WDe Copyright(C)2005 Ben Cadieux (ben.cadieux@gmail.com)

WDe User Manual

  0.0       Hot-Key Quick Reference
  1.0       Initial Screen and Commandline
  2.0       Basics
  2.1       Screen Regions
  2.2       Navigation and Editing
  3.0       Drive Support
  3.1       Physical Disks
  3.1.1     BIOS Notes
  3.2       Logical Drives
  3.3       CD-Rom Drives
  3.4       Disk Images

  4.0       Menu System
  4.1       Basics
  4.2       Menu Items & Submenus
  4.2.1     Item "Help"
  4.2.2     Menu "File"
  4.2.2.1   Menus "Save to File" & "Restore from File"
  4.2.2.1.1 Item "Input"
  4.2.2.1.2 Item "MBR/Boot Sector"
  4.2.2.1.3 Item "Partition 1/2/3/4"
  4.2.2.1.4 Item "Fat1/Fat2"
  4.2.2.1.5 Item "Root"
  4.2.2.1.6 Item "Partition"
  4.2.2.1.7 Item "Chain"
  4.2.2.2   Item "Change Disk"
  4.2.3     Menu "Goto"
  4.2.4     Menu "View"
  4.2.4.1   View "Directory"
  4.2.5     Menu "Find"
  4.2.6     Menu "Functions"
  4.2.6.1   Item "Fill"
  4.2.6.2   Item "Restrict"
  4.2.6.3   Item "UnFormat"
  4.2.6.4   Item "UnDelete"
  4.2.7     Item "Save"

  5.0       Error Messages
  5.1       "No (More) Matches Found"
  5.2       "No more free space at offset X: T(runcate) or A(bort)?"
  5.3       "File Too Small"
  5.4       "File Too Corrupt"
  5.5       "Error Reading File"
  5.6       "Error Writing File"
  5.7       "Error Creating File"
  5.8       "Invalid Sector Range"
  5.9       "Error Reading Sector"
  5.9.1     "Abort/Zero-Fill"
  5.9.1     "Abort/Skip/Ignore All"
  5.10      "Error Writing Sector"
  5.11      "File Not Found"
  5.12      "Invalid Start Cluster"
  5.13      "Recursive Link Not Found"
  5.14      "Fat Table Not Blank"
  5.15      "Root Not Blank"
  5.16      "No Directories Found"
  5.17      "No search string defined yet"
  5.18      "File size cannot exceed 4GB-1"
  5.19      "Sector size exceeds 4KB"
  5.20      "No Directory Entry found with Start Cluster XXX"
  5.21      "End of Cluster Chain reached"



  0.0 - Hot-Key Quick Reference

    Universal Keys:

    Escape        - Back out of a menu (Quit also)
    Arrow Keys    - Change offset within data
    Home/End      - Move cursor to start/end of data
    PageUp        - Back 1 sector
    PageDown      - Forward 1 sector
    Ctrl+PageUp   - Back 100 sectors
    Ctrl+PageDown - Forward 100 sectors
    Tab           - Switch to/from ascii editing
    Shift+Tab     - Switch between hex and binary
    Ctrl+End      - Jump to last sector on drive
    Ctrl+Home     - Jump to first sector on drive
    Ctrl+Up       - Pop sector from stack and jump to it

    Keys in FAT area of FAT partitions:

    Ctrl+Right    - Jump to next entry in chain
    Ctrl+Left     - Search previous entry in chain
    Enter         - Jump to current entry's data
    Ctrl+Enter    - Search directory entry with matching start cluster

    Keys in Data area of FAT partitions:

    Ctrl+Right    - Jump to next cluster in chain
    Ctrl+Left     - Search previous cluster in chain
    Ctrl+Enter    - Jump to FAT entry for this cluster
    Alt+Right     - Forward 1 cluster
    Alt+Left      - Back 1 cluster
    Enter         - If in directory, jump to start cluster of entry



  1.0 - Initial Screen and Commandline

     When starting, WDe optionally accepts command line arguments - to make
    WDe display the currently accepted arguments, run "WDe -?".
    
