DISKEDIT - A sector editor (Version 1.08)
Instruction Manual...By M.H. Smith 1988
Contents:
1. Using the program
a. Getting started
b. Simple editing
c. More advanced features
2. Reference section
a. The FILE menu
b. The MOVE menu
c. The CHECK menu
d. The SHOW menu
e. The OPTIONS menu
f. Keyboard menu selections
3. Atari disk format
a. Physical disk format
b. Logical disk format
c. Root and sub directories
d. The file allocation table
Section 1: Using the program
Subsection a: Getting Started
Current limitations and warnings
If a single file on the disk is to be edited then it follows that
the disk must have a correct file allocation table. There are checks
in the program to prevent this but it is recommended that you do not
use the Open File menu option on a disk when you know the FAT is
incorrect.
The program is also restricted to editing standard ST disks with 2
512 byte sectors per cluster. This should not be much of a limitation
as I have yet to see a disk that isn't.
The program usually assumes that the Bios Parameter block on the
disk is correct. Because of the way the program works a totally
scrambled BPB could cause trouble if it indicates that there is a
ridiculously large number of sectors on the disk. Again I have yet to
see this happen but I suppose it will occur eventually.
Be careful
It goes without saying that you can do tremendous damage by careless
use of a sector editor. If you have never used one before read the
section on the Atari disk format first. For experimenting purposes
set the write protect on a disk and examine it to get used to the
program. If you ever lose any data follow this procedure:
i) Stay very calm, do not format the disk out of frustration. It
is very likely that most of the data is still on it.
ii) Use a bit or sector copier to make a backup of the corrupt
disk. This may help to identify physically damaged sectors
and you can then work on the backup copy in relative safety.
iii ) Before making any changes be sure you know what you intend to
do, how the disk is organised and how you will be able to
recover if you mess up.
iv) If at all possible do not write on the defective disk. Pull
the sectors containing your data into memory and write them
as a file onto another disk (this is covered later).
Severely damaged disks
If the sectors on the disk are damaged in such a way that the
controller can no longer read them then there is obviously very
little that can be done. Take the advice of the program, open the
window, grab the disk by its edge and throw, hard.
If the file allocation table is defective it makes the job of
recovery more difficult but not impossible. You must locate the
sectors on the disk which contain your data and indicate to the
program the order they should be put in to form the file. You can
usually spot a defective FAT when you ask to see a file and the drive
makes a noise like it is about to break out of the case.
If you are sensible about keeping backups then you have less
worries, usually. If you do not realise a disk is corrupt and use a
sector copier you can back up the corruption (don't laugh I have done
it!)
Subsection b: Simple Editing:
Opening a disk or file
Put the disk in question into the drive and click the Open Disk or
Open File menu options. When you edit a disk you can move about
between and edit all the sectors on that disk (1440 on a double sided
disk). If you open a file you must indicate which one by using the
file selector. You are then confined to the sectors that make up that
file.
The info line of the window changes to actually give information.
It shows the sector you are at, the highest number sector available
and flags which show the state of that sector. These are explained
later.
The window title changes to indicate the disk being edited or the
full path of the file being edited.
Sector zero of the disk or file is brought into memory and displayed
in the window.
Using the editor
The square editing cursor can be moved around with the cursor keys
or you can point and click the mouse where you want the cursor. The
key acts like a left cursor.
To change one of the bytes of the sector either type a character in
the ascii range (code 32 - 126) if the character display is on or
type two hex digits. If you change your mind after one digit has been
typed press the key.
If the new value you supply differs from the one that was there
before then the sector is considered to be changed and an indication
of this appears on the info line of the window.
To move to a different sector press ALT-G or select the Goto Sector
menu option. Assuming the number of the sector that you then supply
is in range then that sector will be read from disk for editing.
Saving Changes
For now ensure that the option Caching To RAM is turned off. When
you move off of a sector that has been changed or close the disk
without writing changes to a sector then an alert appears asking if
you want the changed sector written or not.
You can save the sector yourself at any time by pressing ALT-W or
selecting the Write Sector option. This does not clear the changed
indication as there is still a copy of the original sector in memory
and you may recover it with the Undo Changes option or ALT-U if you
decide that the changes were not really wanted. Then hit ALT-W again.
this only applies until you move off of a sector. More powerful undo
is available with the caching option enabled and is explained in the
next section.
