                     +---------------------------------+
                     |       Partition-Explorer        |
                     |                                 |
                     | http://www.partition-saving.com |
                     | Copyright (c) 2015 D. Guibouret |
                     +---------------------------------+

                                    Manual

Table of contents
-----------------

  1- License and preface
  2- Introduction
  3- System Requirements
  4- Interface features/functions
  5- Using the program
     a) Executing program
     b) Program functions
  6- Menu
     a) File menu
     b) Support menu
     c) Goto menu
     d) View as menu
     e) Information menu
  7- Configuration
     a) Common configuration
     b) FAT configuration
     c) NTFS configuration
     d) Ext2 configuration
  8- Driver refresh
  9- Calculator
  10- Disk definitions
     a) MBR partition sector
     b) GPT header sectors
     c) GPT entries sectors
  11- FAT definitions
     a) FAT12/FAT16 boot sector
     b) FAT12/FAT16 FAT
     c) Directory
     d) FAT32 boot sector
     e) FAT32 information sector
     f) FAT32 FAT
  12- NTFS definitions
     a) Boot sector
     b) MFT
     c) Standard information attribute
     d) Attributes list attribute
     e) File name attribute
     f) Object identifier attribute
     g) Security descriptor attribute
     h) Volume name attribute
     i) Volume information attribute
     j) Data attribute
     k) Index root attribute
     l) Index allocation attribute
     m) Bitmap attribute
     n) Reparse point attribute
     o) Extended attribute information attribute
     p) Extended attribute attribute
     q) Property set attribute
     r) Logged utility stream attribute
  13- Ext2 definitions
     a) Superblock
     b) Group descriptor (32 bits)
     c) Group descriptor (64 bits)
     d) Inodes table
     e) Inodes bitmap
     f) Blocks bitmap
     g) Directory
     h) Indirect blocks list
     i) Double indirect blocks list
     j) Triple indirect blocks list
     k) Extents
  14- Configuration file
  15- Options file


1- License and preface
----------------------

This program may be copied and freely redistributed. It may not be sold in any
way, either alone or included in another program. All that is in this package
must be kept together in its original form.

This program is offered as-is without any guarantee. No pursuit can be engaged
against its author in case of damages due to this program.

All remarks are welcome.


2- Introduction
---------------

Partition-Explorer is a program that allows viewing and editing content of a
partition. As it accesses content of a partition at a low level, you can
easily damage this partition and render it no more accessible by your OS (so
lost partition content). SO BE ALWAYS CAUTIOUS ON WHAT YOU DO WITH THIS
PROGRAM. There is no undo feature, once something is done and written to disk,
there is no way to come back to previous state unless you remember what the
previous values were.


3- System Requirements
----------------------

Hardware:

  - 386 or better.
  - 4 MB of memory (could work with less, but data compression might not
    work). Free DOS memory must be at least 300 kB.

Software:

  - DOS (version >= 3.3) for DOS version.
  - any Windows version less 3.1 versions for Windows version.
  - any Linux version having a kernel version >= 2.5.4 and glibc version >=
    2.3.

To use DOS version, you need a bootable DOS floppy or CD (or a DOS partition
on your disk). If you do not have one, you can use the boot disk that includes
Partition-Saving (see spartbdk documentation) to create a bootable floppy or
CD. You can also create your own floppy disk (see FAQ question 10). In case
you use the Partition-Saving one, you will have to put the Partition-Explorer
program on a partition that could be accessed from DOS (so a FAT partition or
another floppy disk) as it is not provided with the Partition-Saving boot
floppy disk.
In Windows and Linux cases, you need administrator's rights to be able to
access partitions.
If you want to modify the system partition with Windows version, you need a
second Windows installation or a WinPE or BartPE CD or use the Windows repair
console because program cannot have a low level access to the active system.
If you want to modify the system partition with Linux version, you need a
second Linux installation or a liveCD or use the repair console that is on
most installation CD because program cannot have a low level access to a
mounted system.
This program shall be used after a boot of computer without leaving any OS
into some hibernation mode because in this case modification made by this
program can disallow this OS booting back or OS can undo what program does.


4- Interface features/functions
-------------------------------

Interface if based on a menu on top of the edition window. At startup the
edition window is not displayed until you select a support to explore. This
interface can be split in two with each part having its own menu in order to
explore two different partitions simultaneously (or the same one with using
two views). The interface can also be split in two with displaying a simple
calculator.
On right side of the menu, the read-only or read/write state of the support is
displayed and in case something has been modified without having been written
back to disk, a "*" is displayed on left of this state.
The way to use this interface is similar to Partition-Saving's textual window
interface and you can get more details in reading chapter 4.a of its manual.


5- Using the program
--------------------

  a) Executing program

Usage:
explpart.exe [-cm|-nm|-pm] [-f <options file>] [-cfg <configuration file>]
[-ncd] [-ncs] [-nvd|-vd] [-nvf|-vf] [-tds] [-tui|-tuix|-bui|-buix]
[-utf8|-noutf8] [-term <terminal>]
To use the Windows version, explpwin.exe (32 bits) or explpw64.exe (64 bits)
shall be used instead of explpart.exe.
To launch the Linux version, explplnx.run (32 bits) or explpl64.run (64 bits)
shall be used instead of explpart.exe.
In Windows and Linux versions, same options are available, but some of them
will have no effect (see below).

  -cm: this option is the default way the mouse is utilised.

  -pm: this option is another way to utilise the mouse that can be used in
case the first one does not work (it is default method when using DOS version
on Windows NT/XP). Using this method may prevent detecting some double clicks.
This option is equivalent to -cm into Windows version. In Linux version,
program does not try to install its own mouse handler but fully relies on
ncurses one.

  -nm: this option disables the mouse. You would have to use it only if mouse
use seems to pose a problem with 2 previous methods.

  -f <options file>: this option allows you to set same options than on
command line and in way supports are detected. To understand the contents of
this file, please read chapter 15.

  -cfg <configuration file>: this option allows you set initial configuration
of program. Configuration is described in chapter 7. To understand the
contents of this file, please read chapter 14.

  -ncd: this option disables the check that created/read file is not on
saved/restored element. It is generally recommended only if DOS drive letter
attribution is wrong. This option has no influence in Windows and Linux
versions (this check cannot be disabled).

  -ncs: this option disables the check on free size on drive where files are
created. This is a workaround in case the driver report a wrong free size, but
you have to be aware that in case performing some copy, these ones could fail
only once the destination drive is full.

  -nvd|-vd: this option disables/enables the check that sectors are correctly
written. It is disabled as default. This speeds up disk access, but may
prevent detecting bad sectors on the disk. The check that sectors are
correctly written cannot be enabled in Windows and Linux versions (less for
floppy disks in Windows 9x).

  -nvf|-vf: this option disables/enables the check that files are correctly
written and that sectors are correctly written when using DOS devices access.
It is disabled as default. This speeds up file access, but created files or
restored devices may be incorrect because the disk where they are written is
damaged. The check that files are correctly written cannot be enabled in
Windows and Linux versions.

  -tds: this option enables check of disk size with relying on partitions
table content (for disk with extended access) or with searching last cylinder
(for disk with standard access). This option is needed only if partitions do
not appear.

  -tui|-tuix|-bui|-buix: this option allows you to select the user interface:

    * -tui: textual window interface.
    * -tuix: same as -tui but with using extended display mode (43 or 50 lines
      instead of 25). In Linux version, the whole terminal size is used. In
      Linux and Windows modes, program will adapt displayed area is you modify
      terminal size (without allowing it to be smaller than 80*25).
    * -bui: textual window interface using BIOS calls to write on the screen.
      This ensures better compatibility but goes slower. This option is the
      same than -tui in Windows and Linux versions.
    * -buix: same as -bui but with using extended display mode (43 or 50 lines
      instead of 25). This option is the same than -tuix in Windows and Linux
      versions.

If this option is not given, extended textual window interface is used. This
option has to be used only if this interface poses a problem (for example
nothing appears when the program begins). In this case, you can try the -bui
option.

  -utf8|-noutf8: forces use or not use of UTF-8 terminal capability in Linux
version. The default behaviour is to detect it automatically.

  -term <terminal>: this option is specific to Linux and Windows versions.
In Linux version, if program finds it does not run in a terminal, it launches
itself into a terminal with using the "xterm" command (this mechanism is
useful if you double click on program from a file explorer). This option
allows setting command to use to create the X terminal in which running
program instead of "xterm" (this command shall allow using "-e" option to run
a program). If <terminal> is equal to "no", program does not try to create a
terminal even if it finds it is not executed into a terminal.
In Windows version, program tries to launch a new console to ensure the mouse
quick edit mode is disabled (thus allowing use of mouse). Using this option
(whatever <terminal> value is) disables this behaviour.

Return code of program can be one of the following:

  - 0 if no error has been detected.
  - 1 if an error has appeared.
  - 255 if some exception has been raised.

  b) Program functions

When program is started, it begins with analysing all your disks and devices
to build a list of all what can be viewed. Once this is done you can start
using it through its menu. Basically you will select a support through
"Support" menu then navigate in the displayed data through the "Goto" menu.
You will be able to modify some values and write changes back to disk (if you
activated read/write mode in configuration first).
Chapter 6 gives a description of each command you can select inside menu.
Depending on the state of the program, all the commands are not available (ex:
if you did not select any support, the "Goto" and "View" menus are not
available).
When the displayed data are a recognised structure of a filesystem, you can
use two different views:

  - the detailed one, where you have a complete description of the content of
    the sectors,
  - the raw one, where the data are only viewed as an array of bytes.

You can switch from one to another through "F9" key and see the consequences
of a change. When switching, the cursor remains at the same location in the
sector, so you can easily see which bytes correspond to a field of the
structure.
Another view that is available is the "Explore" view that is a more standard
way to see the filesystem. But in this case you can no more have the link
between what is currently displayed and the content of the sectors.
Data that can be displayed depend on the kind of filesystem that is detected
on the partition. The description of each kind of displayed information is
given in chapters 10 to 13.
In case the filesystem was damaged and cannot be correctly be detected, you
can either use the "View" menu to force displaying of content of sectors with
using some specific structure or use the configuration to set the basics
information needed to recognise a filesystem. In first case, it will remain
local to the sectors you are currently viewing, in the second case, program
will try to match the filesystem with relying on information you provided (so
if you give some bad definition or if the filesystem is too deeply damaged,
you can get some strange behaviour).

  c) Navigating in the filesystem

When the filesystem is correctly recognised you can navigate into its content
through the "Goto" menu or by hitting a key ("Enter" in most cases) in the
field of a sector. At any moment you can come back to a previously displayed
content through "Back", "Forward" and "History" commands of "Goto" menu.
For some views that are repeat of same kind of structure among whole sector,
you can use a "Quick access" command of "View as" menu to reach directly an
entry.
There can be some definition where displaying the whole content will need a
lot of memory or a long time to build and navigate in the window. In that
case, program splits definition at regular point to limit number of displayed
items. You can change the limit in configuration. When the definition is
split, you have on top and bottom of the window "Previous" and "Next" buttons
and a "Go to item" entry: these are to access the definitions that were not
displayed.

Another way to navigate is in case you want to search to which file a sector
belongs. This can be done through "Sector info", "Cluster info", "Inode path"
and "MFT path" entries of "Info" menu. This kind of search could be quite long
(as program can have to scan the whole filesystem to find the corresponding
file), you can cancel it at any time by hitting the "Escape" key (note: this
one could take some time depending on the state of the search). Program will
display what it was able to resolve when it was interrupted.

  d) Modifying content

When you enable the read/write mode in configuration, you can modify the
content of a field and write this back to the disk. You shall be very cautious
as if you enter some wrong value, there will be nothing to prevent you from
doing this (so you can damage the filesystem). A small check that can be
performed is to switch from detailed view to raw then back (or vice-versa) and
check that the value you modified was not modified. During such a switch you
can get a window telling you that "Content description overflows content size.
End is cut to match content size.". That means that the modified content
becomes too big to enter into the initial content of sectors and so the end of
this content was lost. This is not a problem as long as this end is some
unused part in the structure, but becomes one is some needed data are lost. In
this last case you will better have to revert your change (or to not write
changes and read sectors again to retrieve initial values).
Depending on the displayed structure, some fields could be related to some
other (ex: filename and filename length). Depending on the configuration you
chose, program could update them automatically or not (so if you add some
characters to a filename, its length is updated accordingly or on contrary if
you changed the length, the name is modified). If you did not activate the
automatic update, you can explicitly request it by hitting a key
("Shift+Enter" in most cases). The fields that are linked together are
detailed in the filesystem descriptions.
When you modify content of sectors and write them back to disk, you could have
to inform program of such a change if you want it to take them into account in
its internal structures. You have to perform this explicitly to avoid breaking
program behaviour in case you perform some incomplete change (such as you can
do it only when you know a set of changes you did is coherent). You can get
more details on this in chapter 8.

At any time you can save the sectors content to a file to be able to retrieve
it latter (such restoring the content to its initial state if some change
seems to lead to errors). This can be done through the "Save to file" and
"Read from file" commands into "File" menu. The "Save as text" command allows
saving the sector content as it is displayed into detailed view, but there is
no way to reload such a file: it is only to have content in a readable form.

6- Menu
-------

Menu is the entry point for user to use the program. You can activate it with
clicking on menu item with mouse or with typing "Alt+<the name shortcut>".
Menu is divided into several entries:

  - File that allows configuring program, save or load content, open or close
    display and quit program,
  - Support that gives the list of supports that could be displayed,
  - Goto that allows go to specific construction on current support. This menu
    is available only when a support is chosen,
  - View that allows forcing the way currently displayed sectors shall be
    treated,
  - Info that gives some information about currently displayed support,
  - On right the read/write current configuration is displayed and in case
    some modification was done on current displayed item, a "*" is displayed
    before.

  a) File menu
The file menu allows managing configuration and windows of program. Program is
able to display two windows showing two different supports. These windows are
independent from each other and each of them has its own menu and
configuration.
Available commands depend on what is currently displayed. Commands are:

  - Write changes: write change you have done to support for current display,
  - Save as text: save currently displayed sectors into a text file in a way
    similar to what is currently displayed. This command is available only
    when displaying sectors in a detailed form,
  - Save to file: save currently displayed sectors into a binary file,
  - Load from file: load content of currently displayed sectors from a binary
    file. This replaces current sectors content,
  - Configure: allows setting configuration for this display. This
    configuration is taken into account only when a new support is chosen,
  - Current configuration: displays current configuration of this display,
  - Load configuration: load the configuration from a file.
  - Save configuration: save configuration to a file.
  - New display: allows splitting screen in two to view another support. This
    command is not available if there is already two displays or if calculator
    is displayed,
  - Close display: allows closing current display,
  - Calculator: allows splitting screen in two to display a simple calculator.
    This command is not available if there is two displays,
  - Close calculator: allows closing calculator when it is displayed,
  - Exit: allows exiting program.

  b) Support menu
This menu gives the list of supports that could be viewed.
Supports are grouped by kind of supports and sub-menu are shown to view items
on a support:

  - a disk support selects the given disk or one of its partitions,
  - a floppy support selects the given floppy,
  - the devices support lists the devices that could be selected,
  - raw file support allows giving name of a file that is treated as a
    support.

  c) Goto menu
This menu allows reaching some specific construct on currently displayed
support.
List of reachable definitions depends on kind of filesystem recognised on
support:

  - Back: this allows reaching the previous viewed item if there is one,
  - Forward: this allows reaching the next viewed item if there is one,
  - History: this displays a list of viewed items to display them again. You
    shall be aware that history is not updated in case you write something on
    disk, so they can become wrong in that case (see "Refresh driver" below to
    get more detail),
  - Refresh driver: this allows forcing update of some definition as explained
    in refreshing help,
  - Sector: this is always available and allows giving the first sector and
    number of sectors to display,
  - Menu when displayed support is a disk,
  - Menu when displayed support is a FAT12 or FAT16 support,
  - Menu when displayed support is a FAT32 support,
  - Menu when displayed support is a NTFS support,
  - Menu when displayed support is an ext2 support.

  Goto disk item:
  ---------------
This lists kind of items that can be reached when viewing a disk:

  - Partition table: this allows reaching Master Boot Record and primary
    partitions table sector,
  - GPT header: this allows reaching the Global Partition Table header.

  Goto FAT12/FAT16 item:
  ----------------------
This lists kind of items that can be reached when viewing a FAT12 or FAT16
support:

  - Cluster: this allows giving the first cluster and number of clusters to
    display,
  - Boot sector: this allows reaching the boot sector,
  - FAT table: this allows reaching the File Allocation Table,
  - FAT table copy: this allows reaching the copy of File Allocation Table if
    there is one,
  - Root directory: this allows displaying the root directory,
  - Directory: this allows giving name of directory to display,
  - File: this allows giving name of file to display,
  - Explore: this allows exploring support with seeing directories and files
    tree.

  Goto FAT32 item:
  ----------------
This lists kind of items that can be reached when viewing a FAT32 support:

  - Cluster: this allows giving the first cluster and number of clusters to
    display,
  - Boot sector: this allows reaching the boot sector,
  - Boot sector copy: this allows reaching the copy of the boot sector,
  - Information sector: this allows reaching the FAT32 information sector,
  - Information sector copy: this allows reaching the copy of the FAT32
    information sector,
  - FAT table: this allows reaching the File Allocation Table,
  - FAT table copy: this allows reaching the copy of File Allocation Table if
    there is one,
  - Root directory: this allows displaying the root directory,
  - Directory: this allows giving name of directory to display,
  - File: this allows giving name of file to display,
  - Explore: this allows exploring support with seeing directories and files
    tree.

  Goto NTFS item:
  ---------------
This lists kind of items that can be reached when viewing a NTFS support:

  - Cluster: this allows giving the first cluster and number of clusters to
    display,
  - Boot sector: this allows reaching the boot sector,
  - Boot sector copy: this allows reaching the copy of the boot sector,
  - MFT table: this allows reaching begin of Master File Table,
  - MFT: this allows giving the number of the MFT to display,
  - Root directory: this allows displaying the root directory,
  - Directory: this allows giving name of directory to display,
  - File: this allows giving name of file to display,
  - Explore: this allows exploring support with seeing directories and files
    tree.