     If no (valid) argument is given on the command line, the user will be
    prompted ("Drive: ") to specify the disk or drive to be examined. A digit
    will select a physical disk while a letter specifies a logical drive. If
    a physical disk was selected and the system has floppies installed, the
    user will additionally be asked to select between hard disks and floppies.

     The TAB key may be pressed to change the "Drive:" prompt to a "File:"
    prompt; a full file/path name can then be entered, WDe will interpret this
    file as a physical disk. The "restrict" function - see below for details -
    may then be used to make WDe interpret (parts of) the file as logical drive.



  2.0 - Basics

    2.1 - Screen Regions

      The WDe screen has the following structure:

      - The top line, showing
        + the offset where the cursor currently is positioned within
          the sector,
        + the current sector number,
        + the current region ( boot, FAT, root directory, data),
        + for FAT file systems, the current cluster# or - if the current
          sector is within a FAT - the entry#,
        + for physical disks, if available, the CHS information.
      - The sector region, consisting of 32 lines, showing
        + on the left the offset,
        + in the middle the contents in hexadecimal or binary,
        + on the right the contents in ascii.
      - The view region, starting at line 34, max. 7 lines, showing
        the interpreted data of parts of the current sector.
      - The menu bar, at the bottom line.

      For FAT file systems, the drive space is divided into four parts,
      shortly called "boot/reserved", "FAT", "root" and "data". While in
      the "data" part, WDe will show the cluster# the current sector 
      belongs to. Furthermore, the number will be written in light green
      if the cluster is part of a chain in the FAT, that is, it is - or
      rather: should be - associated with a file.


    2.2 - Navigation and Editing

      2.2.1 Editing

        All hex and ascii editing must be saved with 'F1' before changing
        sectors or quitting the program as changes will be lost.

        The cursor keys and the Home/End-keys are used to move the cursor.

        Hitting TAB will switch between hex & ascii editing.

        If you hit the SHIFT+TAB key combination, you'll switch between
        hex and binary editing.  In this mode, you can use 0 and 1 to set
        bits or use the space bar to invert them.

      2.2.2 Generic Navigation

        PageUp/Down changes the current sector being edited; however, if
        the sector size is > 512, Page Up/Down will just change the current
        offset by 512 if the sector's end hasn't been reached yet on the 
        screen. Ctrl+PageUp/Down will jump by 100 sectors at a time.

        Ctrl+Home/End jump to the beginning and end of the drive.

      2.2.3 Keys for Navigating the FAT File System 

        When in the FAT area:

        Ctrl+Right: will jump to the next entry in the FAT chain, if there
                    exist one.
        Ctrl+Left:  will attempt to recurse to the previous entry in the FAT.
                    This implies scanning the FAT, first descending ( that
                    is, to lower cluster numbers ) and then, if no linking
                    entry has been found this way, ascending. Usually the
                    predecessor is either found instantly or not at all - the
                    latter case should mean that the entry is the start of a
                    chain.
        Enter:      will jump directly to the cluster's first sector in the
                    data area. 
        Ctrl+Enter: will scan the directory tree for an entry with a starting
                    cluster matching the one the cursor is currently on.
                    NOT implemented for exFAT yet!

       When in the data area:

       Ctrl+Right:  will jump directly to the cluster connected to it in
                    the FAT chain.
       Ctrl+Left:   will search the entry linking to this cluster' entry in
                    the FAT and jump to its associated cluster. See the notes
                    for Ctrl+Left in the FAT area.
       Ctrl+Enter:  will jump to the corresponding FAT entry.
       Alt+Left:    will jump to the first sector of the previous cluster.
       Alt+Right:   will jump to the first sector of the next cluster.