Subsection c: More Advanced Features
Storing changes in RAM
With the caching option turned on and you move off of a sector that
has been changed then it is not written to disk but is stored in
memory, along with a copy of the sector as it was unchanged. If
you move back to this sector it is not read from the disk again but is
obtained from memory. An indication of this is the word
appearing on the info line. Asking for undo changes on such a sector
causes the display to revert to the sector as it was read from disk,
not the last time you edited it. Thus you can be sure that the sector
is then really unchanged.
When the disk or file is closed then you are asked if you want all
the sectors you have changed written back to the disk (if there are
any changes). If you confirm this then they are written. A failed
write cancels the close option so you may select it again and retry.
The amount of free memory determines the number of sectors that you
may store. It is up to you to be sensible.
You can force an unchanged sector to be cached by pressing ALT-C or
selecting the Cache Sector option. The indication of this appears
immediately on the info line.
What have I done?
If you do have caching switched on then you can get a list of the
changes you have made by selecting the Show Changes Made option. This
lists the byte and sector numbers of each change and what the byte
used to be and what you changed it to.
Turn on the hardcopy option to get a printed record of the changes.
Should you decide you need a list of the changes after closing the
disk or file it is still available until the next open which will
clear out the cache.
File recovery, FAT damage
If the disk you are dealing with does not have a damaged FAT then
you can use the Show File Trace option to get a list of the sectors
the file occupies. Remember space is allocated 2 sectors at a time
and these are consecutive logical sectors and note that the show
option only gives the first sector in each cluster.
If the FAT is damaged you must search the disk yourself to find the
numbers of the sectors holding data. Use the Search for match option.
A thing to watch for is when you have several deleted copies of a
file on a disk. There will be several sectors holding similar data so
make sure you get the right one.
So open the disk (don't use open file) and find out where the data
is.
Once you know which sectors you need visit them in the correct order
and press ALT-M or click the Mark Sector option on each. The sector
is brought into the cache and a double indication and
+MARKED+ appears on the info line.
Once all the sectors have been marked then close the disk. You will
then get a message asking whether you want the marked sectors
written. Click Yes and supply a file name to the hideous file
selector. If you only have one drive (shame) change disks first. The
sectors you marked are then written out to form the file in the order
that you marked them.
It is highly likely that the file will not have had a length of a
multiple of 512 so you can now load the file into Tempus or some
inferior editor, chop off the extra garbage and save it again.
Sure is easy eh? maybe it will encourage some more backups to be
made. Seriously: if the FAT is down what did you expect. Automatic
recognition of which sectors happen to be in your file?
Section 2: Reference Section
This section describes all the available menu options and even tells
you what they are supposed to do.
Subsection a: FILE menu
Open Disk
This option opens up a disk for editing. You are asked which drive.
Sector zero is then read in and displayed and you may start editing.
This option clears out any cached sectors remaining from a previous
edit.
Open File
This option opens a file. You must specify the path of the file by
using the file selector and it is then opened. The sectors holding
the file are located and the first is read into memory for editing.
It is displayed as being sector zero though its actual sector number
on the disk will be different. Like the previous option this one
clears out cached sectors.
Cache Sector
This copies the sector being edited into the buffer and indicates
the fact on the info line. If there is no more memory an error
message results. Has no effect if the sector is already in the cache.
Cached sectors may be written back to the disk when the disk or file
is closed.
Mark Sector
This indicates that the sector being edited is the next one in a
file to be recovered. It is copied into the cache and a message to
that effect is displayed on the info line. This option has no effect
if the sector in the buffer has already been marked or you are editing
a file, when it does not make sense, The marked sectors may be
written out when the disk is closed.
Undo Changes
If the sector in the buffer has been changed then it is restored to
the state it was in when read from disk. A cached sector is not
restored to the state before the last edit but back to its original
state. This option does not affect the disk.
Write Sector
This option causes the sector in the edit buffer to be written back
to its correct place on disk. It does not affect the indication of
whether the disk was changed. A copy of the sector as it was still
exists and can be recovered until the sector is left. If caching is
on then a copy of the original sector remains in the cache until it
is cleared.