  Goto Ext2 item:
  ---------------
This lists kind of items that can be reached when viewing an ext2 support:

  - Block: this allows giving the first block and number of blocks to display,
  - Superblock: this allows reaching the superblock of first group,
  - Group descriptors: this allows reaching the group descriptors in first
    group either as 32 bits or 64 bits depending on configuration,
  - Group: this allows giving the number of the group to display,
  - Superblock in group: this allows giving the number of the group of which
    displaying the superblock,
  - Group descriptors in group: this allows giving the number of the group of
    which displaying the group descriptors either as 32 bits or 64 bits
    depending on configuration,
  - Inode table in group: this allows giving the number of the group of which
    displaying the inode table,
  - Inode bitmap in group: this allows giving the number of the group of which
    displaying the inode allocation bitmap,
  - Block bitmap in group: this allows giving the number of the group of which
    displaying the block allocation bitmap,
  - Root directory: this allows displaying the root directory,
  - Directory: this allows giving name of directory to display,
  - File: this allows giving name of file to display,
  - Explore: this allows exploring support with seeing directories and files
    tree.

  d) View as menu
This menu allows using a specific structure when displaying some sectors. This
forces the given kind of view to be used without checking its coherence with
current sector content, so it could give unexpected result.
The kind of views that could be used are grouped per kind of filesystem:

  - Quick access: this menu is available for some views (as directory content)
    to be able to reach a specific entry inside the currently displayed view,
  - Switch to raw: this menu is available when the kind of sectors is
    recognised. It allows displaying sectors as a list of bytes,
  - Switch to details: this menu is available when the kind of sectors is
    recognised. It allows displaying sectors using structured definition,
  - View as disk: allows choosing a disk structure,
  - View as FAT12: allows choosing a FAT12 structure,
  - View as FAT16: allows choosing a FAT16 structure,
  - View as FAT32: allows choosing a FAT32 structure,
  - View as NTFS: allows choosing a NTFS structure,
  - View as ext2: allows choosing an ext2 structure.

  View as disk item
  -----------------
This menu allows viewing sectors using some disk structure:

  - Partition table,
  - GPT header,
  - GPT entries.

  View as FAT12 item
  ------------------
This menu allows viewing sectors using some FAT12 structure:

  - Boot sector,
  - FAT,
  - Directory.

  View as FAT16 item
  ------------------
This menu allows viewing sectors using some FAT16 structure:

  - Boot sector,
  - FAT,
  - Directory.

  View as FAT32 item
  ------------------
This menu allows viewing sectors using some FAT32 structure:

  - Boot sector,
  - Information sector,
  - FAT,
  - Directory.

  View as NTFS item
  -----------------
This menu allows viewing sectors using some NTFS structure:

  - Boot sector,
  - MFT,
  - Standard information,
  - Attributes list,
  - File name,
  - Object identifier,
  - Security descriptor,
  - Volume name,
  - Volume information,
  - Data,
  - Root index,
  - Index allocation,
  - Bitmap,
  - Reparse point,
  - Extended attributes information,
  - Extended attributes,
  - Property set,
  - Logged utility stream,
  - Directory.

  View as Ext2 item
  -----------------
This menu allows viewing sectors using some ext2 structure:

  - Superblock,
  - Indirect block list,
  - Directory,
  - Group descriptors (32 bits or 64 bits),
  - Block bitmap,
  - Inode bitmap,
  - Inode table,
  - Extents block.

  e) Information menu
This menu allows displaying some information about currently viewed item:

  - Support info.: this displays information on currently displayed support,
  - Sector info.: this displays information on a specific sector,
  - Cluster info.: this displays information on a specific cluster or block,
  - Inode path: this displays the path of the file corresponding to an inode.
    This entry is present only in case of ext2 driver,
  - MFT path: this displays the path of the file corresponding to a MFT. This
    entry is present only in case of a NTFS driver,
  - View info.: this displays information on currently displayed sectors,
  - Compare: this allows comparing content of the two displays. This entry is
    present only when the two displays are active,
  - Unlock supports: when being in write mode, support are locked to avoid
    simultaneous write from another program. This allows unlocking them for
    them to be usable from another program,
  - Help: this displays this help,
  - About: this displays program information.

7- Configuration
----------------

Configuration allows configuring behaviour of the program. This can be defined
or current configuration can be viewed with using the corresponding menu
entry. This opens a tabbed window. This window displays the configuration to
use to display disk items. Configuration allows defining how interface shall
behave and how to treat support in case its content cannot be recognised.
A change of configuration is taken into account only when:

  - changing support through the Support menu,
  - refreshing driver when this option is available in Goto menu. In that case
    change of read-only state is not taken into account (only changing support
    allows it).

There are some common options that apply to several kinds of filesystems and
some options specific to each filesystem:

  - Common configuration
  - FAT configuration
  - NTFS configuration
  - Ext2 configuration

  a) Common configuration
The common configuration allows defining interface behaviour and setting
definitions common to several filesystems.
Settings corresponding to interface behaviour are:

  - Read only: modifications done to the displayed content are not written
    back to support.
  - Update linked values: in filesystem some values can be linked (as a field
    that gives length of a name and the corresponding name). If this option is
    checked, program will automatically update the linked field if one is
    modified (changing name length will update field giving its length or
    vice-versa). It is better to not use this option if the filesystem is in a
    bad state. In this case, program could get wrong because of invalid
    content and so modifies some fields when reading sectors before you can
    check the field value.
  - Open in raw mode: this allows opening display in raw mode even if a
    detailed description is available. This can be used in case the filesystem
    is damaged such as the detailed description will be broken. Using this
    mode allows also avoiding an update of linked values when reading sectors.
    You can still switch to detailed view through the corresponding menu
    entry.
  - Detection mode: this allows setting how program shall behave when
    accessing a new support: either try to detect its filesystem or force one
    with using values given here to configure it (so without relying on
    current filesystem content). Forcing to use a given filesystem should only
    be set in case filesystem is damaged and cannot be correctly recognised.
  - Max. nb sectors in "View as": this setting allows limiting number of
    sectors to use when trying to consider some sectors as being of some kind
    of definition.
  - Max. nb items displayed: this setting limits number of items that are
    displayed to avoid using too much memory or slowing down interface because
    of number of items shown. In that case, you can reach not displayed items
    through giving there number when hitting Alt+L.
  - History size: this configures maximum number of views that are kept in
    history list. As views can use a huge amount of memory this value shall
    not be too high if you are low in memory.
  - Calculator memory size: this configures maximum number of values that can
    be memorised into calculator.

Settings that are common to several filesystems are:

  - Cluster/block size: size in bytes of a cluster (for FAT and NTFS
    filesystem) or of a block (for ext2, ext3 and ext4 filesystems).

  b) FAT configuration
These definitions are specific to FAT filesystems. They are used in case
detection is forced to FAT12, FAT16 or FAT32 filesystem:

  - Number of FATs: number of File Allocation Table: 2 in most cases.
  - First used FAT: first FAT that shall be used: 0 in most cases. This
    configuration is theoretically available with FAT32 only, but is made
    available for all types of FAT as an extension. This allows managing
    filesystem with damaged FAT to ignore damaged one (but this extension
    works only in the program, there is no way to put such parameter on a
    FAT12 or FAT16 filesystem).
  - Number of used FATs: number of FAT that shall be used: 2 in most cases. As
    for "First used FAT" parameter, this parameter is an extension for FAT12
    and FAT16 filesystems.
  - First sector of FAT: first sector used for the FAT: 1 for FAT12 and FAT16
    and not fixed for FAT32 (often 32).
  - Number of sectors per FAT: number of sectors used to store one FAT. This
    depends on number of clusters and is at least (but can be greater): (2 *
    number of clusters) * size of FAT entry in bytes / size of sector (rounded
    up).
  - Nb sectors of root directory (FAT12/FAT16): number of sectors used to
    store root directory content. This is used only for FAT12 and FAT16 and is
    often 32 for partitions (lower for floppy disk).
  - Cluster of root directory (FAT32): cluster used to store root directory
    content. This is used only for FAT32 and is often 2.

  c) NTFS configuration
These definitions are specific to NTFS filesystem. They are used in case
detection is forced to NTFS filesystem:

  - Cluster of MFT: first cluster used to store Master File Table.
  - Number of sectors per MFT: number of sectors to store one file record.
  - Number of sectors per index record: number of sectors to store one index
    record (as directory entry).

  d) Ext2 configuration
These definitions are specific to ext2, ext3 and ext4 filesystems. They are
used in case detection is forced to ext2 filesystem:

  - Version number: version of the filesystem: 1 in most case.
  - Blocks per group: number of blocks in a group: 8 * size of a block in most
    cases.
  - Inodes per group: number of inodes in a group.
  - Size of inode: size in bytes of one inode description: at least 128 and at
    most block size.
  - Has sparse superblock: flag to know if sparse superblock is used. This is
    considered only in case version number is 1.
  - Has meta blocks group: flag to know if meta blocks group are used. This is
    considered only in case version number is 1.
  - First meta blocks group: number of first group having meta information.
    This is considered only in case previous flag is checked.
  - Has 64 bits group descriptors: flag to know if group descriptors use
    definition on 32 bits or 64 bits. This is considered only in case version
    number is 1.
  - Group descriptor size: size in bytes of a group descriptor. This is
    considered only in case previous option is checked.
  - Has group descriptor checksum: flag to know if group descriptors contain a
    checksum to check their coherence. This is considered only in case version
    number is 1.

8- Driver refresh
-----------------

Refreshing driver allows taking into account change you have done:

  - either in configuration, less for the read-only status,
  - or because you wrote some specific sectors on disk.

In order to work, program needs to memorise some sectors and cannot update
their values automatically when you change them because this could lead to
some incoherence (as if you change number of sectors per FAT and still have
not updated FAT content). In that case, you have to explicitly choose to
refresh driver through dedicated option in Goto menu when you think you have
put filesystem back in a coherent state. Program will update corresponding
sectors in memory and if they seem correct, use them else keep previous
memorised content (but sectors on support will remain as you wrote them, so
with values program finds incorrect).
The only case where program will try to automatically perform a refresh is
when using exploration view in read/write mode. In that case it needs to
memorise some other sectors and so shall ensure they are coherent. In case
that fails, it enters exploration view in read-only mode.
Sectors that are memorised are:

  - for FAT filesystem: boot sector,
  - for NTFS filesystem: boot sector and MFT 0 ($MFT), 1 ($MFTMirr) and 3
    ($Volume) definitions,
  - for ext2 filesystem: superblock and group descriptors.

To improve performance, program could cache some sectors to avoid reading them
too frequently. If you write them from inside the program, it will update the
cached content automatically. But if you write these sectors from outside of
the program, it will not be aware of that, so will still use the cached
content. In that case refreshing the driver allows also clearing the cache. It
shall be noticed that there is no such problem when support is accessed in
read/write mode, as this prevents accessing the filesystem from outside of the
program. In all views less read/write exploration view, sectors that can be
cached are:

  - for FAT filesystem: FAT sectors,
  - for NTFS filesystem: MFT 4 ($AttrDef) and 6 ($Bitmap),
  - for ext2 filesystem: blocks bitmap, inodes bitmap and inodes sectors.

In read/write exploration view, any sector can be cached.
The other cases where program keeps sectors content in memory and does not
update it if they are written are:

  - content of what is currently displayed,
  - previous definitions that you can reuse through Back, Forward and History
    buttons of Goto menu.

In case you access the same support in the two displays:

  - refreshing driver applies only to the display where you execute it,
  - modifying the support in one display will not update content of the other
    display as explained above. You have to read sectors again in other
    display with avoiding using Back, Forward and History buttons of Goto menu
    if modification changes more than just sector content but definitions
    limit (as when increasing size of file you are viewing).

The only definition that is never updated is the supports definition (so
partitions table). If you change them, you have to restart program for it to
use new definitions.

9- Calculator
-------------

This window displays a simple calculator: you can perform basic operations
(arithmetical and bit operations), convert number from one base to another and
perform computation with limiting number of bits used.
First display shows current number that is used in computation. Second display
shows remainder of division when last operation is a division.
The "64 bits" ... "8 bits" list allows choosing number of bit to use in number
representation. In case an operation overflows, bits above the limit are
discarded. Changing number of bits will change currently displayed number. The
"unsigned", "signed" list allows choosing if operations are done with
considering they are unsigned or signed. Changing sign will change currently
displayed number. The "Hexadecimal" ... "Binary" list allows changing base
used to display numbers. Changing base will change currently displayed number.
When using:

  - hexadecimal displaying, digits are grouped per 16 bits values,
  - decimal displaying, digits are grouped per thousands,
  - octal displaying, digits are grouped per 24 bits values,
  - binary displaying, digits are grouped per 8 bits values.

The parentheses group allows opening and closing parentheses with current
number of opened parentheses being displayed between the two buttons. The
"Memorise" button allows adding current value into list of memorised values.
The remainder is also added when it is different from 0. Memorised values can
be retrieved through clicking on "V" button on right of first display or by
hitting the "V" key, then selecting the value and hitting "Enter" key or
double-clicking on it.
The operation buttons are:

  - Lsh: performs unsigned left shift of number (even if signed displaying is
    used),
  - Rsh: performs unsigned right shift of number (even if signed displaying is
    used),
  - C: clears current number (but keep already computed part of operation),
  - AC: clears everything,
  - Not, And, Or, Xor: performs the corresponding bit operation,
  - *, /, +, -: performs the corresponding operation,
  - Rem: performs the remainder operation,
  - x^y: performs the power operation with "y" being limited to positive
    numbers up to 64,
  - +\-: changes sign of current number (not available with unsigned
    displaying),
  - =: performs computation.

The digit buttons allow adding a digit to currently typed number. Available
list of buttons depends on currently selected base. Number can also be copied
or pasted through Ctrl+C and Ctrl+V (current base is used, so trying to paste
a hexadecimal number when being in decimal will fail).
In addition to keys corresponding to each button, the following keys could be
used:

  - g: select the signed/unsigned list,
  - s: select the base list,
  - z: select the number of bits list,
  - Backspace: remove current digit,
  - Delete: clears everything,
  - Return: performs computation.

10- Disk definitions
--------------------

  a) MBR partition sector
This window displays MBR sector that has following structure:
+-----------+------+---------------------------------------+-----+--------+
| Item name | Size |              Description              | Key | Action |
+-----------+------+---------------------------------------+-----+--------+
| Boot code | 440  | Code to boot from this disk.          |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Windows   |      | Unique identifier used by Windows to  |     |        |
| disk      | 4    | identify disk.                        |     |        |
| signature |      |                                       |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Unused    | 2    | Unused bytes.                         |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Partition | 16   | Description of first partition.       |     |        |
| 1         |      |                                       |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Partition | 16   | Description of second partition.      |     |        |
| 2         |      |                                       |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Partition | 16   | Description of third partition.       |     |        |
| 3         |      |                                       |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Partition | 16   | Description of fourth partition.      |     |        |
| 4         |      |                                       |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Boot      | 2    | 0xAA55 value to mark bootable sector. |     |        |
| marker    |      |                                       |     |        |
+-----------+------+---------------------------------------+-----+--------+
| Unused    | Var. | Unused bytes at end of sector if this |     |        |
|           |      | one is more than 512 bytes.           |     |        |
+-----------+------+---------------------------------------+-----+--------+
For each partition, the description is:
+-----------+------+------------------------------------+-------+------------+
| Item name | Size |            Description             |  Key  |   Action   |
+-----------+------+------------------------------------+-------+------------+
| Active    | 1    | 128 value to mean partition can be |       |            |
| flag      |      | booted.                            |       |            |
+-----------+------+------------------------------------+-------+------------+
| Start     |      |                                    |       |            |
| sector    | 1    | Head of first sector of partition. |       |            |
| head      |      |                                    |       |            |
+-----------+------+------------------------------------+-------+------------+
| Start     |      | Sector on track of first sector of |       |            |
| sector    | 6b   | partition.                         |       |            |
| sector    |      |                                    |       |            |
+-----------+------+------------------------------------+-------+------------+
| Start     |      | Cylinder of first sector of        |       |            |
| sector    | 10b  | partition.                         |       |            |
| cylinder  |      |                                    |       |            |
+-----------+------+------------------------------------+-------+------------+
|           |      |                                    |       | Select     |
| Partition | 1    | Value to indicate type of          | Enter | partition  |
| type      |      | partition.                         |       | type in    |
|           |      |                                    |       | list.      |
+-----------+------+------------------------------------+-------+------------+
| End       |      |                                    |       |            |
| sector    | 1    | Head of last sector of partition.  |       |            |
| head      |      |                                    |       |            |
+-----------+------+------------------------------------+-------+------------+
| End       |      | Sector on track of last sector of  |       |            |
| sector    | 6b   | partition.                         |       |            |
| sector    |      |                                    |       |            |
+-----------+------+------------------------------------+-------+------------+
| End       |      | Cylinder of last sector of         |       |            |
| sector    | 10b  | partition.                         |       |            |
| cylinder  |      |                                    |       |            |
+-----------+------+------------------------------------+-------+------------+
|           |      | First sector of partition from     |       |            |
| First     | 4    | begin of disk for main partitions  | Enter | Go to      |
| sector    |      | or from begin of extended          |       | partition. |
|           |      | partition for logical ones.        |       |            |
+-----------+------+------------------------------------+-------+------------+
| Number of | 4    | Number of sectors of partition.    |       |            |
| sectors   |      |                                    |       |            |
+-----------+------+------------------------------------+-------+------------+

  b) GPT header sectors
This window displays Global Partition Table header sector that has following
structure:
+-----------+------+-------------------------------------+-------+-----------+
| Item name | Size |             Description             |  Key  |  Action   |
+-----------+------+-------------------------------------+-------+-----------+
| Signature | 8    | 0x5452415020494645 value.           |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Revision  | 4    | GPT version.                        |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Size      | 4    | Size of this header.                |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| CRC       | 4    | Checksum of this header.            | Enter | Compute   |
|           |      |                                     |       | checksum. |
+-----------+------+-------------------------------------+-------+-----------+
| Reserved  | 4    | Unused.                             |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Current   |      |                                     |       |           |
| header    | 8    | Sector where this header appears.   |       |           |
| sector    |      |                                     |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Other     |      | Sector where a copy of this header  |       |           |
| header    | 8    | appears.                            |       |           |
| sector    |      |                                     |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| First     |      | First sector that could be used by  |       |           |
| usable    | 8    | a partition.                        |       |           |
| sector    |      |                                     |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Last      |      | Last sector that could be used by a |       |           |
| usable    | 8    | partition.                          |       |           |
| sector    |      |                                     |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Disk GUID | 16   | Disk unique identifier.             |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Partition |      | Sector from where partition entries |       | Go to     |
| entries   | 8    | are described.                      | Enter | partition |
| sector    |      |                                     |       | entries.  |
+-----------+------+-------------------------------------+-------+-----------+
| Partition |      |                                     |       | Go to     |
| entries   | 4    | Number of partition entries.        | Enter | partition |
| number    |      |                                     |       | entries.  |
+-----------+------+-------------------------------------+-------+-----------+
| Partition |      |                                     |       |           |
| entry     | 4    | Size of one partition entry.        |       |           |
| size      |      |                                     |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Partition |      |                                     |       | Compute   |
| entries   | 4    | Checksum of partition entries.      | Enter | checksum. |
| CRC       |      |                                     |       |           |
+-----------+------+-------------------------------------+-------+-----------+
| Unused    | Var. | Unused bytes at end of sector.      |       |           |
+-----------+------+-------------------------------------+-------+-----------+

  c) GPT entries sectors
This window displays Global Partition Table partition entries sectors that are
a list of partition entries having following structure:
+-----------+------+--------------------------------------+-------+---------+
| Item name | Size |             Description              |  Key  | Action  |
+-----------+------+--------------------------------------+-------+---------+
| Type GUID | 16   | Identifier of type of partition.     |       |         |
+-----------+------+--------------------------------------+-------+---------+
| Partition | 16   | Unique identifier of partition.      |       |         |
| GUID      |      |                                      |       |         |
+-----------+------+--------------------------------------+-------+---------+
| First     | 8    | First sector of partition.           | Enter | Go to   |
| sector    |      |                                      |       | sector. |
+-----------+------+--------------------------------------+-------+---------+
| Last      | 8    | Last sector of partition.            |       |         |
| sector    |      |                                      |       |         |
+-----------+------+--------------------------------------+-------+---------+
|           |      |                                      |       | Display |
| Flags     | 8    | Flags to describe partition options. | Enter | flags   |
|           |      |                                      |       | detail. |
+-----------+------+--------------------------------------+-------+---------+
| Name      | 72   | Name of partition in UTF-16.         |       |         |
+-----------+------+--------------------------------------+-------+---------+
|           |      | Unused bytes at end of entry         |       |         |
| Unused    | Var. | depending on entry size defined in   |       |         |
|           |      | GPT header.                          |       |         |
+-----------+------+--------------------------------------+-------+---------+

