cluster, you'll need to re-build the chain of clusters. To do this, you'll need to search the disk to find a cluster that looks like your file. Hopefully, you'll be able to find it by searching the disk sequentially from the cluster given by the directory entry. You'll need to look only at free clusters, indicated by a zero entry in the FAT. Finding the Next Cluster ------------------------ The information presented up to this point works well for the root directory, and for any subdirectories small enough to contain only one cluster. If a subdirectory is longer than one cluster, you'll need to know how to follow cluster chains in the FAT. The FAT contains an entry for every cluster, giving the number of the next cluster, or FFF (or FFFF) if this is the last cluster in a file. If there are 4087 or more Total Clusters in Volume, the FAT consists of 16-bit entries. If there are fewer clusters, the FAT consists of 12-bit entries. To load the FAT into memory, issue: -L 0 d fs fl where fs is the number of reserved sectors, and fl is the number of sectors per FAT. Given an initial cluster number, follow the instructions for your FAT entry size to find the next cluster in the file. 12-bit FAT entry instructions First, divide the cluster number by two, then multiply by three. This gives an offset aaaa in the FAT. Dump it using the command -D aaaa L 3 Look at the three bytes at this offset, which I'll represent as BC zA xy If the original cluster number was even, the new cluster will be ABC. If the original cluster number was odd, the new cluster will be xyz. If ABC (or xyz) is FFF, you've reached the end of the file. Otherwise, continue the process, making a list of all clusters in the file. 16-bit FAT entry instructions Multiply the cluster number by two, giving an offset aaaa in the FAT. Dump it using the command -D aaaa L 3 The new cluster number is displayed. If it is FFFF, you've reached the end of the file. Otherwise, continue the process, making a list of all clusters in the file.