Close
This option causes the disk or file to be closed. If you have
changed the sector in the buffer you will get the option to write to
disk. Similarly if you have sectors in the cache which are changed or
have marked some sectors you will be asked whether you want these
written out as well. The close option does not destroy data in the
cache so the list of changed sectors is still available until the
next open disk or file.
The same effect as the close menu option can be obtained by clicking
the window close box. Clicking this box without a disk or file open
causes the window to be cleared.
Quit
Can not be selected unless close has been used. This takes you out
of the program.
Subsection b: The MOVE Menu
Goto Sector
After asking for a sector number then that sector will be fetched in
for editing. You cannot exceed the maximum sector as displayed at
the top of the screen. If a file is open then the sector read in will
be the one at the specified position in the file, sector 1 of the
file is never logical sector 1 on the disk.
Goto Offset
This option is only available when you are editing a file. You must
type in a hex offset in bytes from the beginning of the file (2,4 or
6 digits) and the sector and byte position of this offset is
calculated and you are moved there. This is useful when you want to
patch a file you have examined with a monitor. Remember that
executable files have a header which is removed on loading.
Search For Match
If the display selected is character mode then you are asked to
supply a character string to be searched for. Otherwise you must type
a hex string, e.g. 0407 to search for 2 bytes.
Once this has been done the search of the disk or file starts at the
editing cursor position and continues until the pattern is found or
the end of the disk or file is reached.
You can stop the search at any time by holding do the right mouse
button.
If the search was successful then the edit cursor is moved to where
the match was found. If you stopped the search or the pattern was not
found then the cursor is left where it was before the search.
Next Match
This option, available after a successful search, causes the next
match to be sought. It always continues the search from the byte
after the one where the last match occurred. i.e. you may move the
cursor to examine any sectors you like between uses of this option.
Subsection c: The CHECK Menu
Check FAT
The file allocation table on the specified drive is read in and
checked for consistency. Problems detected include chains of clusters
running through bad disk clusters, cycles of clusters and a chain
hitting a cluster marked as free.
A problem not detected is two files pointing to the same chain of
clusters as this would mean reading all the sub-directories on the
disk. This is a rare situation though and should be quite easy to
spot.
Check Boot Sector
This option reads in the boot sector of the specified drive and
checksums it to see if it will be executed when the disk is booted
from. This occurs if the word checksum of the disk is 1234 hex. A
message is printed giving the result.
Most disks should not have executable boot sectors. Some protected
software does for example. You should be suspicious of disks such as
P.D. software that have executable boot sectors as it is one of the
means that stupid people could use to try and do your data in. You
could also try looking for hidden files in the AUTO folder if you are
really paranoid.
Subsection d: The SHOW Menu
The options in this menu have several things in common. They all
treat the screen as a scrolling text window and display their
information in it. If the hardcopy option is on then anything printed
in the window appears on the printer as well.
If you are editing a disk or file and you use one of these options
then the sector display is restored from an internal buffer when the
output has finished.
You can pause the output by holding down the right mouse button or
by pressing one or more of , or . Output
resumes when you release the key or button.
Show Disk Info
This option displays the data in the Bios Parameter Block of a disk.
This includes things like the size and position of the root directory
and FAT and how many free clusters there are left.
If the claimed number of free clusters exceeds the count of the
number of clusters on the disk then a warning message is printed.
Show Directories
After selecting this option you can use the file selector to pick
the directory you are interested in. After selecting one it is
searched for files and their name, size, creation date and attributes
are displayed.
Show Sector
This causes the sector being edited to be displayed in character and
hex form. It is included so a copy of the sector can be printed out.
Show FAT
This option reads in a file allocation table and prints it out in a
relatively easy to read form. The cluster number is given at the left
hand side of the output then 8 clusters follow on the line. For each
is printed the contents of that entry and a 3 letter code indicating
its significance.
The display often includes a lot of empty entries as it does not
believe the count of the number of clusters on disk but always prints
to the end of the FAT even though most of these entries do not exist.
The meaning of the codes is as follows:
BAD The cluster was marked bad at format time
RES The cluster is reserved (cluster 1)
EOF The cluster is the last one in a particular file
USE The cluster is allocated.