       Additionally, when in a directory:

       Enter:       will jump to the beginning of the first cluster of that
                    entry - if the entry is associated with a cluster at all,
                    which isn't true for entries used to store long filenames,
                    for example.

       Hitting Enter or Ctrl+Enter keys will save the current sector# on a
       stack; using Ctrl+Up will retrieve this information and thus allow
       to go back to the previous position.

      2.2.4 Other Navigation

       Hitting Ctrl+Enter in sector 0 of a logical drive will cause WDe
       to change to the physical drive that partition belongs to, if it exists.
       However, this is usually not a very reliable information, for example,
       ramdisks won't have a physical drive associated with them at all - or
       a physical disk may have been moved to another computer, residing as
       quite another disk# there.



  3.0 - Drive Support:

    3.1 - Physical disks (0, 1, 2, etc)

      WDe supports physical disks using int13h's ah=42h for reads and
      ah=43h for writes.  If these are not supported, WDe will default
      to 02h/03h.  Drive information is obtained with ah=48h and ah=08h
      respectively.  Note that the 'CHS:' information rolls over to 0
      when a high enough sector is reached if the drive is big enough.

      3.1.1 - BIOS Notes

        Physical disks read by WDe are often limited by the BIOS.
        A quick calculation should be done by going to the last sector
        of the disk, multiplying that value by 512 and ensuring that
        the result is the actual size of the disk.

        If not, then it's likely that your BIOS needs to be updated
        to support the drive.  It's also possible that WDe contains
        a bug and is not reading it correctly.

    3.2 - Logical drives (A:, C:, etc)

      WDe uses int21h/ax=7305h to do logical drive reading/writing,
      (DOS 7.x functions) and int 25h/26h (cx=0FFFFh) for non-fat32
      partitions/drives.  All drive information is obtained from
      the bootsector, with the exception of the sector size, which
      is preferably be read from DOS by using function "get DPB".
       Note that when running in Windows XP or Vista, the file system
      of the logical drive may be NTFS or exFAT. While exFAT is supported,
      NTFS is not and hence navigation inside WDe is rather limited then.

    3.3 - CD-Rom drives

      For CD-Rom drives, WDe uses int2Fh's ax=1510h to read, though
      drives cannot be written to as it is not supported by any known
      CD-RW drives although WDe should write correctly if a drive were
      to support it.  Drive parameters are obtained from the first
      sector.  Due to CD-Rom sector size (2048/2352 bytes), WDe addresses
      them in separate sections.

    3.4 - Disk Images

      WDe reads files (hit tab when queried for drive) which can then
      be treated as physical or logical drives using the "Restrict"
      function.



  4.0 - Menu System

    4.1 - Basics

      The menu is controlled by the function keys on the keyboard,
      it is shown at the bottom of the screen when a drive is being
      edited.

      Some menu items open up new "submenus" which will then change
      the use of the function keys; you can use the 'Escape' key to
      go back to the previous menu.

      To quit WDe, pressing 'Escape' when at the main menu will
      show a Yes/No prompt to quit; hitting escape again will
      go back to the menu.

      If the user is prompted to enter a numeric value, and that value
      is not accepted by WDe ( because it's out of range or otherwise
      invalid ), a beep is emitted. Note that cluster numbers must be
      entered in hexadezimal.


    4.2 - Menu Items & Submenus

      4.2.1 - Item "Help"

        This menu option displays the quick key reference that shows 
        how to navigate inside WDe.

      4.2.2 - Menu "File"

        This submenu gives two more submenus. The first is designed
        to save sectors from the drive being edited to a file.  The
        second restores sectors saved to file back to a drive. Note 
        that currently, due to file size restrictions, files cannot
        be saved that will exceed 2GB ( or 4GB-1, if the underlying
        DOS allows that ).