11- FAT definitions
-------------------

  a) FAT 12/FAT 16 boot sector
This window displays the FAT12 or FAT16 boot sector:
+-------------+------+----------------------------------------+-----+--------+
|  Item name  | Size |              Description               | Key | Action |
+-------------+------+----------------------------------------+-----+--------+
| Jump code   | 3    | Code to reach begin of boot sector     |     |        |
|             |      | code.                                  |     |        |
+-------------+------+----------------------------------------+-----+--------+
| OEM name    | 8    | OS Vendor identification string.       |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Bytes per   | 2    | Number of bytes a sector has.          |     |        |
| sector      |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Sectors per | 1    | Number of sectors a cluster has.       |     |        |
| cluster     |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Reserved    | 2    | Number of sectors before first FAT.    |     |        |
| sectors     |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Number of   | 1    | Number of FAT.                         |     |        |
| FAT         |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Number of   |      | Number of entries in root directory.   |     |        |
| root        | 2    | An entry is 32 bytes long.             |     |        |
| entries     |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Number of   |      | Number of sectors in partition. If it  |     |        |
| sectors     | 2    | is 0, value is stored in Number of     |     |        |
| (short)     |      | sectors (long).                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Media       | 1    | Type of media (floppy disk with its    |     |        |
| descriptor  |      | type, disk, ...).                      |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Number of   |      |                                        |     |        |
| sectors per | 2    | Number of sectors in one FAT.          |     |        |
| FAT         |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Sectors per | 2    | Number of sectors on one track.        |     |        |
| track       |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Heads per   | 2    | Number of heads on one cylinder.       |     |        |
| cylinder    |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Number of   |      | Sector at which partition begins (in   |     |        |
| sectors     | 4    | relative from begin of disk or from    |     |        |
| before      |      | extended partition).                   |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Number of   |      | Number of sectors in partition when it |     |        |
| sectors     | 4    | is more than 65535.                    |     |        |
| (long)      |      |                                        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Disk number | 1    | Disk or floppy number for BIOS.        |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Reserved    | 1    | 0 value.                               |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Additional  | 1    | 0x29 value to mean that following      |     |        |
| information |      | information are given.                 |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Volume      | 4    | Volume serial number (used to track    |     |        |
| identifier  |      | media change).                         |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Volume      | 11   | Volume name, equivalent to the one     |     |        |
| label       |      | stored in root directory.              |     |        |
+-------------+------+----------------------------------------+-----+--------+
| FAT name    | 8    | FAT12, FAT16 or FAT (but does not      |     |        |
|             |      | indicate type of FAT).                 |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Boot code   | 448  | Code to be able to boot this           |     |        |
|             |      | partition.                             |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Boot        | 2    | 0xAA55 signature to indicate boot      |     |        |
| signature   |      | sector.                                |     |        |
+-------------+------+----------------------------------------+-----+--------+
| Unused      | Var. | Unused part (only present if sector is |     |        |
|             |      | more than 512 bytes).                  |     |        |
+-------------+------+----------------------------------------+-----+--------+

  b) FAT12/FAT16 FAT
This window displays the FAT12 or FAT16 FAT sectors. There are 8 entries per
line with for each entry:
+------+------+--------------------------------------+--------+------------+
| Item | Size |             Description              |  Key   |   Action   |
| name |      |                                      |        |            |
+------+------+--------------------------------------+--------+------------+
|      |      |                                      | Enter  | Go to      |
|      | 12b  | FAT entry value (size depends on FAT |        | cluster.   |
|      | or   | kind).                               +--------+------------+
|      | 16b  |                                      | Shift+ | Follow FAT |
|      |      |                                      | Enter  | entry.     |
+------+------+--------------------------------------+--------+------------+
This can be followed by an 'Unused' entry for unused bytes at end of sectors.

  c) Directory
This window displays the FAT directory entries. There are two kinds of
directory entries:

  - standard directory entry (short name).
  - long directory entry (long name).

A long name is split among several long directory entries in reverse order and
is followed by its corresponding short name. Long names are stored in UTF-16.
Directory entry for short name is composed of:
+-----------+------+------------------------------------+-------+----------+
| Item name | Size |            Description             |  Key  |  Action  |
+-----------+------+------------------------------------+-------+----------+
|           |      | Base name of the file (part before |       |          |
|           |      | '.'). If first byte is:            |       |          |
|           |      |                                    |       |          |
|           |      |   - 0: entry is free and following |       |          |
| Name      | 8    |     ones also.                     |       |          |
|           |      |   - 5: first byte should be        |       |          |
|           |      |     interpreted as 229.            |       |          |
|           |      |   - 229: entry is free.            |       |          |
|           |      |                                    |       |          |
+-----------+------+------------------------------------+-------+----------+
| Extension | 3    | Extension of the file (part after  |       |          |
|           |      | '.').                              |       |          |
+-----------+------+------------------------------------+-------+----------+
|           |      | Entry flags (directory, read-only, |       | Display  |
| Flags     | 1    | ...).                              | Enter | flags    |
|           |      |                                    |       | details. |
+-----------+------+------------------------------------+-------+----------+
| Unused    | 1    | 0 value.                           |       |          |
+-----------+------+------------------------------------+-------+----------+
| Creation  | 1    | Entry creation time in tenth of    |       |          |
| 1/10 s.   |      | seconds.                           |       |          |
+-----------+------+------------------------------------+-------+----------+
| Creation  |      |                                    |       | Display  |
| time      | 2    | Entry creation time.               | Enter | date     |
|           |      |                                    |       | details. |
+-----------+------+------------------------------------+-------+----------+
| Creation  |      |                                    |       | Display  |
| date      | 2    | Entry creation date.               | Enter | date     |
|           |      |                                    |       | details. |
+-----------+------+------------------------------------+-------+----------+
| Access    |      |                                    |       | Display  |
| date      | 2    | Entry last access date.            | Enter | date     |
|           |      |                                    |       | details. |
+-----------+------+------------------------------------+-------+----------+
|           |      |                                    |       | Display  |
| Cluster   | 2    | High word of cluster value.        | Enter | clusters |
| (high)    |      |                                    |       | chain    |
|           |      |                                    |       | content. |
+-----------+------+------------------------------------+-------+----------+
| Write     |      |                                    |       | Display  |
| time      | 2    | Entry last write time.             | Enter | date     |
|           |      |                                    |       | details. |
+-----------+------+------------------------------------+-------+----------+
| Write     |      |                                    |       | Display  |
| date      | 2    | Entry last write date.             | Enter | date     |
|           |      |                                    |       | details. |
+-----------+------+------------------------------------+-------+----------+
|           |      |                                    |       | Display  |
| Cluster   | 2    | Low word of cluster value.         | Enter | clusters |
| (low)     |      |                                    |       | chain    |
|           |      |                                    |       | content. |
+-----------+------+------------------------------------+-------+----------+
| Size      | 4    | Number of bytes of the file.       |       |          |
+-----------+------+------------------------------------+-------+----------+
Directory entry for long name is composed of:
+----------+------+--------------------------------------+-------+-----------+
|   Item   | Size |             Description              |  Key  |  Action   |
|   name   |      |                                      |       |           |
+----------+------+--------------------------------------+-------+-----------+
|          |      | Long entry number in long entry      |       |           |
| Long     |      | chain in reverse order. If masked    |       |           |
| entry    | 1    | with 0x40, it is last entry. First   |       |           |
| number   |      | entry (the one just before the short |       |           |
|          |      | entry) has number 1.                 |       |           |
+----------+------+--------------------------------------+-------+-----------+
| Name     | 10   | Character 1 to 5 of name for this    |       |           |
| (part1)  |      | entry.                               |       |           |
+----------+------+--------------------------------------+-------+-----------+
|          |      | Entry flags (15 to identify long     |       | Display   |
| Flags    | 1    | entry).                              | Enter | flags     |
|          |      |                                      |       | details.  |
+----------+------+--------------------------------------+-------+-----------+
| Zero (1) | 1    | 0 value.                             |       |           |
+----------+------+--------------------------------------+-------+-----------+
| Checksum | 1    | Checksum of the corresponding short  | Enter | Compute   |
|          |      | entry.                               |       | checksum. |
+----------+------+--------------------------------------+-------+-----------+
| Name     | 12   | Character 6 to 11 of name for this   |       |           |
| (part2)  |      | entry.                               |       |           |
+----------+------+--------------------------------------+-------+-----------+
| Zero (2) | 2    | 0 value.                             |       |           |
+----------+------+--------------------------------------+-------+-----------+
| Name     | 4    | Character 12 to 13 of name for this  |       |           |
| (part3)  |      | entry.                               |       |           |
+----------+------+--------------------------------------+-------+-----------+

  d) FAT32 boot sector
This window displays the FAT32 boot sector:
+-------------+------+------------------------------------+-------+----------+
|  Item name  | Size |            Description             |  Key  |  Action  |
+-------------+------+------------------------------------+-------+----------+
| Jump code   | 3    | Code to reach begin of boot sector |       |          |
|             |      | code.                              |       |          |
+-------------+------+------------------------------------+-------+----------+
| OEM name    | 8    | OS Vendor identification string.   |       |          |
+-------------+------+------------------------------------+-------+----------+
| Bytes per   | 2    | Number of bytes a sector has.      |       |          |
| sector      |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Sectors per | 1    | Number of sectors a cluster has.   |       |          |
| cluster     |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Reserved    | 2    | Number of sectors before first     |       |          |
| sectors     |      | FAT.                               |       |          |
+-------------+------+------------------------------------+-------+----------+
| Number of   | 1    | Number of FAT.                     |       |          |
| FAT         |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Number of   |      | Number of entries in root          |       |          |
| root        | 2    | directory. An entry is 32 bytes    |       |          |
| entries     |      | long.                              |       |          |
+-------------+------+------------------------------------+-------+----------+
| Number of   |      | Number of sectors in partition. If |       |          |
| sectors     | 2    | it is 0, value is stored in Number |       |          |
| (short)     |      | of sectors (long).                 |       |          |
+-------------+------+------------------------------------+-------+----------+
| Media       | 1    | Type of media (floppy disk with    |       |          |
| descriptor  |      | its type, disk, ...).              |       |          |
+-------------+------+------------------------------------+-------+----------+
| Number of   |      | Number of sectors in one FAT. If   |       |          |
| sectors per | 2    | it is 0, value is stored in Number |       |          |
| FAT (short) |      | of sectors per FAT (long).         |       |          |
+-------------+------+------------------------------------+-------+----------+
| Sectors per | 2    | Number of sectors on one track.    |       |          |
| track       |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Heads per   | 2    | Number of heads on one cylinder.   |       |          |
| cylinder    |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Number of   |      | Sector at which partition begins   |       |          |
| sectors     | 4    | (in relative from begin of disk or |       |          |
| before      |      | from extended partition).          |       |          |
+-------------+------+------------------------------------+-------+----------+
| Number of   |      | Number of sectors in partition     |       |          |
| sectors     | 4    | when it is more than 65535.        |       |          |
| (long)      |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Number of   |      | Number of sectors in one FAT when  |       |          |
| sectors per | 4    | it is more than 65535.             |       |          |
| FAT (long)  |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Used FAT    | 2    | Definition of which FAT is used.   | Enter | Display  |
|             |      |                                    |       | details. |
+-------------+------+------------------------------------+-------+----------+
| FAT version | 2    | 0 to mean it is first FAT32        |       |          |
|             |      | format.                            |       |          |
+-------------+------+------------------------------------+-------+----------+
| Root first  | 4    | First cluster of root directory.   |       |          |
| cluster     |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Information | 2    | Sector where are stored some       | Enter | Go to    |
| sector      |      | information on FAT.                |       | sector.  |
+-------------+------+------------------------------------+-------+----------+
| Boot sector | 2    | Sector where is stored a copy of   | Enter | Go to    |
| copy        |      | the boot sector.                   |       | sector.  |
+-------------+------+------------------------------------+-------+----------+
| Reserved    | 12   | 0 value.                           |       |          |
+-------------+------+------------------------------------+-------+----------+
| Disk number | 1    | Disk or floppy number for BIOS.    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Reserved    | 1    | 0 value.                           |       |          |
+-------------+------+------------------------------------+-------+----------+
| Additional  | 1    | Value to mean that following       |       |          |
| information |      | information are given.             |       |          |
+-------------+------+------------------------------------+-------+----------+
| Volume      | 4    | Volume serial number (used to      |       |          |
| identifier  |      | track media change).               |       |          |
+-------------+------+------------------------------------+-------+----------+
| Volume      | 11   | Volume name, equivalent to the one |       |          |
| label       |      | stored in root directory.          |       |          |
+-------------+------+------------------------------------+-------+----------+
| FAT name    | 8    | FAT32 (but does not indicate type  |       |          |
|             |      | of FAT).                           |       |          |
+-------------+------+------------------------------------+-------+----------+
| Boot code   | 420  | Code to be able to boot this       |       |          |
|             |      | partition.                         |       |          |
+-------------+------+------------------------------------+-------+----------+
| Boot        | 2    | 0xAA55 signature to indicate boot  |       |          |
| signature   |      | sector.                            |       |          |
+-------------+------+------------------------------------+-------+----------+
| Unused      | Var. | Unused part (only present if       |       |          |
|             |      | sector is more than 512 bytes).    |       |          |
+-------------+------+------------------------------------+-------+----------+

  e) FAT32 information sector
This window displays the FAT32 information sector:
+-----------+------+------------------------------------------+-----+--------+
| Item name | Size |               Description                | Key | Action |
+-----------+------+------------------------------------------+-----+--------+
| First     | 4    | 0x41615252 value.                        |     |        |
| signature |      |                                          |     |        |
+-----------+------+------------------------------------------+-----+--------+
| Reserved  | 480  | 0 value.                                 |     |        |
+-----------+------+------------------------------------------+-----+--------+
| Second    | 4    | 0x61417272 value.                        |     |        |
| signature |      |                                          |     |        |
+-----------+------+------------------------------------------+-----+--------+
| Free      |      | Number of free clusters on the partition |     |        |
| clusters  | 4    | or 4294967295 if it is not computed.     |     |        |
| number    |      |                                          |     |        |
+-----------+------+------------------------------------------+-----+--------+
| First     |      | First cluster from which starting to     |     |        |
| free      | 4    | look for free cluster or 4294967295 if   |     |        |
| cluster   |      | it is not known.                         |     |        |
+-----------+------+------------------------------------------+-----+--------+
| Reserved  | 12   | 0 value.                                 |     |        |
+-----------+------+------------------------------------------+-----+--------+
| Third     | 4    | 0xAA550000 value.                        |     |        |
| signature |      |                                          |     |        |
+-----------+------+------------------------------------------+-----+--------+
| Unused    | Var. | Unused part (only present if sector is   |     |        |
|           |      | more than 512 bytes).                    |     |        |
+-----------+------+------------------------------------------+-----+--------+

  f) FAT32 FAT
This window displays the FAT32 FAT sectors. There are 4 entries per line with
each entry being split into:
+------+------+-----------------------------+--------+----------------+
| Item | Size |         Description         |  Key   |     Action     |
| name |      |                             |        |                |
+------+------+-----------------------------+--------+----------------+
|      |      |                             | Enter  | Go to cluster. |
|      | 28b  | 28 lowest bits of FAT entry +--------+----------------+
|      |      | value.                      | Shift+ | Follow FAT     |
|      |      |                             | Enter  | entry.         |
+------+------+-----------------------------+--------+----------------+
|      | 4b   | 4 highest bits of FAT entry |        |                |
|      |      | value.                      |        |                |
+------+------+-----------------------------+--------+----------------+
This can be followed by an 'Unused' entry for unused bytes at end of sectors.