??? The entry points to a reserved cluster.
nothing The cluster is a free one
Reserved clusters should never be allocated so the presence of a
'???' entry indicates problems. If the symbol is 'USE' then the
number in that entry is the number of the next sequential cluster in
the file. Follow that chain to the next one and then see what to do
next!
Show File Trace
This option asks for a filename. As with Open File this option
interprets a null filename as a request to operate on the directory
given in the path, this allows you to find where a sub- directory
occurs on disk.
The trace produced lists each cluster of the file in order, the
logical sector number on disk of the first sector in the cluster is
printed in brackets following the cluster number.
Show Changes Made
This option scans the sectors held in the cache. For any of them
that have been changed a record of the changes is printed. This gives
the byte and sector number of the change and what the byte was
changed from and to.
A printed copy of this can be very useful if you find you have done
something very silly. It does happen you know.
Subsection e: The OPTIONS Menu
Character Display
This changes mode of display of the program between hexadecimal and
character mode. It affects the sector display, the entry of data and
the form in which you are asked to specify a search string.
Caching To RAM
This option turns the caching of sectors on and off. With this
option on changed sectors are not written straight back to disk but
are stored in memory. You may make as many changes to as many sectors
that will fit in memory as you like.
When you close the disk you can then have all the changed sectors
written at once.
Hardcopy Of Show
When this option is turned on then all output from the options in
the SHOW menu is sent to the printer as well as to the screen.
Should you select a SHOW option with hardcopy enabled and the
printer is not present or not on line then an error message is
produced.
Subsection f: Keyboard Menu Selections
Certain menu options can also be accessed from the keyboard. These
will only be accepted in cases where the menu option would be
allowed. The keys to press are as follows:
ALT-U Undo Changes
ALT-W Write Sector
ALT-C Cache Sector
ALT-M Mark Sector
ALT-G Goto Sector
ALT-O Goto Offset
ALT-F Search For Match
ALT-N Next Match
Section 3: Atari Disk Format
Subsection a: Physical Format
Tracks And Sectors
An Atari disk is either single or double sided, rumours of a triple
sided disk under development are completely untrue!
Each side of the disk is formatted into concentric rings, called
tracks, on standard disks there are 80 tracks, protected disks
sometimes use more.
Each track is divided into sectors, the standard format has 9
sectors, each holding 512 bytes per track.
So on a double sided disk this results in 2x80x9x512 bytes of
storage space = 737280. This is known as the formatted capacity, when
you bought the drive they will have quoted the unformatted capacity
of 1Mb as it is bigger.
The Boot Sector
You do not get all the above space to yourself however. To start
with sector 0 track 0 of the first side is known as the boot sector.
It sometimes contains boot code and always contains the Bios
Parameter Block. This is a description of the disk indicating the
areas reserved by the operating system and the area you may store
data in. The block occupies 9 words in the boot sector and contains
the following information:
Name Use
recsiz Size of sectors in bytes
clsiz Size of a cluster in sectors
clsizb Cluster size in bytes
rdlen Length of root directory
fsiz Size of FAT in sectors
fatrec No of 1st sector of 2nd FAT copy
datrec No of 1st sector for users data
numcl No of data clusters on disk
flags Indicates FAT format
clsizb has always seemed a little superfluous. I assume it is because
the format was borrowed from the bad old 8086 which finds 2x512 a
little arduous.
rdlen is the size of the root directory in sectors. This is
described more fully later.
There are two consecutive copies of the FAT held on disk. I am not
sure why as it has never seemed to prevent the OS screwing the disk
up.
If bit zero of flags is set it indicates that the FAT has 16 bit
entries. This occurs on a hard disk. The program will at present
refuse to edit disks with a 16 bit FAT. Floppy disks have 12 bit
entries.
If the boot sector word checksums to 1234 hex then the code it
contains is executed when the disk is booted from. This code can then
do absolutely anything you like. Early model ST computers had their
operating systems loaded from disk in such a manner.
Subsection b: Logical Format
Logical Sectors and Mappings
In practice the physical format of the disk can be abstracted away.