        4.2.2.1 - Menus "Save to File" & "Restore from File"

          4.2.2.1.1 - Item "Input"

          Sectors are saved or restored beginning at the current
          position on the drive being edited; the user is prompted
          for the number of sectors to save/restore.

          4.2.2.1.2 - Item "MBR/Boot Sector"

          The MBR/Boot Sector can be saved/restored from/to file.
          These are always considered to be at sector 0 and
          considered to take 1 sector.

          4.2.2.1.3 - Item "Partition 1/2/3/4"

          These functions will save/restore the entire partition
          selected to a file.

          4.2.2.1.4 - Item "Fat1/Fat2"

          The first and second fat may be saved/restored.
          Fat parameters are calculated from the bootsector.

          4.2.2.1.5 - Item "Root"

          Saves or restores either the root for FAT12/FAT16 or the
          first cluster of it for FAT32/exFAT to/from file.

          4.2.2.1.6 - Item "Partition"

          Saves/restores the entire current partition to/from file.

          4.2.2.1.7 - Item "Chain"

           This option will appear when you're currently in the FAT table
          or in the 32 bytes belonging to a directory entry.  Using this
          option can save/restore the data in a fat or file chain to/from
          a specified file. Note that, when restoring, the chain itself is
          never changed, just the corresponding sector contents.
           When saving a file chain to a file the user may be prompted after
          the copy process whether the saved file should be truncated to the
          size stored in the directory entry. So this option actually allows
          to copy files from a file system that is not natively supported by
          the OS ( i.e. FAT32 and exFAT ).
           When restoring a file chain, there is no check whether the file
          sizes differ. If the source file is just 1 byte long, but the file
          chain consists of clusters covering 1 MB, just the first byte is
          "restored", the rest of the chain remains untouched. As already
          mentioned, the chain itself - and, in case of file chains, the 
          directory entry - are never modified.

        4.2.2.2 - Item "Change Disk"

         The third option in menu "File "is to change the current drive.
         See the comments for the initial screen for more details.

      4.2.3 - Menu "Goto"

        This feature jumps to a particular sector, cluster or disk area
        for your editing convenience.

      4.2.4 - Menu "View"

        The view feature fills in the blank space below the hex editing
        area with extra details for boot sectors, mbrs, fats and
        directories when chosen. "Auto" view lets WDe decide what view
        seems best, anything else forces that selected view to be used.

        4.2.4.1 - View "Directory"

          If your view is set to 'directory', hitting enter in any of the
          32 bytes belonging to a directory entry will cause WDe to jump
          to the first sector of the first cluster of that file or
          directory.

      4.2.5 - Menu "Find"

        Search functions may be used to find strings, hex, FATs,
        boot sectors, mbrs, and directories.  This is convenient for data
        recovery if backups are stored, or the originals are lost in a
        disaster. Note that search for string and hex start at current
        cursor position, while search for the other items start at the
        current sector's start. Find "Next" searches for occurances
        of ascii strings or hex strings, the character at the current
        cursor position is ignored.

      4.2.6 - Menu "Functions"

        4.2.6.1 - Item "Fill"

          The fill functions allow the filling of sectors with a
          repeated string or byte.  It also has an invert function
          which takes each byte and reverses each bit; this is
          ideal for securely overwriting data when used in conjunction
          with the random fill function (which fills with random data).

          The incremental function is ideal for rebuilding FAT tables
          in a very quick and dirty manner.  The decremental function
          was added because it mostly reuses the same code as the incremental
          functions although has no obvious purpose.

          Note that filling starts from the current sector.

        4.2.6.2 - Item "Restrict"

          This function was designed to set a range of sectors as a
          different type of drive.  For example, if DOS was not mounting
          Drive C (typing "C:" gives "invalid drive specification"), then
          we could load the physical drive it belongs on ("0"), locate
          the bootsector to that partition and then restrict it as a
          fat drive.  This would allow us to jump along the fat chain,
          jump to the root, etc, to verify drive integrity.  This means
          that recovery operations may be made on FAT32 or exFAT disks
          under DOS versions that do not support those file systems.