12- NTFS definitions
--------------------

  a) Boot sector
This window displays the NTFS boot sector:
+------------+------+--------------------------------------+-------+--------+
| Item name  | Size |             Description              |  Key  | Action |
+------------+------+--------------------------------------+-------+--------+
| Jump code  | 3    | Code to reach begin of boot sector   |       |        |
|            |      | code.                                |       |        |
+------------+------+--------------------------------------+-------+--------+
| OEM name   | 8    | OS Vendor identification string.     |       |        |
+------------+------+--------------------------------------+-------+--------+
| Bytes per  | 2    | Number of bytes a sector has.        |       |        |
| sector     |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Sectors    |      |                                      |       |        |
| per        | 1    | Number of sectors a cluster has.     |       |        |
| cluster    |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Reserved   | 2    | 0 value.                             |       |        |
| sectors    |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Null       | 5    | 0 value.                             |       |        |
| values     |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Media      | 1    | Type of media (floppy disk with its  |       |        |
| descriptor |      | type, disk, ...).                    |       |        |
+------------+------+--------------------------------------+-------+--------+
| Null       | 2    | 0 value.                             |       |        |
| values     |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Sectors    | 2    | Number of sectors on one track.      |       |        |
| per track  |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Heads per  | 2    | Number of heads on one cylinder.     |       |        |
| cylinder   |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Number of  |      | Sector at which partition begins (in |       |        |
| sectors    | 4    | relative from begin of disk or from  |       |        |
| before     |      | extended partition).                 |       |        |
+------------+------+--------------------------------------+-------+--------+
| Null       | 4    | 0 value.                             |       |        |
| values     |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Disk       | 1    | Disk or floppy number for BIOS.      |       |        |
| number     |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Unused     | 3    | 0 value.                             |       |        |
+------------+------+--------------------------------------+-------+--------+
| Number of  | 8    | Number of sectors in partition.      |       |        |
| sectors    |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| MFT        |      |                                      |       | Go to  |
| cluster    | 8    | First cluster of $MFT file.          | Enter | MFT    |
|            |      |                                      |       | table  |
+------------+------+--------------------------------------+-------+--------+
|            |      |                                      |       | Go to  |
| MFT mirror | 8    | First cluster of $MFTMirr file.      | Enter | MFT    |
| cluster    |      |                                      |       | mirror |
|            |      |                                      |       | table  |
+------------+------+--------------------------------------+-------+--------+
| Cluster    |      | If positive, number of clusters per  |       |        |
| per MFT    | 1    | MFT record, if negative, size of MFT |       |        |
| record     |      | record in bytes (2 power absolute    |       |        |
|            |      | value).                              |       |        |
+------------+------+--------------------------------------+-------+--------+
| Unused     | 3    | 0 value.                             |       |        |
+------------+------+--------------------------------------+-------+--------+
| Cluster    |      | Size of index record (same           |       |        |
| per index  | 1    | computation than for cluster per MFT |       |        |
| record     |      | record).                             |       |        |
+------------+------+--------------------------------------+-------+--------+
| Unused     | 3    | 0 value.                             |       |        |
+------------+------+--------------------------------------+-------+--------+
| Volume     |      |                                      |       |        |
| serial     | 8    | Volume serial number.                |       |        |
| number     |      |                                      |       |        |
+------------+------+--------------------------------------+-------+--------+
| Unused     | 4    | 0 value.                             |       |        |
+------------+------+--------------------------------------+-------+--------+
| Boot code  | 426  | Code to be able to boot this         |       |        |
|            |      | partition.                           |       |        |
+------------+------+--------------------------------------+-------+--------+
| Boot       | 2    | 0xAA55 signature to indicate boot    |       |        |
| signature  |      | sector.                              |       |        |
+------------+------+--------------------------------------+-------+--------+
| Unused     | Var. | Unused part (only present if sector  |       |        |
|            |      | is more than 512 bytes).             |       |        |
+------------+------+--------------------------------------+-------+--------+

  b) MFT
The Master File Table is composed of several MFT record each of them
describing a file (or part of a file). They share the same structure:

  - a header,
  - one or several attributes.

Attributes describe file information and content. They can have several
representations depending on their type and if they are small enough to be
stored into the MFT record (resident attribute) or not (not resident
attribute). A resident attribute is composed of:

  - a header,
  - attribute data depending on its type.

A not resident attribute is composed of:

  - a header,
  - list of clusters (stored under data runs format) where attribute data are.

Last attribute has type 0xffffffff to mark end of attributes list.
The MFT record header has the following structure:
+------------+------+--------------------------------+-------+---------------+
| Item name  | Size |          Description           |  Key  |    Action     |
+------------+------+--------------------------------+-------+---------------+
| Magic      | 4    | "FILE" value.                  |       |               |
| number     |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
|            |      | Offset where the protection    |       |               |
|            |      | sequence appears. The          |       |               |
| Update     |      | protection sequence stores the |       |               |
| sequence   | 2    | two last bytes of each sector  |       |               |
| offset     |      | of MFT record and replaces     |       |               |
|            |      | them with a two bytes value    |       |               |
|            |      | appearing at begin of this     |       |               |
|            |      | sequence.                      |       |               |
+------------+------+--------------------------------+-------+---------------+
| Update     |      | Number of two bytes values in  |       |               |
| sequence   | 2    | protection sequence (number of |       |               |
| size       |      | sectors per MFT record + 1).   |       |               |
+------------+------+--------------------------------+-------+---------------+
| File       |      |                                |       |               |
| sequence   | 8    | Sequence number in $LogFile.   |       |               |
| number     |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
| Number of  | 2    | Number of use of file.         |       |               |
| use        |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
| Nb hard    | 2    | Number of hard links to file.  |       |               |
| link       |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
| Attribute  | 2    | Offset of first attribute.     |       |               |
| offset     |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
| Flags      | 2    | MFT record flags.              | Enter | Display flags |
|            |      |                                |       | detail.       |
+------------+------+--------------------------------+-------+---------------+
| File       |      | Size of file record (padded to |       |               |
| record     | 4    | multiple of 8).                |       |               |
| size       |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
| Allocated  | 4    | Allocated size of file record. |       |               |
| size       |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
|            |      | MFT record number of base      |       | Go to         |
| Base file  | 6    | record if this MFT is split    | Enter | corresponding |
|            |      | among several records (base    |       | MFT.          |
|            |      | record if 0).                  |       |               |
+------------+------+--------------------------------+-------+---------------+
| Seq.       | 2    | Number of use of base record.  |       |               |
| number     |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
| Next       |      | Next value that can be used as |       |               |
| attribute  | 2    | attribute number.              |       |               |
| number     |      |                                |       |               |
+------------+------+--------------------------------+-------+---------------+
| Padding    | Var. | Padding to reach update        |       |               |
|            |      | sequence offset.               |       |               |
+------------+------+--------------------------------+-------+---------------+
|            |      | Update sequence (2 first       |       |               |
| Update     |      | bytes: value set in two last   |       |               |
| sequence   | Var. | bytes of each sector,          |       |               |
|            |      | following two bytes: original  |       |               |
|            |      | value read from each sector).  |       |               |
+------------+------+--------------------------------+-------+---------------+
| Attributes | Var. | Content of attributes.         |       |               |
+------------+------+--------------------------------+-------+---------------+
| Unused in  | Var. | Unused part at end of MFT      |       |               |
| MFT        |      | record.                        |       |               |
+------------+------+--------------------------------+-------+---------------+
When being displayed in detailed format, the update sequence protection is
unset to see the correct value, but when being displayed in raw format, the
protection is left (so two last bytes of each sector need to be read from
update sequence).
A resident attribute header has following structure:
+------------+------+--------------------------+--------+--------------------+
| Item name  | Size |       Description        |  Key   |       Action       |
+------------+------+--------------------------+--------+--------------------+
| Attribute  |      | Type of attribute        |        |                    |
| type       | 4    | (content depends on      |        |                    |
|            |      | this).                   |        |                    |
+------------+------+--------------------------+--------+--------------------+
|            |      |                          | Enter  | Get length from    |
|            |      |                          |        | current size.      |
| Attribute  | 4    | Size of the attribute.   +--------+--------------------+
| size       |      |                          | Shift+ | Update unused part |
|            |      |                          | Enter  | at end of          |
|            |      |                          |        | attribute.         |
+------------+------+--------------------------+--------+--------------------+
| Not        | 1    | 0 to mean it is          |        |                    |
| resident   |      | resident.                |        |                    |
+------------+------+--------------------------+--------+--------------------+
|            |      |                          |        | Get value from     |
|            |      |                          | Enter  | current name       |
| Name       | 1    | Length of name of        |        | length.            |
| length     |      | attribute in UTF-16.     +--------+--------------------+
|            |      |                          | Shift+ | Update name        |
|            |      |                          | Enter  | length.            |
+------------+------+--------------------------+--------+--------------------+
|            |      |                          |        | Get offset from    |
|            |      |                          | Enter  | current name       |
| Name       |      | Offset of name of        |        | offset.            |
| offset     | 2    | attribute.               +--------+--------------------+
|            |      |                          | Shift+ | Update padding     |
|            |      |                          | Enter  | length before      |
|            |      |                          |        | name.              |
+------------+------+--------------------------+--------+--------------------+
| Flags      | 2    | Attribute's flags.       | Enter  | Display flags      |
|            |      |                          |        | detail.            |
+------------+------+--------------------------+--------+--------------------+
|            |      | Attribute unique         |        |                    |
| Identifier | 2    | identifier into MFT      |        |                    |
|            |      | record.                  |        |                    |
+------------+------+--------------------------+--------+--------------------+
| Data size  | 4    | Size of data part.       |        |                    |
+------------+------+--------------------------+--------+--------------------+
|            |      |                          |        | Get offset from    |
|            |      |                          | Enter  | current data       |
| Data       |      |                          |        | offset.            |
| offset     | 2    | Offset of data part.     +--------+--------------------+
|            |      |                          | Shift+ | Update padding     |
|            |      |                          | Enter  | length before      |
|            |      |                          |        | data.              |
+------------+------+--------------------------+--------+--------------------+
| Indexed    |      | Flag to signal if        |        |                    |
| flag       | 1    | attribute is indexed or  |        |                    |
|            |      | not.                     |        |                    |
+------------+------+--------------------------+--------+--------------------+
| Unused     | 1    | 0 value.                 |        |                    |
+------------+------+--------------------------+--------+--------------------+
| Padding    | Var. | Padding to reach name    |        |                    |
|            |      | offset.                  |        |                    |
+------------+------+--------------------------+--------+--------------------+
| Attribute  | Var. | Name of attribute in     |        |                    |
| name       |      | UTF-16.                  |        |                    |
+------------+------+--------------------------+--------+--------------------+
| Padding    | Var. | Padding to reach data    |        |                    |
|            |      | offset.                  |        |                    |
+------------+------+--------------------------+--------+--------------------+
|            |      | Data of attribute        |        |                    |
| Data       | Var. | (depends on attribute    |        |                    |
|            |      | type).                   |        |                    |
+------------+------+--------------------------+--------+--------------------+
| Unused in  | Var. | Padding to reach size of |        |                    |
| attr       |      | attribute.               |        |                    |
+------------+------+--------------------------+--------+--------------------+
A not resident attribute header structure depends on if data are compressed or
not. In case of not resident not compressed attribute, it has following
structure:
+-------------+------+-----------------------+--------+----------------------+
|  Item name  | Size |      Description      |  Key   |        Action        |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Type of attribute     |        | Go to the content    |
| Attribute   | 4    | (content depends on   | Enter  | with formatting it   |
| type        |      | this).                |        | depending on its     |
|             |      |                       |        | type.                |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       | Enter  | Get length from      |
| Attribute   |      | Size of the           |        | current size.        |
| size        | 4    | attribute.            +--------+----------------------+
|             |      |                       | Shift+ | Update unused part   |
|             |      |                       | Enter  | at end of attribute. |
+-------------+------+-----------------------+--------+----------------------+
| Not         | 1    | 1 to mean it is not   |        |                      |
| resident    |      | resident.             |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       | Enter  | Get value from       |
|             |      | Length of name of     |        | current name length. |
| Name length | 1    | attribute in UTF-16.  +--------+----------------------+
|             |      |                       | Shift+ | Update name length.  |
|             |      |                       | Enter  |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       | Enter  | Get offset from      |
|             |      | Offset of name of     |        | current name offset. |
| Name offset | 2    | attribute.            +--------+----------------------+
|             |      |                       | Shift+ | Update padding       |
|             |      |                       | Enter  | length before name.  |
+-------------+------+-----------------------+--------+----------------------+
| Flags       | 2    | Attribute's flags.    | Enter  | Display flags        |
|             |      |                       |        | detail.              |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Attribute unique      |        |                      |
| Identifier  | 2    | identifier into MFT   |        |                      |
|             |      | record.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      | First logical cluster |        |                      |
|             |      | covered by this       |        |                      |
|             |      | attribute when        |        |                      |
| First VCN   | 8    | several attributes of |        |                      |
|             |      | the same type exist   |        |                      |
|             |      | in the same MFT       |        |                      |
|             |      | record.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Last logical cluster  |        |                      |
| Last VCN    | 8    | covered by this       |        |                      |
|             |      | attribute.            |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       |        | Get offset from      |
|             |      |                       | Enter  | current data runs    |
| Data run    |      |                       |        | offset.              |
| offset      | 2    | Offset of data runs.  +--------+----------------------+
|             |      |                       | Shift+ | Update padding       |
|             |      |                       | Enter  | length before data   |
|             |      |                       |        | runs.                |
+-------------+------+-----------------------+--------+----------------------+
| Compression | 2    | 0 to mean             |        |                      |
| unit        |      | uncompressed.         |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Unused      | 4    | 0 value.              |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Alloc. data | 8    | Allocated size for    |        |                      |
| size        |      | data.                 |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Data size   | 8    | Size of data.         |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Init. data  | 8    | Initialised size of   |        |                      |
| size        |      | data.                 |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Padding     | Var. | Padding to reach name |        |                      |
|             |      | offset.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Attribute   | Var. | Name of attribute in  |        |                      |
| name        |      | UTF-16.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Padding     | Var. | Padding to reach data |        |                      |
|             |      | offset.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Description of        |        |                      |
| Data runs   | Var. | clusters where data   |        |                      |
|             |      | are.                  |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Unused in   | Var. | Padding to reach size |        |                      |
| attr        |      | of attribute.         |        |                      |
+-------------+------+-----------------------+--------+----------------------+
In case of not resident compressed attribute, it has following structure:
+-------------+------+-----------------------+--------+----------------------+
|  Item name  | Size |      Description      |  Key   |        Action        |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Type of attribute     |        | Go to the content    |
| Attribute   | 4    | (content depends on   | Enter  | with formatting it   |
| type        |      | this).                |        | depending on its     |
|             |      |                       |        | type.                |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       | Enter  | Get length from      |
| Attribute   |      | Size of the           |        | current size.        |
| size        | 4    | attribute.            +--------+----------------------+
|             |      |                       | Shift+ | Update unused part   |
|             |      |                       | Enter  | at end of attribute. |
+-------------+------+-----------------------+--------+----------------------+
| Not         | 1    | 1 to mean it is not   |        |                      |
| resident    |      | resident.             |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       | Enter  | Get value from       |
|             |      | Length of name of     |        | current name length. |
| Name length | 1    | attribute in UTF-16.  +--------+----------------------+
|             |      |                       | Shift+ | Update name length.  |
|             |      |                       | Enter  |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       | Enter  | Get offset from      |
|             |      | Offset of name of     |        | current name offset. |
| Name offset | 2    | attribute.            +--------+----------------------+
|             |      |                       | Shift+ | Update padding       |
|             |      |                       | Enter  | length before name.  |
+-------------+------+-----------------------+--------+----------------------+
| Flags       | 2    | Attribute's flags.    | Enter  | Display flags        |
|             |      |                       |        | detail.              |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Attribute unique      |        |                      |
| Identifier  | 2    | identifier into MFT   |        |                      |
|             |      | record.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      | First virtual cluster |        |                      |
|             |      | covered by this       |        |                      |
|             |      | attribute when        |        |                      |
| First VCN   | 8    | several attributes of |        |                      |
|             |      | the same type exist   |        |                      |
|             |      | in the same MFT       |        |                      |
|             |      | record.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Last virtual cluster  |        |                      |
| Last VCN    | 8    | covered by this       |        |                      |
|             |      | attribute.            |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      |                       |        | Get offset from      |
|             |      |                       | Enter  | current data runs    |
| Data run    |      |                       |        | offset.              |
| offset      | 2    | Offset of data runs.  +--------+----------------------+
|             |      |                       | Shift+ | Update padding       |
|             |      |                       | Enter  | length before data   |
|             |      |                       |        | runs.                |
+-------------+------+-----------------------+--------+----------------------+
| Compression | 2    | Compression buffer    |        |                      |
| unit        |      | size.                 |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Unused      | 4    | 0 value.              |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Alloc. data | 8    | Allocated size for    |        |                      |
| size        |      | data.                 |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Data size   | 8    | Size of data.         |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Init. data  | 8    | Initialised size of   |        |                      |
| size        |      | data.                 |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Compressed  | 8    | Size of data after    |        |                      |
| data size   |      | compression.          |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Padding     | Var. | Padding to reach name |        |                      |
|             |      | offset.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Attribute   | Var. | Name of attribute in  |        |                      |
| name        |      | UTF-16.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Padding     | Var. | Padding to reach data |        |                      |
|             |      | offset.               |        |                      |
+-------------+------+-----------------------+--------+----------------------+
|             |      | Description of        |        |                      |
| Data runs   | Var. | clusters where data   |        |                      |
|             |      | are.                  |        |                      |
+-------------+------+-----------------------+--------+----------------------+
| Unused in   | Var. | Padding to reach size |        |                      |
| attr        |      | of attribute.         |        |                      |
+-------------+------+-----------------------+--------+----------------------+
Data runs are described through a list of cluster ranges stored as:
+----------+------+------------------------------------+--------+-----------+
|   Item   | Size |            Description             |  Key   |  Action   |
|   name   |      |                                    |        |           |
+----------+------+------------------------------------+--------+-----------+
|          |      | 4 upper bits give size of begin    |        |           |
| Sizes    | 1    | cluster part, 4 lower bits give    |        |           |
|          |      | size of length part.               |        |           |
+----------+------+------------------------------------+--------+-----------+
|          |      |                                    | Enter  | Go to     |
|          |      |                                    |        | clusters. |
| Nb       | Var. | Number of clusters in this data    +--------+-----------+
| clusters |      | run.                               | Shift+ | Update    |
|          |      |                                    | Enter  | sizes     |
|          |      |                                    |        | value.    |
+----------+------+------------------------------------+--------+-----------+
|          |      |                                    | Enter  | Go to     |
|          |      |                                    |        | clusters. |
| Begin    | Var. | First cluster in this data run.    +--------+-----------+
| cluster  |      |                                    | Shift+ | Update    |
|          |      |                                    | Enter  | sizes     |
|          |      |                                    |        | value.    |
+----------+------+------------------------------------+--------+-----------+
| Sparse   |      | Type of data run: either not       |        |           |
| type     | Var. | sparse, or using V1.2 or V3.0 type |        |           |
|          |      | of sparse data run encoding.       |        |           |
+----------+------+------------------------------------+--------+-----------+
Numbers are stored in a compressed way: first byte of data run gives number of
bytes to represent each part. The begin cluster part gives cluster value in
relative from absolute cluster starting previous data run (so is a signed
value). When data area is filled by 0, data runs can be stored as sparse data
runs: they do not occupy any space on disk. There is two ways to represent
sparse data runs:

  - setting the absolute value of begin cluster to -1 (this way was used
    before Windows 2000 but can still be used). This coding is used when the
    V1.2 sparse type is checked.
  - setting the length of begin cluster to 0 (it is used since Windows 2000).
    This coding is used when the V3.0 sparse type is checked.