Rather than referring to the side,track and sector of a disk you can
refer to a logical sector. This is a number from 0 to the number of
sectors on the disk-1. It is so arranged that logical sector 0
corresponds to the boot sector. The device driver is responsible for
translating the logical sector numbers into the physical disk sector
you are referring to. Any kind of weird mapping scheme could be used
transparently to the user.
The sector numbers in the BPB refer to logical sectors. So if the
value of 'datrec' is 18 then it means that logical sector 18 holds
the first data block. It may or may not be side 0,track 2 sector 1.
Clusters
Sectors are not allocated to files one at a time but in clusters. A
cluster is a group of sectors. On the ST the cluster size is 2 so
each cluster holds 1K of data.
If the value of 'datrec' is 18 the first cluster occupies logical
sectors 18 and 19. The file allocation table, described later,
indicates which clusters belong to which files and which are free for
use.
Subsection c: Root and Sub Directories
Where Is the Root Directory?
The root directory can be found from the information in the BPB by
calculating fatrec+fsiz. This area is fixed at format time thus
implying that is a limit to the number of files that can be created
in the root directory.
If 7 sectors are allocated to it and each entry is 32 bytes long
then the number of files you can have in the root directory is
512x7/32 = 112.
Where are Sub Directories
Sub directories are treated in much the same way as files. Instead
of holding data they hold directory entries. They can grow
dynamically as can files and so the limit for the number of files in
a subdirectory depends on the size of the disk.
To find a file several levels down you start at the root and look
for the subdirectory, say AUTO. When this is found you have the start
cluster of the AUTO subdirectory and can search this for the next
one. A chain of clusters exists for AUTO in the same way as an
ordinary file and can be followed to find all the entries in it.
Sub-directories have two extra entries '.' and '..' which refer to
the current directory and its parent directory respectively.
The Format Of a Directory Entry
Both root and sub directories have the same format. They are a list
of entries each of which is 32 bytes long. Values in the various
fields are held in backwards 8086 format. To see one open up a disk
and goto sector 11. The format of a directory entry is:
Size and Type Usage
8 characters File name
3 characters File extension
1 byte File attributes
10 bytes Unused
word Creation time
word Creation date
word No of first cluster
long, Length of file in bytes
If a file is deleted the first byte of the entry is set to E5 hex
(you remember CP\M too eh?)
The start cluster number can be converted to a sector number given
the BPB and the additional knowledge that clusters 0 and 1 do not
exist on the disk.
You calculate ((cluster no-2 for reserved clusters) x clsiz) +
datrec
The file attribute byte has bits set depending on what attributes
the file has. The layout is as follows:
Bit No Usage
0 If set file is read only
1 If set file is hidden from dir search
2 If set file is a system file
3 If set file is 11 byte volume label
4 If set file is a subdirectory
5 Archive bit
6 Unused
7 Unused
The archive bit is supposed to indicate whether a file has been
altered since the last backup but does not seem to work on floppy
disks. I imagine it does on hard disks or the storm of protest would
have been pretty big.
Subsection d: The File Allocation Table
Where Is it?
There are two copies of this on the disk. The second copy can be
found by looking at the value of datrec in the BPB. The first copy is
at datrec-fsiz. The FAT normally occupies 5 sectors.
For each cluster on the disk the FAT records its state. Whether it
is allocated to a file, free, bad etc.
Format Of Entries
The entry for each cluster occupies 12 bits. So each group of 3
bytes in the FAT holds the data for 2 clusters.
Extracting the correct 12 bits for each entry (you can deduce how to
do this by looking at the output of Show FAT, remember : Show FAT
compensates for the 8086!) gives a number between 000 and FFF hex.
If the number is 000 then that cluster is free for use.
If the number is 001 then there is a problem. Cluster 1 is a
reserved cluster and does not actually appear on the disk. The FAT
entries for 0 and 1 are supposed to contain information about the
disk.
If the number is 002 to FEF then it means that this number is the
cluster number of the next cluster in the file.
If the number is FF0 to FF7 then it means that one or both of the
sectors in that cluster were found bad at format time and the cluster
cannot therefore be used.
If the number is FF8 to FFF it means that this cluster holds the
last one for a file.
So by finding the start cluster of a file you can follow the chain
of clusters in that file until you reach the last one. This might go
something like: 003 004 005 006 FFF.
If the FAT ever gets damaged then you are in trouble!