          Another use is specifying the drive type of an image file
          being read by WDe.

          Restrict gives an "Above/Below" prompt.  If Above is chosen,
          the current sector will now be considered Sector 0 and any
          sectors "above" (lower than the current sector) are inaccessible.
          "Below" will merely make all sectors below (greater than) the
          current sector innaccessible.

          When "Above" is chosen, an option to set the drive type is also
          provided; L(ogical) or P(hysical). L(ogical) will interpret the new
          "Sector 0" as a bootsector and sets all variables accordingly;
          P(hysical) treats the drive as a hard drive with a master boot record
          - that's likely to be useful if one has to navigate thru extended
          DOS partitions. If L(ogical) is selected and the bootsector contains
          no data that can be interpreted as FAT, NTFS or exFAT, then the
          result might be "unsatisfying".

        4.2.6.3 - Item "UnFormat"

          This function is only in the menu when editing a FAT partition.
          It will detect whether or not the FAT and Root are blank before
          continuing with an UnFormat.  Note that if the partition has been
          labelled after it was formatted, the label may need to be removed
          before using this function or the root will not be considered to
          be blank (as the label may be stored as a 32-byte entry in the root).

          UnFormat only writes to the FAT and Root; so if an unformat
          is unsuccessful, reformatting the drive will restore it to the
          state it was in before it was unformatted.

          Unformatting a drive will not restore it to the state it was in
          before a format; the process should only be used in hopes of
          recovering required data before formatting the drive again for use.

          Note that keeping a well defragmented drive increases the chances
          of data being recoverable with unformat.

        4.2.6.4 - Item "UnDelete"

          This function only appears when the sector being edited is
          detected as being a directory and the cursor is blinking
          somewhere within the 32 bytes belonging to a deleted file.

          It is recommended that multi-clustered directories be
          undeleted manually; locating their clusters cannot
          be accurately (or easily) done by a piece of software.

          Undeletion works by attempting to "guess" which clusters
          belong to a file; the concept is unreliable at best,
          always check files once they're undeleted.

          Note that keeping a well defragmented drive increases the chances
          of data being recoverable with undelete.  Also be aware that WDe
          is very picky about what a "directory" is; if no "UnDelete" option
          is coming up when in the 32-bytes of a deleted file, there is
          likely some sort of invalid data stored in the directory.

      4.2.7 - Item "Save"

        This menu option saves any manual changes made to the sector
        currently being edited.


  5.0 - Error Messages

    5.1 - "No (More) Matches Found"

      This error simply means that WDe has reached the end of the drive and
      whatever it was searching for (using the "Find" functions) was not
      found.

    5.2 - "No more free space at offset X; T(runcate) or C(ancel)?"

      This is an UnDelete error; it means that there are not enough free
      contiguous clusters (anymore) where the file was originally stored.
      Pressing 'T' will undelete the file, but truncate it to the size
      as displayed; 'C' will leave everything as it is.

    5.3 - "File Too Small"

      This error occurs when attempting to read a file as a disk image when
      it is smaller than 1 sector.

      This error also occurs when attempting to restore a greater number of
      sectors to disk from file than the file is large enough to provide.

    5.4 - "File Too Corrupt"

      This is an UnDelete error; the first cluster of the file is already
      in use by another file on the drive, therefore at least the first
      portion of the file is overwritten.  Users should manually delete
      a file when this occurs.
       The error message will also occur if one has manually edited the
      first byte of a directory entry to E5h and then tries to "undelete"
      the corresponding file. In this case just change the byte back to a
      valid filename char.

    5.5 - "Error Reading File"

      This error is quite rare; it may occur for any number of reasons,
      such as part of the file is being stored on damaged media.

    5.6 - "Error Writing File"

      This error may occur for any number of reasons; damaged media is
      a strong possibility.