Data runs list ends with a data run having both sizes equal to 0. When being
displayed in detailed format, the begin cluster of data runs is displayed in
absolute value. When being displayed in raw format, data runs are displayed as
stored on disk (so with relative starting cluster).
Description of attributes depending on their type:

  - 0x00000010: standard information
  - 0x00000020: attributes list
  - 0x00000030: file name
  - 0x00000040: object identifier
  - 0x00000050: security descriptor
  - 0x00000060: volume name
  - 0x00000070: volume information
  - 0x00000080: data
  - 0x00000090: root index
  - 0x000000a0: index allocation
  - 0x000000b0: bitmap
  - 0x000000c0: reparse point
  - 0x000000d0: extended attributes information
  - 0x000000e0: extended attributes
  - 0x000000f0: property set
  - 0x00000100: logged utility stream
  - 0xffffffff: end of attributes: this attribute has neither header nor data.

  c) Standard information attribute
The standard information attribute has type 0x10 and has following structure:
+-------------+------+------------------------------------+-------+----------+
|  Item name  | Size |            Description             |  Key  |  Action  |
+-------------+------+------------------------------------+-------+----------+
| Creation    |      |                                    |       | Display  |
| time        | 8    | File creation time.                | Enter | time     |
|             |      |                                    |       | details. |
+-------------+------+------------------------------------+-------+----------+
|             |      |                                    |       | Display  |
| Mod. time   | 8    | File modification time.            | Enter | time     |
|             |      |                                    |       | details. |
+-------------+------+------------------------------------+-------+----------+
|             |      |                                    |       | Display  |
| MFT time    | 8    | MFT record modification time.      | Enter | time     |
|             |      |                                    |       | details. |
+-------------+------+------------------------------------+-------+----------+
|             |      |                                    |       | Display  |
| Read time   | 8    | File access time.                  | Enter | time     |
|             |      |                                    |       | details. |
+-------------+------+------------------------------------+-------+----------+
| DOS         |      |                                    |       | Display  |
| permissions | 4    | DOS permissions flag.              | Enter | flags    |
|             |      |                                    |       | detail.  |
+-------------+------+------------------------------------+-------+----------+
| Max nb ver  | 4    | Maximum allowed versions for file  |       |          |
|             |      | (0: disabled).                     |       |          |
+-------------+------+------------------------------------+-------+----------+
| Version     | 4    | File version.                      |       |          |
+-------------+------+------------------------------------+-------+----------+
| Class id.   | 4    | Class identifier for class index.  |       |          |
+-------------+------+------------------------------------+-------+----------+
| Owner id.   | 4    | Owner identifier.                  |       |          |
+-------------+------+------------------------------------+-------+----------+
| Secur. id.  | 4    | Key in the $SSII index.            |       |          |
+-------------+------+------------------------------------+-------+----------+
| Quota       | 8    | Size of this file in user's quota. |       |          |
| charged     |      |                                    |       |          |
+-------------+------+------------------------------------+-------+----------+
| Up. seq. nb | 8    | Last update sequence number of the |       |          |
|             |      | file.                              |       |          |
+-------------+------+------------------------------------+-------+----------+
Depending on attribute's size, last four fields could be absent.

  d) Attributes list attribute
The attributes list attribute has type 0x20. It stores references to all
attributes in a MFT record when this one is split over several MFT. It is
composed of several records describing one attribute and having following
structure:
+-----------+------+----------------------------+--------+-----------------+
| Item name | Size |        Description         |  Key   |     Action      |
+-----------+------+----------------------------+--------+-----------------+
| Type      | 4    | Type of the attribute      |        |                 |
|           |      | described by this record.  |        |                 |
+-----------+------+----------------------------+--------+-----------------+
|           |      |                            | Enter  | Get length from |
|           |      |                            |        | current size.   |
| Length    | 2    | Length of this record.     +--------+-----------------+
|           |      |                            | Shift+ | Update padding  |
|           |      |                            | Enter  | length at end.  |
+-----------+------+----------------------------+--------+-----------------+
|           |      |                            |        | Get value from  |
|           |      |                            | Enter  | current name    |
| Name      | 1    | Length of name of          |        | length.         |
| length    |      | attribute.                 +--------+-----------------+
|           |      |                            | Shift+ | Update name     |
|           |      |                            | Enter  | length.         |
+-----------+------+----------------------------+--------+-----------------+
|           |      |                            |        | Get offset from |
|           |      |                            | Enter  | current name    |
| Name      |      | Offset of name of          |        | offset.         |
| offset    | 1    | attribute.                 +--------+-----------------+
|           |      |                            | Shift+ | Update padding  |
|           |      |                            | Enter  | length before   |
|           |      |                            |        | name.           |
+-----------+------+----------------------------+--------+-----------------+
| VCN       | 8    | First virtual cluster of   |        |                 |
|           |      | attribute.                 |        |                 |
+-----------+------+----------------------------+--------+-----------------+
|           |      | MFT record where the       |        | Go to           |
| MFT       | 6    | attribute is stored.       | Enter  | corresponding   |
|           |      |                            |        | MFT.            |
+-----------+------+----------------------------+--------+-----------------+
| Seq.      | 2    | Number of use of MFT       |        |                 |
| number    |      | record.                    |        |                 |
+-----------+------+----------------------------+--------+-----------------+
| Attribute | 2    | Unique identifier of       |        |                 |
| id.       |      | attribute into MFT record. |        |                 |
+-----------+------+----------------------------+--------+-----------------+
| Padding   | Var. | Padding to reach name      |        |                 |
|           |      | offset.                    |        |                 |
+-----------+------+----------------------------+--------+-----------------+
| Attr name | Var. | Attribute name.            |        |                 |
+-----------+------+----------------------------+--------+-----------------+
| Padding   | Var. | Padding to reach record    |        |                 |
|           |      | size.                      |        |                 |
+-----------+------+----------------------------+--------+-----------------+

  e) File name attribute
The file name attribute has type 0x30 and has following structure:
+-----------+------+--------------------------------+--------+---------------+
| Item name | Size |          Description           |  Key   |    Action     |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                |        | Go to         |
|           |      |                                | Enter  | corresponding |
|           |      | MFT record of directory where  |        | MFT.          |
| Directory | 6    | file is.                       +--------+---------------+
|           |      |                                | Shift+ | Go to         |
|           |      |                                | Enter  | directory     |
|           |      |                                |        | content.      |
+-----------+------+--------------------------------+--------+---------------+
| Seq.      | 2    | Number of use of directory MFT |        |               |
| number    |      | record.                        |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Creation  | 8    | File creation time.            | Enter  | Display time  |
| time      |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Mod. time | 8    | File modification time.        | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| MFT time  | 8    | MFT record modification time.  | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Read time | 8    | File access time.              | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Alloc.    | 8    | Size allocated to file.        |        |               |
| size      |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Size      | 8    | Size of file.                  |        |               |
+-----------+------+--------------------------------+--------+---------------+
| File      | 4    | File flags.                    | Enter  | Display flags |
| flags     |      |                                |        | detail.       |
+-----------+------+--------------------------------+--------+---------------+
| Ext.      | 4    | Size of extended attributes.   |        |               |
| attr.     |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                |        | Get value     |
|           |      |                                | Enter  | from current  |
| Name      | 1    | Length of file name.           |        | name length.  |
| length    |      |                                +--------+---------------+
|           |      |                                | Shift+ | Update name   |
|           |      |                                | Enter  | length.       |
+-----------+------+--------------------------------+--------+---------------+
|           |      | Namespace of the file name (0: |        |               |
| Namespace | 1    | POSIX, 1: Win32, 2: DOS, 3:    |        |               |
|           |      | Win32 and DOS).                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Name      | Var. | File name in UTF-16.           |        |               |
+-----------+------+--------------------------------+--------+---------------+

  f) Object identifier attribute
The file name attribute has type 0x40 and has following structure:
+-------------+------+-----------------------------------+-----+--------+
|  Item name  | Size |            Description            | Key | Action |
+-------------+------+-----------------------------------+-----+--------+
| GUID object | 16   | Object unique identifier.         |     |        |
| identifier  |      |                                   |     |        |
+-------------+------+-----------------------------------+-----+--------+
| GUID birth  |      | Unique identifier of volume where |     |        |
| volume      | 16   | file was created.                 |     |        |
| identifier  |      |                                   |     |        |
+-------------+------+-----------------------------------+-----+--------+
| GUID birth  |      |                                   |     |        |
| object      | 16   | Original unique identifier.       |     |        |
| identifier  |      |                                   |     |        |
+-------------+------+-----------------------------------+-----+--------+
| GUID domain | 16   | Network unique identifier.        |     |        |
| identifier  |      |                                   |     |        |
+-------------+------+-----------------------------------+-----+--------+
Depending on attribute's size only first fields could be present.

  g) Security descriptor attribute
The security descriptor attribute has type 0x50 and has following structure:
+----------+------+--------------------------+--------+----------------------+
|   Item   | Size |       Description        |  Key   |        Action        |
|   name   |      |                          |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Revision | 1    | Security descriptor      |        |                      |
|          |      | version.                 |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Padding  | 1    | Unused value.            |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Control  | 2    | Flags to describe        | Enter  | Display flags        |
| flags    |      | security descriptor.     |        | detail.              |
+----------+------+--------------------------+--------+----------------------+
|          |      |                          |        | Get offset from      |
|          |      |                          | Enter  | current user SID     |
| User SID |      |                          |        | offset.              |
| offset   | 4    | Offset of the user SID.  +--------+----------------------+
|          |      |                          | Shift+ | Update padding       |
|          |      |                          | Enter  | length before user   |
|          |      |                          |        | SID.                 |
+----------+------+--------------------------+--------+----------------------+
|          |      |                          |        | Get offset from      |
|          |      |                          | Enter  | current group SID    |
| Group    |      |                          |        | offset.              |
| SID      | 4    | Offset of the group SID. +--------+----------------------+
| offset   |      |                          | Shift+ | Update padding       |
|          |      |                          | Enter  | length before group  |
|          |      |                          |        | SID.                 |
+----------+------+--------------------------+--------+----------------------+
|          |      |                          | Enter  | Get offset from      |
| SACL     |      |                          |        | current SACL offset. |
| offset   | 4    | Offset of the SACL.      +--------+----------------------+
|          |      |                          | Shift+ | Update padding       |
|          |      |                          | Enter  | length before SACL.  |
+----------+------+--------------------------+--------+----------------------+
|          |      |                          | Enter  | Get offset from      |
| DACL     |      |                          |        | current DACL offset. |
| offset   | 4    | Offset of the DACL       +--------+----------------------+
|          |      |                          | Shift+ | Update padding       |
|          |      |                          | Enter  | length before DACL.  |
+----------+------+--------------------------+--------+----------------------+
| Padding  | Var. | Padding to reach SACL    |        |                      |
|          |      | offset.                  |        |                      |
+----------+------+--------------------------+--------+----------------------+
| SACL     | Var. | System Access Control    |        |                      |
|          |      | List description.        |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Padding  | Var. | Padding to reach DACL    |        |                      |
|          |      | offset.                  |        |                      |
+----------+------+--------------------------+--------+----------------------+
|          |      | Discretionary Access     |        |                      |
| DACL     | Var. | Control List             |        |                      |
|          |      | description.             |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Padding  | Var. | Padding to reach user    |        |                      |
|          |      | SID.                     |        |                      |
+----------+------+--------------------------+--------+----------------------+
| User SID | Var. | User that owns the file. |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Padding  | Var. | Padding to reach group   |        |                      |
|          |      | SID.                     |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Group    | Var. | Group that owns the      |        |                      |
| SID      |      | file.                    |        |                      |
+----------+------+--------------------------+--------+----------------------+
| Unused   | Var. | Unused part at end of    |        |                      |
|          |      | attribute.               |        |                      |
+----------+------+--------------------------+--------+----------------------+
An Access Control List has the following structure:
+----------+------+---------------------+--------+-----------------------+
|   Item   | Size |     Description     |  Key   |        Action         |
|   name   |      |                     |        |                       |
+----------+------+---------------------+--------+-----------------------+
| Revision | 1    | ACL version.        |        |                       |
+----------+------+---------------------+--------+-----------------------+
| Padding  | 1    | Unused value.       |        |                       |
+----------+------+---------------------+--------+-----------------------+
|          |      |                     | Enter  | Get size from current |
|          |      |                     |        | ACL size.             |
| Size     | 2    | ACL size.           +--------+-----------------------+
|          |      |                     | Shift+ | Update unused part    |
|          |      |                     | Enter  | length at end.        |
+----------+------+---------------------+--------+-----------------------+
| ACE      | 2    | Number of Access    |        |                       |
| count    |      | Control Entry.      |        |                       |
+----------+------+---------------------+--------+-----------------------+
| Padding  | 2    | Unused value.       |        |                       |
+----------+------+---------------------+--------+-----------------------+
| ACE      | Var. | Access Control      |        |                       |
|          |      | Entries.            |        |                       |
+----------+------+---------------------+--------+-----------------------+
| Unused   | Var. | Unused bytes at end |        |                       |
| in ACL   |      | of ACL.             |        |                       |
+----------+------+---------------------+--------+-----------------------+
An Access Control Entry has the following structure:
+--------+------+------------------------+--------+-------------------------+
|  Item  | Size |      Description       |  Key   |         Action          |
|  name  |      |                        |        |                         |
+--------+------+------------------------+--------+-------------------------+
| Type   | 1    | ACE type.              |        |                         |
+--------+------+------------------------+--------+-------------------------+
| Flags  | 1    | ACE flags.             | Enter  | Display flags detail.   |
+--------+------+------------------------+--------+-------------------------+
|        |      |                        | Enter  | Get size from current   |
|        |      |                        |        | ACE size.               |
| Size   | 2    | ACE size.              +--------+-------------------------+
|        |      |                        | Shift+ | Update unused part      |
|        |      |                        | Enter  | length at end.          |
+--------+------+------------------------+--------+-------------------------+
| Access | 4    | Allowed or disallowed  | Enter  | Display actions detail. |
| mask   |      | actions.               |        |                         |
+--------+------+------------------------+--------+-------------------------+
| SID    | Var. | Identifier to which    |        |                         |
|        |      | ACE applies.           |        |                         |
+--------+------+------------------------+--------+-------------------------+
| Unused | Var. | Unused bytes at end of |        |                         |
| in ACE |      | ACE.                   |        |                         |
+--------+------+------------------------+--------+-------------------------+

  h) Volume name attribute
The volume name attribute has type 0x60 and has following structure:
+-----------+------+---------------------------+-----+--------+
| Item name | Size |        Description        | Key | Action |
+-----------+------+---------------------------+-----+--------+
| Name      | Var. | Name of volume in UTF-16. |     |        |
+-----------+------+---------------------------+-----+--------+

  i) Volume information attribute
The volume information attribute has type 0x70 and has following structure:
+---------------+------+---------------------+-------+-----------------------+
|   Item name   | Size |     Description     |  Key  |        Action         |
+---------------+------+---------------------+-------+-----------------------+
| Unknown       | 8    | Not known content.  |       |                       |
+---------------+------+---------------------+-------+-----------------------+
| Major version | 1    | NTFS major version. |       |                       |
+---------------+------+---------------------+-------+-----------------------+
| Minor version | 1    | NTFS minor version. |       |                       |
+---------------+------+---------------------+-------+-----------------------+
| Flags         | 2    | Volume flags.       | Enter | Display flags detail. |
+---------------+------+---------------------+-------+-----------------------+
| Unknown       | 4    | Not known content.  |       |                       |
+---------------+------+---------------------+-------+-----------------------+

  j) Data attribute
The data attribute has type 0x80 and has following structure:
+-----------+------+-----------------------+-----+--------+
| Item name | Size |      Description      | Key | Action |
+-----------+------+-----------------------+-----+--------+
| Data      | Var. | Content of attribute. |     |        |
+-----------+------+-----------------------+-----+--------+

  k) Index root attribute
The index root attribute has type 0x90 and has following structure:
+-------------+------+----------------------------------+--------+----------+
|  Item name  | Size |           Description            |  Key   |  Action  |
+-------------+------+----------------------------------+--------+----------+
| Type        | 4    | Type of the indexed attribute.   |        |          |
+-------------+------+----------------------------------+--------+----------+
| Collation   | 4    | Collation rule used to sort      |        |          |
| rule        |      | entries.                         |        |          |
+-------------+------+----------------------------------+--------+----------+
| Alloc.      | 4    | Size of index allocation         |        |          |
| index size  |      | entries.                         |        |          |
+-------------+------+----------------------------------+--------+----------+
| Cluster per |      | Size of each index block (same   |        |          |
| index       | 1    | way of coding than in boot       |        |          |
| record      |      | sector).                         |        |          |
+-------------+------+----------------------------------+--------+----------+
| Padding     | 3    | Unused value.                    |        |          |
+-------------+------+----------------------------------+--------+----------+
|             |      |                                  |        | Get      |
|             |      |                                  |        | offset   |
|             |      |                                  | Enter  | from     |
|             |      |                                  |        | current  |
| Entries     |      |                                  |        | offset.  |
| offset      | 4    | Offset of content.               +--------+----------+
|             |      |                                  |        | Update   |
|             |      |                                  | Shift+ | padding  |
|             |      |                                  | Enter  | length   |
|             |      |                                  |        | before   |
|             |      |                                  |        | entries. |
+-------------+------+----------------------------------+--------+----------+
| Entries     | 4    | Size of entries.                 |        |          |
| size        |      |                                  |        |          |
+-------------+------+----------------------------------+--------+----------+
| Allocated   | 4    | Size allocated for entries.      |        |          |
| size        |      |                                  |        |          |
+-------------+------+----------------------------------+--------+----------+
| Uses        |      | 0: entries in this attribute, 1: |        |          |
| index_alloc | 1    | entries in index allocation      |        |          |
|             |      | attribute.                       |        |          |
+-------------+------+----------------------------------+--------+----------+
| Padding     | Var. | Padding to reach entries offset. |        |          |
+-------------+------+----------------------------------+--------+----------+
| Content     | Var. | Entries content.                 |        |          |
+-------------+------+----------------------------------+--------+----------+
| Empty       | Var. | Padding to reach allocated size. |        |          |
+-------------+------+----------------------------------+--------+----------+
In case of directory, entries content has following structure:
+-----------+------+--------------------------------+--------+---------------+
| Item name | Size |          Description           |  Key   |    Action     |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                | Enter  | Go to MFT of  |
| File      |      | MFT record of the referenced   |        | file.         |
| reference | 6    | file.                          +--------+---------------+
|           |      |                                | Shift+ | Go to file    |
|           |      |                                | Enter  | content.      |
+-----------+------+--------------------------------+--------+---------------+
| Seq.      | 2    | Number of use of file MFT      |        |               |
| number    |      | record.                        |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Entry     | 2    | Size of the entry.             |        |               |
| length    |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Attribute | 2    | Size of the attribute.         |        |               |
| size      |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Entry     | 2    | Entry flags.                   | Enter  | Displays      |
| flags     |      |                                |        | flags detail. |
+-----------+------+--------------------------------+--------+---------------+
| Unused    | 2    | Unused value.                  |        |               |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                |        | Go to         |
|           |      |                                | Enter  | corresponding |
|           |      | MFT record of directory where  |        | MFT.          |
| Directory | 6    | file is.                       +--------+---------------+
|           |      |                                | Shift+ | Go to         |
|           |      |                                | Enter  | directory     |
|           |      |                                |        | content.      |
+-----------+------+--------------------------------+--------+---------------+
| Seq.      | 2    | Number of use of directory MFT |        |               |
| number    |      | record.                        |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Creation  | 8    | File creation time.            | Enter  | Display time  |
| time      |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Mod. time | 8    | File modification time.        | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| MFT time  | 8    | MFT record modification time.  | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Read time | 8    | File access time.              | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Alloc.    | 8    | Size allocated to file.        |        |               |
| size      |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Size      | 8    | Size of file.                  |        |               |
+-----------+------+--------------------------------+--------+---------------+
| File      | 4    | File flags.                    | Enter  | Display flags |
| flags     |      |                                |        | detail.       |
+-----------+------+--------------------------------+--------+---------------+
| Ext.      | 4    | Size of extended attributes.   |        |               |
| attr.     |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                |        | Get length    |
|           |      |                                | Enter  | from current  |
| Name      | 1    | Length of file name.           |        | name.         |
| length    |      |                                +--------+---------------+
|           |      |                                | Shift+ | Update name   |
|           |      |                                | Enter  | length.       |
+-----------+------+--------------------------------+--------+---------------+
|           |      | Namespace of the file name (0: |        |               |
| Namespace | 1    | POSIX, 1: Win32, 2: DOS, 3:    |        |               |
|           |      | Win32 and DOS).                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Name      | Var. | File name in UTF-16.           |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Padding   | Var. | Padding value.                 |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Sub-node  |      | VCN of sub-node (only present  |        |               |
| VCN       | 8    | if sub-node flag is set in     |        |               |
|           |      | flags).                        |        |               |
+-----------+------+--------------------------------+--------+---------------+
Part after "Unused" entry could be not given for last entry.

  l) Index allocation attribute
The index allocation attribute has type 0xa0 and is composed of several
entries having following structure:
+-----------+------+-----------------------------------+--------+------------+
| Item name | Size |            Description            |  Key   |   Action   |
+-----------+------+-----------------------------------+--------+------------+
| Magic     | 4    | "INDX" value.                     |        |            |
| number    |      |                                   |        |            |
+-----------+------+-----------------------------------+--------+------------+
|           |      | Offset where the protection       |        |            |
|           |      | sequence appears. The protection  |        |            |
| Update    |      | sequence stores the two last      |        |            |
| sequence  | 2    | bytes of each sector of index     |        |            |
| offset    |      | record and replaces them with a   |        |            |
|           |      | two bytes value appearing at      |        |            |
|           |      | begin of this sequence.           |        |            |
+-----------+------+-----------------------------------+--------+------------+
| Update    |      | Number of two bytes values in     |        |            |
| sequence  | 2    | protection sequence (number of    |        |            |
| size      |      | sectors per index record + 1).    |        |            |
+-----------+------+-----------------------------------+--------+------------+
| $LogFile  |      |                                   |        |            |
| seq.      | 8    | Sequence number in $LogFile.      |        |            |
| number    |      |                                   |        |            |
+-----------+------+-----------------------------------+--------+------------+
| VCN in    | 8    | Virtual cluster of this index     |        |            |
| sequence  |      | record into index allocation.     |        |            |
+-----------+------+-----------------------------------+--------+------------+
|           |      |                                   |        | Get offset |
|           |      |                                   | Enter  | from       |
|           |      |                                   |        | content    |
|           |      |                                   |        | offset.    |
| Entries   | 4    | Offset of content.                +--------+------------+
| offset    |      |                                   |        | Update     |
|           |      |                                   | Shift+ | padding    |
|           |      |                                   | Enter  | length     |
|           |      |                                   |        | before     |
|           |      |                                   |        | content.   |
+-----------+------+-----------------------------------+--------+------------+
| Entries   | 4    | Size of entries.                  |        |            |
| size      |      |                                   |        |            |
+-----------+------+-----------------------------------+--------+------------+
|           |      |                                   |        | Get size   |
|           |      |                                   | Enter  | from       |
|           |      |                                   |        | content    |
| Allocated |      |                                   |        | size.      |
| size      | 4    | Size allocated for entries.       +--------+------------+
|           |      |                                   |        | Update     |
|           |      |                                   | Shift+ | empty      |
|           |      |                                   | Enter  | length at  |
|           |      |                                   |        | end.       |
+-----------+------+-----------------------------------+--------+------------+
| Has       | 1    | 0: index record is leaf, 1: index |        |            |
| children  |      | record has children.              |        |            |
+-----------+------+-----------------------------------+--------+------------+
| Padding   | Var. | Padding to reach entries offset.  |        |            |
+-----------+------+-----------------------------------+--------+------------+
| Content   | Var. | Entries content.                  |        |            |
+-----------+------+-----------------------------------+--------+------------+
| Empty     | Var. | Padding to reach allocated size.  |        |            |
+-----------+------+-----------------------------------+--------+------------+
In case of directory, entries content has following structure:
+-----------+------+--------------------------------+--------+---------------+
| Item name | Size |          Description           |  Key   |    Action     |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                | Enter  | Go to MFT of  |
| File      |      | MFT record of the referenced   |        | file.         |
| reference | 6    | file.                          +--------+---------------+
|           |      |                                | Shift+ | Go to file    |
|           |      |                                | Enter  | content.      |
+-----------+------+--------------------------------+--------+---------------+
| Seq.      | 2    | Number of use of file MFT      |        |               |
| number    |      | record.                        |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Entry     | 2    | Size of the entry.             |        |               |
| length    |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Attribute | 2    | Size of the attribute.         |        |               |
| size      |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Entry     | 2    | Entry flags.                   | Enter  | Displays      |
| flags     |      |                                |        | flags detail. |
+-----------+------+--------------------------------+--------+---------------+
| Unused    | 2    | Unused value.                  |        |               |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                |        | Go to         |
|           |      |                                | Enter  | corresponding |
|           |      | MFT record of directory where  |        | MFT.          |
| Directory | 6    | file is.                       +--------+---------------+
|           |      |                                | Shift+ | Go to         |
|           |      |                                | Enter  | directory     |
|           |      |                                |        | content.      |
+-----------+------+--------------------------------+--------+---------------+
| Seq.      | 2    | Number of use of directory MFT |        |               |
| number    |      | record.                        |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Creation  | 8    | File creation time.            | Enter  | Display time  |
| time      |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Mod. time | 8    | File modification time.        | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| MFT time  | 8    | MFT record modification time.  | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Read time | 8    | File access time.              | Enter  | Display time  |
|           |      |                                |        | details.      |
+-----------+------+--------------------------------+--------+---------------+
| Alloc.    | 8    | Size allocated to file.        |        |               |
| size      |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Size      | 8    | Size of file.                  |        |               |
+-----------+------+--------------------------------+--------+---------------+
| File      | 4    | File flags.                    | Enter  | Display flags |
| flags     |      |                                |        | detail.       |
+-----------+------+--------------------------------+--------+---------------+
| Ext.      | 4    | Size of extended attributes.   |        |               |
| attr.     |      |                                |        |               |
+-----------+------+--------------------------------+--------+---------------+
|           |      |                                |        | Get length    |
|           |      |                                | Enter  | from current  |
| Name      | 1    | Length of file name.           |        | name.         |
| length    |      |                                +--------+---------------+
|           |      |                                | Shift+ | Update name   |
|           |      |                                | Enter  | length.       |
+-----------+------+--------------------------------+--------+---------------+
|           |      | Namespace of the file name (0: |        |               |
| Namespace | 1    | POSIX, 1: Win32, 2: DOS, 3:    |        |               |
|           |      | Win32 and DOS).                |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Name      | Var. | File name in UTF-16.           |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Padding   | Var. | Padding value.                 |        |               |
+-----------+------+--------------------------------+--------+---------------+
| Sub-node  |      | VCN of sub-node (only present  |        |               |
| VCN       | 8    | if sub-node flag is set in     |        |               |
|           |      | flags).                        |        |               |
+-----------+------+--------------------------------+--------+---------------+

  m) Bitmap attribute
The bitmap attribute has type 0xb0 and has following structure:
+--------+------+--------------------------------------+-------+-------------+
|  Item  | Size |             Description              |  Key  |   Action    |
|  name  |      |                                      |       |             |
+--------+------+--------------------------------------+-------+-------------+
|        |      | Bits giving object state (depends on |       | Displays    |
| Bitmap | Var. | bitmap type).                        | Enter | bits        |
|        |      |                                      |       | definition. |
+--------+------+--------------------------------------+-------+-------------+

  n) Reparse point attribute
The reparse point attribute has type 0xc0 and has following structure:
+----------+------+----------------------+--------+------------------------+
|   Item   | Size |     Description      |  Key   |         Action         |
|   name   |      |                      |        |                        |
+----------+------+----------------------+--------+------------------------+
| Type     | 4    | Type and flags of    |        |                        |
|          |      | reparse point.       |        |                        |
+----------+------+----------------------+--------+------------------------+
|          |      |                      | Enter  | Get length from        |
|          |      |                      |        | current content.       |
| Size     | 2    | Content length.      +--------+------------------------+
|          |      |                      | Shift+ | Update content length. |
|          |      |                      | Enter  |                        |
+----------+------+----------------------+--------+------------------------+
| Reserved | 2    | Padding.             |        |                        |
+----------+------+----------------------+--------+------------------------+
| Content  | Var. | Content depending on |        |                        |
|          |      | type.                |        |                        |
+----------+------+----------------------+--------+------------------------+

  o) Extended attribute information attribute
The extended attributes information attribute has type 0xd0 and has following
structure:
+---------------+------+-----------------------------------+-----+--------+
|   Item name   | Size |            Description            | Key | Action |
+---------------+------+-----------------------------------+-----+--------+
| Packed size   | 2    | Size of the packed information.   |     |        |
+---------------+------+-----------------------------------+-----+--------+
| Nb ext. attr. | 2    | Number of extended attributes.    |     |        |
+---------------+------+-----------------------------------+-----+--------+
| Unpacked size | 4    | Size of the unpacked information. |     |        |
+---------------+------+-----------------------------------+-----+--------+

  p) Extended attribute attribute
The extended attributes attribute has type 0xe0 and stores several definitions
having following structure:
+--------+------+------------------------------+--------+-----------------+
|  Item  | Size |         Description          |  Key   |     Action      |
|  name  |      |                              |        |                 |
+--------+------+------------------------------+--------+-----------------+
|        |      |                              | Enter  | Get length from |
|        |      |                              |        | current size.   |
| Size   | 4    | Extended attribute size.     +--------+-----------------+
|        |      |                              | Shift+ | Update unused   |
|        |      |                              | Enter  | length.         |
+--------+------+------------------------------+--------+-----------------+
| Flags  | 1    | Extended attribute flags.    |        |                 |
+--------+------+------------------------------+--------+-----------------+
|        |      |                              | Enter  | Get length from |
| Name   |      | Length of extended attribute |        | current name.   |
| length | 1    | name.                        +--------+-----------------+
|        |      |                              | Shift+ | Update name     |
|        |      |                              | Enter  | length.         |
+--------+------+------------------------------+--------+-----------------+
|        |      |                              | Enter  | Get length from |
| Value  |      | Length of extended attribute |        | current value.  |
| length | 2    | value.                       +--------+-----------------+
|        |      |                              | Shift+ | Update value    |
|        |      |                              | Enter  | length.         |
+--------+------+------------------------------+--------+-----------------+
| Name   | Var. | Extended attribute name.     |        |                 |
+--------+------+------------------------------+--------+-----------------+
| Value  | Var. | Extended attribute value.    |        |                 |
+--------+------+------------------------------+--------+-----------------+
| Unused | Var. | Padding to reach extended    |        |                 |
|        |      | attribute size.              |        |                 |
+--------+------+------------------------------+--------+-----------------+

  q) Property set attribute
The property set attribute has type 0xf0 and has following structure:
+-----------+------+---------------------------+-----+--------+
| Item name | Size |        Description        | Key | Action |
+-----------+------+---------------------------+-----+--------+
| Content   | Var. | Content of the attribute. |     |        |
+-----------+------+---------------------------+-----+--------+

  r) Logged utility stream attribute
The logged utility stream attribute has type 0x100 and has following
structure:
+-----------+------+---------------------------+-----+--------+
| Item name | Size |        Description        | Key | Action |
+-----------+------+---------------------------+-----+--------+
| Content   | Var. | Content of the attribute. |     |        |
+-----------+------+---------------------------+-----+--------+