    5.7 - "Error Creating File"

      This error will typically occur when the user enters an invalid path
      for the file to be stored in; or the media to be recorded to is
      write-only; or a directory of the specified name exists.

    5.8 - "Invalid Sector Range"

      This error means that the range of sectors to be written to or read
      from is not between the valid first and last sector of the drive being
      edited.

    5.9 - "Error Reading Sector"

      This can mean that an attempt has been made to read a sector outside
      the valid first and last sector of a drive.

      The error can also mean that the sector attempting to be read is
      physically damaged.

      5.9.1 - "Abort/Zero-Fill"

        In some cases when there is an error reading a sector, such as when
        writing a number of sectors to file, this query will appear.  The
        abort option will stop writing the file, whereas the "Zero-Fill"
        option will write null characters to the file where the unreadable
        sector should have been written.

      5.9.1 - "Abort/Skip/Ignore All"

        When searching and an "Error Reading Sector" message appears; this
        set of options might be displayed.  The abort option will stop
        searching, the "Skip" option will ignore the error and read the
        next sector, and finally the "Ignore All" error will skip any
        sectors that cannot be read and continue searching.

    5.10 - "Error Writing Sector"

        If a sector cannot be written to, it's possible that the drive
        being written to is read-only media.

    5.11 - "File Not Found"

        This error occurs when a file to be read does not exist or the
        path to it is invalid.

    5.12 - "Invalid Start Cluster"

        This error is for UnDelete and Chain Saving/Restoring functions.
        It means that the very first cluster is not within the valid first
        and last cluster numbers for the particular drive.

    5.13 - "Recursive Link Not Found"

        This message may appear when Ctrl-Left is pressed while in the FAT
        or data part of a disk. WDe first scans the FAT from the current
        entry to the start, then from the current entry to the end to find
        the linking entry - the predecessor in the chain. If no such
        predecessor is found, this message is displayed - the start of the
        chain has been reached. It's not an error, unless there exists no
        directory entry with a matching "start cluster" entry.

    5.14 - "Fat Table Not Blank"

        This error is specific to UnFormat; the FAT Table must not contain
        any entries; if it does then it is not fully formatted.

    5.15 - "Root Not Blank"

        This is a somewhat unnecessary safety precaution taken by UnFormat;
        if the FAT is blank but there exists an entry in the root, this
        error occurs.

        It typically means that there is a label in the root; since it's
        not valid to have a file or directory on the partition that has
        no clusters.  If the label is removed, this error should no longer
        occur.

    5.16 - "No Directories Found"

        This is another UnFormat error; it means that the entire drive has
        been scanned but no valid directories were found.  Since UnFormat
        can only recover files within directories, the UnFormat is aborted.

    5.17 - "No search string defined yet"

        This is emitted by "Find Next" if no search string (via F1 or F2 in
        the find submenu) has been defined yet.

    5.18 - "File Size cannot exceed 4GB-1"

        This is a limitation of DOS's FAT file system. The message may appear
        if a large partition is to be saved to a file.

    5.19 - "Sector Size exceeds 4KB"

        WDe's buffer for sectors is currently limited to a size of 4 kB.
        A device ( or a boot sector, for logical disks ) that reports a larger
        size will be rejected.

    5.20 - "No Directory Entry found with Start Cluster XXX"

        Appears if Ctrl-Enter has been hit in the FAT area for an entry that
        is not the start of a chain - only the start cluster# is stored in the
        directory entries and can therefore be found by a directory scan. So
        to find a directory entry associated with a FAT chain first find the
        start of the chain ( by pressing Ctrl+Left, repeatedly ).

    5.21 - "End of Cluster Chain reached"

        This message may occur when Ctrl-Right is pressed while in the data
        part of a disk. It means that the corresponding FAT chain has reached
        its end. It's only an error if the end of the chain is "preliminary".