13- Ext2 definitions
--------------------

  a) Superblock
This window displays the ext2/ext3/ext4 superblock. Superblock description
depends on its version number.
Common part is:
+------------+------+--------------------------------------+-------+---------+
| Item name  | Size |             Description              |  Key  | Action  |
+------------+------+--------------------------------------+-------+---------+
| Unused     | 1024 | Unused bytes before superblock.      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Number of  | 4    | Number of inodes.                    |       |         |
| inodes     |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Number of  | 4    | Number of blocks.                    |       |         |
| blocks     |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Number of  |      | Number of blocks reserved to         |       |         |
| reserved   | 4    | specific user when filesystem        |       |         |
| blocks     |      | becomes full.                        |       |         |
+------------+------+--------------------------------------+-------+---------+
| Number of  |      |                                      |       |         |
| free       | 4    | Number of free blocks.               |       |         |
| blocks     |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Number of  |      |                                      |       |         |
| free       | 4    | Number of free inodes.               |       |         |
| inodes     |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| First data | 4    | Number of first block.               |       |         |
| block      |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Block size | 4    | Size of block (in power of 2 from    |       |         |
|            |      | 1024).                               |       |         |
+------------+------+--------------------------------------+-------+---------+
| Fragment   | 4    | Size of fragment.                    |       |         |
| size       |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Blocks per | 4    | Number of blocks in a group          |       |         |
| group      |      | (multiple of 8).                     |       |         |
+------------+------+--------------------------------------+-------+---------+
| Fragments  | 4    | Number of fragments in a group.      |       |         |
| per group  |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Inodes per | 4    | Number of inodes in a group          |       |         |
| group      |      | (multiple of 8).                     |       |         |
+------------+------+--------------------------------------+-------+---------+
| Mount date | 4    | Last mount time.                     | Enter | Display |
|            |      |                                      |       | time.   |
+------------+------+--------------------------------------+-------+---------+
| Write date | 4    | Last write time.                     | Enter | Display |
|            |      |                                      |       | time.   |
+------------+------+--------------------------------------+-------+---------+
| Number of  | 2    | Number of mounts since last          |       |         |
| mount      |      | filesystem check.                    |       |         |
+------------+------+--------------------------------------+-------+---------+
| Maximum    |      | Maximum number of mounts between two |       |         |
| number of  | 2    | filesystems checks.                  |       |         |
| mount      |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Superblock | 2    | 0xEF53 value.                        |       |         |
| signature  |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| File       |      |                                      |       | Display |
| system     | 2    | Flags giving filesystem state.       | Enter | details |
| state      |      |                                      |       | of      |
|            |      |                                      |       | flag.   |
+------------+------+--------------------------------------+-------+---------+
| Error      |      | What to perform in case of error (1: |       |         |
| treatment  | 2    | ignore, 2: mount read-only, 3:       |       |         |
|            |      | panic).                              |       |         |
+------------+------+--------------------------------------+-------+---------+
| Unused     | 2    | 0 value.                             |       |         |
+------------+------+--------------------------------------+-------+---------+
| Last check | 4    | Last check time.                     | Enter | Display |
| date       |      |                                      |       | time.   |
+------------+------+--------------------------------------+-------+---------+
| Time       |      | Maximum number of seconds between    |       |         |
| between    | 4    | two filesystems checks.              |       |         |
| checks     |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
|            |      | OS creator of filesystem (0: Linux,  |       |         |
| OS         | 4    | 1: Hurd, 2: Masix). This influences  |       |         |
|            |      | some data structure.                 |       |         |
+------------+------+--------------------------------------+-------+---------+
| Version    | 4    | Filesystem version (0 or 1).         |       |         |
| number     |      |                                      |       |         |
+------------+------+--------------------------------------+-------+---------+
| Reserved   | 2    | Identifier of user that can use      |       |         |
| blocks uid |      | reserved blocks.                     |       |         |
+------------+------+--------------------------------------+-------+---------+
| Reserved   | 2    | Identifier of group that can use     |       |         |
| blocks gid |      | reserved blocks.                     |       |         |
+------------+------+--------------------------------------+-------+---------+
Following fields are defined for filesystem version 1 only:
+-----------------+------+---------------------------------+-------+---------+
|    Item name    | Size |           Description           |  Key  | Action  |
+-----------------+------+---------------------------------+-------+---------+
| First not       | 4    | Number of first inode that      |       |         |
| reserved inode  |      | could be allocated.             |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Inode size      | 2    | Size of an inode.               |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Group number    | 2    | Group to which this superblock  |       |         |
|                 |      | belongs.                        |       |         |
+-----------------+------+---------------------------------+-------+---------+
|                 |      | Options used on this filesystem |       | Display |
| Compatibility   | 4    | that does not prevent it to be  | Enter | flags   |
| flags           |      | used by a kernel that does not  |       | detail. |
|                 |      | know them.                      |       |         |
+-----------------+------+---------------------------------+-------+---------+
|                 |      | Options used on this filesystem |       | Display |
| Incompatibility | 4    | that prevents it to be used by  | Enter | flags   |
| flags           |      | a kernel that does not know     |       | detail. |
|                 |      | them.                           |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Read            |      | Options used on this filesystem |       | Display |
| compatibility   | 4    | that force a kernel that does   | Enter | flags   |
| flags           |      | not know them to mount it read  |       | detail. |
|                 |      | only.                           |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Volume          | 16   | Volume unique identifier.       |       |         |
| identifier      |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Volume name     | 16   | Volume name.                    |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Last mount      | 64   | Path to which the filesystem    |       |         |
| point           |      | was last mounted.               |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Allocation      | 4    | Used compression algorithm.     |       |         |
| algorithm       |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Preallocated    | 1    | Number of blocks preallocated   |       |         |
| blocks number   |      | on allocation.                  |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Preallocated    |      | Number of blocks preallocated   |       |         |
| directories     | 1    | on directory allocation.        |       |         |
| number          |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Reserved blocks |      | Number of blocks reserved at    |       |         |
| in group table  | 2    | end of group descriptors for    |       |         |
|                 |      | online growth.                  |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Journal         | 16   | Unique identifier of journal    |       |         |
| identifier      |      | superblock.                     |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Journal inode   | 4    | Inode of journal file.          |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Journal device  | 4    | Device of journal file.         |       |         |
+-----------------+------+---------------------------------+-------+---------+
| First inode to  | 4    | Start of list of inodes to      |       |         |
| delete          |      | delete.                         |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Hash seed       | 16   | HTREE hash seed for directory   |       |         |
|                 |      | tree.                           |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Hash version    | 1    | HTREE hash version to used.     |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Journal backup  | 1    | Default type of journal backup. |       |         |
| type            |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Group           |      | Size of group descriptors (only |       |         |
| descriptor size | 2    | if 64 bits incompatibility flag |       |         |
|                 |      | is set).                        |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Default mount   |      |                                 |       | Display |
| options         | 4    | Options to use on mount.        | Enter | mount   |
|                 |      |                                 |       | flags.  |
+-----------------+------+---------------------------------+-------+---------+
| First meta      | 4    | Group of first metablock.       |       |         |
| block group     |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| File system     | 4    | Time of creation of filesystem. | Enter | Display |
| creation time   |      |                                 |       | time    |
+-----------------+------+---------------------------------+-------+---------+
| Journal blocks  | 68   | Backup of blocks in journal     |       |         |
| backup          |      | inode.                          |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Number of       | 4    | High word of number of blocks.  |       |         |
| blocks (hi)     |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Number of       |      | High word of number of reserved |       |         |
| reserved blocks | 4    | blocks.                         |       |         |
| (hi)            |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Number of free  | 4    | High word of number of free     |       |         |
| blocks (hi)     |      | blocks.                         |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Minimum inode   | 2    | Minimum size of an inode.       |       |         |
| extra size      |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| New inode extra | 2    | Minimum size of new inodes.     |       |         |
| size            |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Flags           | 4    | Miscellaneous flags.            | Enter | Display |
|                 |      |                                 |       | flags.  |
+-----------------+------+---------------------------------+-------+---------+
| RAID stride     | 2    | RAID stride.                    |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Multi mount     |      | Number of seconds to wait in    |       |         |
| protection      | 2    | multi-mount check.              |       |         |
| interval        |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Multi mount     |      | Block for multi-mount           |       |         |
| protection      | 8    | protection.                     |       |         |
| block           |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| RAID stripe     | 4    | RAID stripe size.               |       |         |
| size            |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Flexible block  | 1    | Number of groups per flexible   |       |         |
| group size      |      | group (power of 2).             |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Reserved        | 3    | Unused.                         |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Number of       |      | Number of kilobytes that were   |       |         |
| kilobytes       | 8    | written.                        |       |         |
| written         |      |                                 |       |         |
+-----------------+------+---------------------------------+-------+---------+
| Padding         | 640  | Unused bytes at end of          |       |         |
|                 |      | superblock.                     |       |         |
+-----------------+------+---------------------------------+-------+---------+
|                 |      | Unused bytes after superblock   |       |         |
| Unused          | Var. | (only if cluster size is bigger |       |         |
|                 |      | than superblock size).          |       |         |
+-----------------+------+---------------------------------+-------+---------+

  b) Group descriptor (32 bits)
This window displays the group descriptors table for 32 bits version.
Table is composed of several descriptors having the following structure:
+---------------+------+----------------------------+-------+---------------+
|   Item name   | Size |        Description         |  Key  |    Action     |
+---------------+------+----------------------------+-------+---------------+
| Block bitmap  | 4    | Block number of the bitmap | Enter | Go to block   |
| block         |      | block.                     |       | bitmap.       |
+---------------+------+----------------------------+-------+---------------+
| Inode bitmap  | 4    | Block number of the inode  | Enter | Go to inode   |
| block         |      | block.                     |       | bitmap.       |
+---------------+------+----------------------------+-------+---------------+
| Inode table   | 4    | First block of the inode   | Enter | Go to inode   |
| block         |      | table.                     |       | table.        |
+---------------+------+----------------------------+-------+---------------+
| Free blocks   | 2    | Number of free blocks in   |       |               |
| count         |      | group.                     |       |               |
+---------------+------+----------------------------+-------+---------------+
| Free inodes   | 2    | Number of free inodes in   |       |               |
| count         |      | group.                     |       |               |
+---------------+------+----------------------------+-------+---------------+
| Used          |      | Number of directories in   |       |               |
| directories   | 2    | group.                     |       |               |
| count         |      |                            |       |               |
+---------------+------+----------------------------+-------+---------------+
| Flags         | 2    | Group descriptor flags.    | Enter | Display flags |
|               |      |                            |       | detail.       |
+---------------+------+----------------------------+-------+---------------+
| Reserved      | 8    | Unused.                    |       |               |
+---------------+------+----------------------------+-------+---------------+
| Number unused | 2    | Number of inodes not used  |       |               |
| inodes        |      | in group.                  |       |               |
+---------------+------+----------------------------+-------+---------------+
| Checksum      | 2    | Group descriptor checksum. | Enter | Compute       |
|               |      |                            |       | checksum.     |
+---------------+------+----------------------------+-------+---------------+
The four last fields are used only if the group descriptor checksum
compatibility flag is set into superblock. The group descriptors table could
be followed by an unused part in case it does not fill up the blocks.

  c) Group descriptor (64 bits)
This window displays the group descriptors table for 64 bits version.
Table is composed of several descriptors having the following structure:
+--------------+------+----------------------------------+-------+-----------+
|  Item name   | Size |           Description            |  Key  |  Action   |
+--------------+------+----------------------------------+-------+-----------+
| Block bitmap |      | Low word of block number of the  |       | Go to     |
| block (low)  | 4    | bitmap block.                    | Enter | block     |
|              |      |                                  |       | bitmap.   |
+--------------+------+----------------------------------+-------+-----------+
| Inode bitmap |      | Low word of block number of the  |       | Go to     |
| block (low)  | 4    | inode block.                     | Enter | inode     |
|              |      |                                  |       | bitmap.   |
+--------------+------+----------------------------------+-------+-----------+
| Inode table  |      | Low word of first block of the   |       | Go to     |
| block (low)  | 4    | inode table.                     | Enter | inode     |
|              |      |                                  |       | table.    |
+--------------+------+----------------------------------+-------+-----------+
| Free blocks  | 2    | Low part of number of free       |       |           |
| count (low)  |      | blocks in group.                 |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Free inodes  | 2    | Low part of number of free       |       |           |
| count (low)  |      | inodes in group.                 |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Used         |      | Low part of number of            |       |           |
| directories  | 2    | directories in group.            |       |           |
| count (low)  |      |                                  |       |           |
+--------------+------+----------------------------------+-------+-----------+
|              |      |                                  |       | Display   |
| Flags        | 2    | Group descriptor flags.          | Enter | flags     |
|              |      |                                  |       | detail.   |
+--------------+------+----------------------------------+-------+-----------+
| Reserved1    | 8    | Unused.                          |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Number       |      | Low word of number of inodes not |       |           |
| unused       | 2    | used in group.                   |       |           |
| inodes (low) |      |                                  |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Checksum     | 2    | Group descriptor checksum.       | Enter | Compute   |
|              |      |                                  |       | checksum. |
+--------------+------+----------------------------------+-------+-----------+
| Block bitmap |      | High word of block number of the |       | Go to     |
| block (high) | 4    | bitmap block.                    | Enter | block     |
|              |      |                                  |       | bitmap.   |
+--------------+------+----------------------------------+-------+-----------+
| Inode bitmap |      | High word of block number of the |       | Go to     |
| block (high) | 4    | inode block.                     | Enter | inode     |
|              |      |                                  |       | bitmap.   |
+--------------+------+----------------------------------+-------+-----------+
| Inode table  |      | High word of first block of the  |       | Go to     |
| block (high) | 4    | inode table.                     | Enter | inode     |
|              |      |                                  |       | table.    |
+--------------+------+----------------------------------+-------+-----------+
| Free blocks  | 2    | High part of number of free      |       |           |
| count (high) |      | blocks in group.                 |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Free inodes  | 2    | High part of number of free      |       |           |
| count (high) |      | inodes in group.                 |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Used         |      | High part of number of           |       |           |
| directories  | 2    | directories in group.            |       |           |
| count (high) |      |                                  |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Number       |      |                                  |       |           |
| unused       | 2    | High part of number of inodes    |       |           |
| inodes       |      | not used in group.               |       |           |
| (high)       |      |                                  |       |           |
+--------------+------+----------------------------------+-------+-----------+
| Reserved2    | 12   | Unused.                          |       |           |
+--------------+------+----------------------------------+-------+-----------+
The group descriptors table could be followed by an unused part in case it
does not fill up the blocks.

  d) Inodes table
This window displays the inode table.
Table is composed of several inodes followed by an optional unused part if
inodes table does not fill the blocks. An inode has a different structure
depending on creator OS, only Linux one is displayed here. An inode has a
different definition depending on its content. All inodes share the following
structure:
+--------------+------+----------------------------------+-------+----------+
|  Item name   | Size |           Description            |  Key  |  Action  |
+--------------+------+----------------------------------+-------+----------+
|              |      | Inode mode (protection bits,     |       | Display  |
| Mode         | 2    | ...).                            | Enter | mode     |
|              |      |                                  |       | details. |
+--------------+------+----------------------------------+-------+----------+
| User id      | 2    | User owner of inode.             |       |          |
+--------------+------+----------------------------------+-------+----------+
| Size         | 4    | Size of the inode in bytes.      |       |          |
+--------------+------+----------------------------------+-------+----------+
| Access time  | 4    | Last access time.                | Enter | Display  |
|              |      |                                  |       | time.    |
+--------------+------+----------------------------------+-------+----------+
| Creation     | 4    | Creation time.                   | Enter | Display  |
| time         |      |                                  |       | time.    |
+--------------+------+----------------------------------+-------+----------+
| Modification | 4    | Last modification time.          | Enter | Display  |
| time         |      |                                  |       | time.    |
+--------------+------+----------------------------------+-------+----------+
| Deletion     | 4    | Last deletion time.              | Enter | Display  |
| time         |      |                                  |       | time.    |
+--------------+------+----------------------------------+-------+----------+
| Group id     | 2    | Group owner of inode.            |       |          |
+--------------+------+----------------------------------+-------+----------+
| Number of    | 2    | Number of hard-links to this     |       |          |
| links        |      | inode.                           |       |          |
+--------------+------+----------------------------------+-------+----------+
| Number of    | 4    | Number of sectors allocated to   |       |          |
| sectors      |      | this inode.                      |       |          |
+--------------+------+----------------------------------+-------+----------+
|              |      |                                  |       | Display  |
| Flags        | 4    | Inode flags.                     | Enter | flags    |
|              |      |                                  |       | details. |
+--------------+------+----------------------------------+-------+----------+
| OS dependent | 4    | Value depending on OS that       |       |          |
|              |      | creates filesystem.              |       |          |
+--------------+------+----------------------------------+-------+----------+
| Inode        |      | Variable definition depending on |       |          |
| content      | 60   | inode content.                   |       |          |
| definition   |      |                                  |       |          |
+--------------+------+----------------------------------+-------+----------+
| Version      | 4    | Inode version.                   |       |          |
+--------------+------+----------------------------------+-------+----------+
| File ACL     | 4    | Block number of a block giving   |       |          |
|              |      | inode attributes.                |       |          |
+--------------+------+----------------------------------+-------+----------+
| Directory    | 4    | High word of inode size.         |       |          |
| ACL          |      |                                  |       |          |
+--------------+------+----------------------------------+-------+----------+
| Fragment     | 4    | Fragment address.                |       |          |
| address      |      |                                  |       |          |
+--------------+------+----------------------------------+-------+----------+
| Nb of        | 2    | High part of number of sectors.  |       |          |
| sectors (hi) |      |                                  |       |          |
+--------------+------+----------------------------------+-------+----------+
| File ACL     | 2    | High part of file ACL block.     |       |          |
| (high)       |      |                                  |       |          |
+--------------+------+----------------------------------+-------+----------+
| User id      | 2    | High part of user identifier.    |       |          |
| (high)       |      |                                  |       |          |
+--------------+------+----------------------------------+-------+----------+
| Group id     | 2    | High part of group identifier.   |       |          |
| (high)       |      |                                  |       |          |
+--------------+------+----------------------------------+-------+----------+
| Reserved     | 4    | Unused.                          |       |          |
+--------------+------+----------------------------------+-------+----------+
| Unknown      | Var. | This part is variable depending  |       |          |
|              |      | on inode size.                   |       |          |
+--------------+------+----------------------------------+-------+----------+
In case of standard inode, the inode content definition is:
+----------+------+-----------------------------------------+-------+--------+
|   Item   | Size |               Description               |  Key  | Action |
|   name   |      |                                         |       |        |
+----------+------+-----------------------------------------+-------+--------+
| Direct   | 12*4 | 12 blocks containing inode data (if not | Enter | Go to  |
| blocks   |      | 0).                                     |       | block. |
+----------+------+-----------------------------------------+-------+--------+
| Indirect | 4    | Block that defines a list of blocks     | Enter | Go to  |
| blocks   |      | containing inode data (if not 0).       |       | block. |
+----------+------+-----------------------------------------+-------+--------+
| Double   |      | Block that gives a list of indirect     |       | Go to  |
| indirect | 4    | blocks (if not 0).                      | Enter | block. |
| blocks   |      |                                         |       |        |
+----------+------+-----------------------------------------+-------+--------+
| Triple   |      | Block that gives a list of double       |       | Go to  |
| indirect | 4    | indirect blocks (if not 0).             | Enter | block. |
| blocks   |      |                                         |       |        |
+----------+------+-----------------------------------------+-------+--------+
In case of device, the block numbers contain the device major and minor
number. In case of socket or pipe, the block numbers are 0 (there is no
associated data).
In case of fast symbolic links (symbolic links with less than 60 bytes), the
inode content definition is:
+-----------+------+-----------------------------------+-----+--------+
| Item name | Size |            Description            | Key | Action |
+-----------+------+-----------------------------------+-----+--------+
| Symbolic  | 60   | Name of the symbolic link (ending |     |        |
| link name |      | with 0).                          |     |        |
+-----------+------+-----------------------------------+-----+--------+
In case of inode with extents, the inode content definition contains an extent
definition.

  e) Inodes bitmap
The inode bitmap gives for each inode of current group if it is occupied or
not:
+--------+------+------------------------------------+-------+-------------+
|  Item  | Size |            Description             |  Key  |   Action    |
|  name  |      |                                    |       |             |
+--------+------+------------------------------------+-------+-------------+
|        |      | Bits giving if inodes are occupied |       | Displays    |
|        | n    | or not.                            | Enter | bits        |
|        |      |                                    |       | definition. |
+--------+------+------------------------------------+-------+-------------+
| Unused | Var. | Optional part if inode bitmap does |       |             |
|        |      | not fill block.                    |       |             |
+--------+------+------------------------------------+-------+-------------+

  f) Blocks bitmap
The block bitmap gives for each block of current group if it is occupied or
not:
+--------+------+------------------------------------+-------+-------------+
|  Item  | Size |            Description             |  Key  |   Action    |
|  name  |      |                                    |       |             |
+--------+------+------------------------------------+-------+-------------+
|        |      | Bits giving if blocks are occupied |       | Displays    |
|        | n    | or not.                            | Enter | bits        |
|        |      |                                    |       | definition. |
+--------+------+------------------------------------+-------+-------------+
| Unused | Var. | Optional part if block bitmap does |       |             |
|        |      | not fill block.                    |       |             |
+--------+------+------------------------------------+-------+-------------+

  g) Directory
This window displays the ext2 directory entries:
+---------+------+-----------------------------------+--------+------------+
|  Item   | Size |            Description            |  Key   |   Action   |
|  name   |      |                                   |        |            |
+---------+------+-----------------------------------+--------+------------+
| Inode   | 4    | Inode number.                     | Enter  | Go to      |
|         |      |                                   |        | inode.     |
+---------+------+-----------------------------------+--------+------------+
| Entry   |      |                                   | Shift+ | Update     |
| length  | 2    | Size of directory entry.          | Enter  | padding    |
|         |      |                                   |        | length.    |
+---------+------+-----------------------------------+--------+------------+
|         |      |                                   | Enter  | Get length |
| Name    |      |                                   |        | from name. |
| length  | 1    | Length of file name.              +--------+------------+
|         |      |                                   | Shift+ | Update     |
|         |      |                                   | Enter  | file name. |
+---------+------+-----------------------------------+--------+------------+
| File    | 1    | Type of file.                     |        |            |
| type    |      |                                   |        |            |
+---------+------+-----------------------------------+--------+------------+
|         |      |                                   | Enter  | Go to      |
|         |      |                                   |        | file.      |
| Name    | Var. | File name.                        +--------+------------+
|         |      |                                   | Shift+ | Update     |
|         |      |                                   | Enter  | name       |
|         |      |                                   |        | length.    |
+---------+------+-----------------------------------+--------+------------+
| Padding | Var. | Padding for directory entry to be |        |            |
|         |      | multiple of 4.                    |        |            |
+---------+------+-----------------------------------+--------+------------+

  h) Indirect blocks list
The indirect block list is composed of list of number of blocks containing
inode data:
+--------+------+------------------------------------------+-------+--------+
|  Item  | Size |               Description                |  Key  | Action |
|  name  |      |                                          |       |        |
+--------+------+------------------------------------------+-------+--------+
|        | n*4  | Block containing data.                   | Enter | Go to  |
|        |      |                                          |       | block. |
+--------+------+------------------------------------------+-------+--------+
| Unused | Var. | Optional part if list of blocks does not |       |        |
|        |      | fill block.                              |       |        |
+--------+------+------------------------------------------+-------+--------+

  i) Double indirect blocks list
The double indirect block list is composed of list of number of blocks
containing direct blocks numbers:
+----------+------+--------------------------------------+-------+--------+
|   Item   | Size |             Description              |  Key  | Action |
|   name   |      |                                      |       |        |
+----------+------+--------------------------------------+-------+--------+
| Indirect | n*4  | Block containing indirect blocks     | Enter | Go to  |
| blocks   |      | number.                              |       | block. |
+----------+------+--------------------------------------+-------+--------+
| Unused   | Var. | Optional part if list of blocks does |       |        |
|          |      | not fill block.                      |       |        |
+----------+------+--------------------------------------+-------+--------+

  j) Triple indirect blocks list
The triple indirect block list is composed of list of number of blocks
containing double indirect blocks numbers:
+----------+------+-----------------------------------------+-------+--------+
|   Item   | Size |               Description               |  Key  | Action |
|   name   |      |                                         |       |        |
+----------+------+-----------------------------------------+-------+--------+
| Double   |      | Block containing double indirect blocks |       | Go to  |
| indirect | n*4  | number.                                 | Enter | block. |
| blocks   |      |                                         |       |        |
+----------+------+-----------------------------------------+-------+--------+
| Unused   | Var. | Optional part if list of blocks does    |       |        |
|          |      | not fill block.                         |       |        |
+----------+------+-----------------------------------------+-------+--------+

  k) Extents
Extent definition is composed of:

  - a header:

+-------------------+------+----------------------------------+-----+--------+
|     Item name     | Size |           Description            | Key | Action |
+-------------------+------+----------------------------------+-----+--------+
| Magic             | 2    | 0xF30A value                     |     |        |
+-------------------+------+----------------------------------+-----+--------+
| Number of entries | 2    | Number of leaf or index extents. |     |        |
+-------------------+------+----------------------------------+-----+--------+
| Maximum number of | 2    | Maximum number of leaf or index  |     |        |
| entries           |      | extents.                         |     |        |
+-------------------+------+----------------------------------+-----+--------+
| Depth             | 2    | Depth to reach leaf extents.     |     |        |
+-------------------+------+----------------------------------+-----+--------+
| Generation        | 4    | Extent version.                  |     |        |
+-------------------+------+----------------------------------+-----+--------+

  - one or several leaf extents if depth is 0 in header:

+----------------+------+------------------------------+-------+--------+
|   Item name    | Size |         Description          |  Key  | Action |
+----------------+------+------------------------------+-------+--------+
| Logical block  | 4    | Logical block in extents     |       |        |
|                |      | definition.                  |       |        |
+----------------+------+------------------------------+-------+--------+
| Number of      | 2    | Number of blocks in extent.  |       |        |
| blocks         |      |                              |       |        |
+----------------+------+------------------------------+-------+--------+
| Physical block | 2    | High part of physical block. | Enter | Go to  |
| (high)         |      |                              |       | block. |
+----------------+------+------------------------------+-------+--------+
| Physical block | 4    | Low part of physical block.  | Enter | Go to  |
| (low)          |      |                              |       | block. |
+----------------+------+------------------------------+-------+--------+

  - one or several index extents if depth is different from 0 in header:

+---------+------+------------------------------------------+-------+--------+
|  Item   | Size |               Description                |  Key  | Action |
|  name   |      |                                          |       |        |
+---------+------+------------------------------------------+-------+--------+
| From    |      | First logical block in extents           |       |        |
| logical | 4    | definition.                              |       |        |
| block   |      |                                          |       |        |
+---------+------+------------------------------------------+-------+--------+
| Index   |      | Low part of block containing extents one |       | Go to  |
| block   | 4    | depth lower.                             | Enter | block. |
| (low)   |      |                                          |       |        |
+---------+------+------------------------------------------+-------+--------+
| Index   |      | High part of block containing extents    |       | Go to  |
| block   | 2    | one depth lower.                         | Enter | block. |
| (high)  |      |                                          |       |        |
+---------+------+------------------------------------------+-------+--------+
| Unused  | 2    | Unused.                                  |       |        |
+---------+------+------------------------------------------+-------+--------+
Extents definition can be followed by unused part if they do not fill the
whole area.


14- Configuration file
----------------------

The configuration file allows you to set the configuration of the program. The
configuration is described into chapter 7. Such a file can be created with
using the "Save configuration" menu and can be loaded either through the
"-cfg" option on command line or the "cfg_file" option in option file or can
be loaded through the "Load configuration" menu.
The configuration file is a text file that allows configuration to be
specified. Each option must be alone on a line.
If the line begins with ";", its a comment line (it is not analysed).
Option content can be defined with an environment variable. In that case, the
environment variable must be given between % (example: file=%CONF%.PAR, %CONF%
will be replaced by the content of the CONF environment variable). If the
environment variable does not exist, an error will be generated. To be able to
give the % character inside option contents, you have to double it (example:
file=WITH%%.PAR, the file name would be WITH%.PAR).

Options have <option name>=<option value> format. Name and value of each
option are described below. You can read the chapter 7 to get more details on
each option.

+-------------------------------+------------------------------+-------------+
|            Option             |            Values            |   Default   |
|                               |                              |    value    |
+-------------------------------+------------------------------+-------------+
| read_only                     | yes|no                       | yes         |
|                               +------------------------------+-------------+
|                               | This option sets if the program is in      |
|                               | read-only mode or not. When it is in       |
|                               | read-only mode, any change performed will  |
|                               | not be saved.                              |
+-------------------------------+------------------------------+-------------+
| update_linked_values          | yes|no                       | yes         |
|                               +------------------------------+-------------+
|                               | This option sets if the program updates    |
|                               | related values when there is a link        |
|                               | between them.                              |
+-------------------------------+------------------------------+-------------+
| open_raw_view                 | yes|no                       | no          |
|                               +------------------------------+-------------+
|                               | This option sets if the program shall open |
|                               | a display in raw mode even if some         |
|                               | detailed description is available. This    |
|                               | can be needed in case the filesystem is    |
|                               | damaged enough for the detailed view to    |
|                               | become unusable. This allows also not      |
|                               | having update of linked values at initial  |
|                               | displaying.                                |
+-------------------------------+------------------------------+-------------+
| detection_mode                | automatic|raw|disk|fat12|    | automatic   |
|                               | fat16|fat32|ntfs|ext2        |             |
|                               +------------------------------+-------------+
|                               | This option sets how the program shall     |
|                               | treat the content of a support.            |
+-------------------------------+------------------------------+-------------+
| cluster_size                  | <number>                     | 1024        |
|                               +------------------------------+-------------+
|                               | This option sets the size of a cluster     |
|                               | (for FAT and NTFS filesystems) or of a     |
|                               | block (for ext2 filesystem) in bytes.      |
+-------------------------------+------------------------------+-------------+
| view_as_max_nb_sectors        | <number>                     | 128         |
|                               +------------------------------+-------------+
|                               | This option limits number of sectors to    |
|                               | use when using one of the "View as" menu.  |
+-------------------------------+------------------------------+-------------+
| displayed_max_nb_items        | <number>                     | 4096        |
|                               +------------------------------+-------------+
|                               | This option limits number of items that    |
|                               | are displayed. This allows reducing memory |
|                               | need and time to build the windows.        |
+-------------------------------+------------------------------+-------------+
| history_size                  | <number>                     | 16          |
|                               +------------------------------+-------------+
|                               | This option sets number of items that were |
|                               | displayed and that can be easily retrieved |
|                               | through "Back" and "Forward" menu.         |
+-------------------------------+------------------------------+-------------+
| calculator_memory_size        | <number>                     | 16          |
|                               +------------------------------+-------------+
|                               | This option limits number of values to     |
|                               | keep inside calculator memory.             |
+-------------------------------+------------------------------+-------------+
| nb_fats                       | [1..2]                       | 2           |
|                               +------------------------------+-------------+
|                               | This option sets the number of FAT that    |
|                               | are on a FAT filesystem.                   |
+-------------------------------+------------------------------+-------------+
| first_used_fat                | [0..<nb_fats>-1]             | 0           |
|                               +------------------------------+-------------+
|                               | This option sets the first FAT to use.     |
+-------------------------------+------------------------------+-------------+
| nb_used_fats                  | [1..<nb_fats>-               | 2           |
|                               | <first_used_fat>]            |             |
|                               +------------------------------+-------------+
|                               | This option sets the number of FAT to use. |
+-------------------------------+------------------------------+-------------+
| first_sector_of_fat           | <number>                     | 1           |
|                               +------------------------------+-------------+
|                               | This option sets the sector where first    |
|                               | FAT starts.                                |
+-------------------------------+------------------------------+-------------+
| nb_sectors_per_fat            | <number>                     | 128         |
|                               +------------------------------+-------------+
|                               | This option sets the number of sectors per |
|                               | FAT.                                       |
+-------------------------------+------------------------------+-------------+
| nb_sectors_of_root            | <number>                     | 32          |
|                               +------------------------------+-------------+
|                               | This option sets the number of sectors for |
|                               | root directory for FAT12 and FAT16         |
|                               | filesystems.                               |
+-------------------------------+------------------------------+-------------+
| cluster_of_root               | <number>                     | 2           |
|                               +------------------------------+-------------+
|                               | This option sets the first cluster of root |
|                               | directory for FAT32 filesystem.            |
+-------------------------------+------------------------------+-------------+
| cluster_of_mft                | <number>                     | 2           |
|                               +------------------------------+-------------+
|                               | This option sets the first cluster of $MFT |
|                               | for NTFS filesystem.                       |
+-------------------------------+------------------------------+-------------+
| nb_sectors_per_mft            | <number>                     | 2           |
|                               +------------------------------+-------------+
|                               | This option sets the number of sectors per |
|                               | MFT entry.                                 |
+-------------------------------+------------------------------+-------------+
| nb_sectors_per_idx_record     | <number>                     | 2           |
|                               +------------------------------+-------------+
|                               | This option sets the number of sectors per |
|                               | index record.                              |
+-------------------------------+------------------------------+-------------+
| version_number                | [0..1]                       | 1           |
|                               +------------------------------+-------------+
|                               | This option sets the filesystem version    |
|                               | for ext2 filesystem.                       |
+-------------------------------+------------------------------+-------------+
| blocks_per_group              | <number>                     | 8192        |
|                               +------------------------------+-------------+
|                               | This option sets the number of blocks in a |
|                               | group for ext2 filesystem.                 |
+-------------------------------+------------------------------+-------------+
| inodes_per_group              | <number>                     | 8192        |
|                               +------------------------------+-------------+
|                               | This option sets the number of inodes in a |
|                               | group for ext2 filesystem.                 |
+-------------------------------+------------------------------+-------------+
| inode_size                    | <number>                     | 128         |
|                               +------------------------------+-------------+
|                               | This option sets the size of an inode.     |
+-------------------------------+------------------------------+-------------+
| has_sparse_superblock         | yes|no                       | yes         |
|                               +------------------------------+-------------+
|                               | This option marks if an ext2 filesystem    |
|                               | uses sparse superblock.                    |
+-------------------------------+------------------------------+-------------+
| has_meta_block_group          | yes|no                       | no          |
|                               +------------------------------+-------------+
|                               | This option marks if an ext2 filesystem    |
|                               | uses meta block group.                     |
+-------------------------------+------------------------------+-------------+
| first_meta_block_group        | <number>                     | 0           |
|                               +------------------------------+-------------+
|                               | This option sets the first meta block      |
|                               | group when filesystem uses meta block      |
|                               | group.                                     |
+-------------------------------+------------------------------+-------------+
| has_64_bits_group_desc        | yes|no                       | no          |
|                               +------------------------------+-------------+
|                               | This option sets if an ext2 filesystem     |
|                               | uses 64 bits group descriptors.            |
+-------------------------------+------------------------------+-------------+
| group_descriptor_size         | <number>                     | 32          |
|                               +------------------------------+-------------+
|                               | This option sets the ext2 group            |
|                               | descriptors size.                          |
+-------------------------------+------------------------------+-------------+
| has_group_descriptor_checksum | yes|no                       | no          |
|                               +------------------------------+-------------+
|                               | This option sets if an ext2 filesystem     |
|                               | uses checksum in group descriptors.        |
+-------------------------------+--------------------------------------------+


15- Options file
----------------

The options file allows you set options that are set on command line or to
configure support to detect. When using explpart with the -f <options file
name> option, the various parameters are read from the file. Contents of this
file can be partial (not covering all the options), but in this case some
rules described below must be followed.
The options file is a text file that allows options to be specified. Each
option must be alone on a line.
If the line begins with ";", its a comment line (it is not analysed).
Option content can be defined with an environment variable. In that case, the
environment variable must be given between % (example: file=%CONF%.PAR, %CONF%
will be replaced by the content of the CONF environment variable). If the
environment variable does not exist, an error will be generated. To be able to
give the % character inside option contents, you have to double it (example:
file=WITH%%.PAR, the file name would be WITH%.PAR).

Options have <option name>=<option value> format. Name and value of each
option are the following:

+-------------------+-------------------------------+------------------------+
|      Option       |            Values             |     Default value      |
+-------------------+-------------------------------+------------------------+
| mouse             | yes|no|poll                   | yes                    |
|                   +-------------------------------+------------------------+
|                   | Choice of the method of using the mouse (same as       |
|                   | -cm|-nm|-pm option on command line).                   |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
+-------------------+-------------------------------+------------------------+
| check_drive       | yes|no                        | yes                    |
|                   +-------------------------------+------------------------+
|                   | Verification that created/read file is not on          |
|                   | saved/restored element is disabled when set to "no"    |
|                   | (same as -ncd option on command line).                 |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
+-------------------+-------------------------------+------------------------+
| verify_free_size  | yes|no                        | yes                    |
|                   +-------------------------------+------------------------+
|                   | Verification of free remaining size on destination     |
|                   | drive is not done when set to "no" (same as -ncs       |
|                   | option on command line).                               |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
+-------------------+-------------------------------+------------------------+
| verify_disk_write | yes|no                        | yes                    |
|                   +-------------------------------+------------------------+
|                   | Verification that sectors are correctly written is     |
|                   | disabled when set to "no" (same as -nvd option on      |
|                   | command line).                                         |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
+-------------------+-------------------------------+------------------------+
| verify_file_write | yes|no                        | yes                    |
|                   +-------------------------------+------------------------+
|                   | Verification that files are correctly written is       |
|                   | disabled when set to "no" (same as -nvf option on      |
|                   | command line).                                         |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
+-------------------+-------------------------------+------------------------+
| test_disk_size    | yes|no|<number>               | no                     |
|                   +-------------------------------+------------------------+
|                   | This option allows trying to detect disk size if it is |
|                   | set to "yes" (same as -tds option on command line).    |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
|                   | If a number is given, it is number of disk for which   |
|                   | trying to detect disk size. In this case, this option  |
|                   | can be given several times with different numbers.     |
+-------------------+-------------------------------+------------------------+
| utf8              | yes|no                        | automatic detection    |
|                   +-------------------------------+------------------------+
|                   | Forces use or not use of UTF-8 terminal capability in  |
|                   | Linux version.                                         |
+-------------------+-------------------------------+------------------------+
| user_interface    | text|text_bios|text_ext|      | text_ext               |
|                   | text_bios_ext                 |                        |
|                   +-------------------------------+------------------------+
|                   | User interface choice (same as -tui|-bui|-tuix|-buix   |
|                   | option on command line).                               |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
+-------------------+-------------------------------+------------------------+
| disk              | <number>                      | detect all disks       |
|                   +-------------------------------+------------------------+
|                   | Gives the disk number to use. This number must be      |
|                   | between zero and the number of disks minus one. When   |
|                   | it is used, program limits detection of support to the |
|                   | given disk.                                            |
|                   | This option cannot be given if "floppy", "device" or   |
|                   | "raw_file" option is given.                            |
+-------------------+-------------------------------+------------------------+
| floppy            | <number>                      | detect all floppies    |
|                   +-------------------------------+------------------------+
|                   | Gives the floppy drive number to use. This number must |
|                   | be between zero and number of floppy drives minus one. |
|                   | When it is used, program limits detection of support   |
|                   | to the given floppy.                                   |
|                   | This option cannot be given if "disk", "device" or     |
|                   | "raw_file" option is given.                            |
+-------------------+-------------------------------+------------------------+
| device            | DOS/Windows: A-`              | detect all devices     |
|                   | Linux: <block device>         |                        |
|                   +-------------------------------+------------------------+
|                   | Gives the DOS/Windows device letter or Linux device    |
|                   | file to use. When it is used, program limits detection |
|                   | of support to the given floppy.                        |
|                   | This option cannot be given if "disk", "floppy" or     |
|                   | "raw_file" option is given.                            |
+-------------------+-------------------------------+------------------------+
| raw_file          | <filename>                    | asked to user          |
|                   +-------------------------------+------------------------+
|                   | Gives name of raw file to use. When it is used,        |
|                   | program limits detection of support to the given file. |
|                   | This option cannot be given if "disk", "floppy" or     |
|                   | "device" option is given.                              |
+-------------------+-------------------------------+------------------------+
| main_part         | <number>                      | detect all partitions  |
|                   +-------------------------------+------------------------+
|                   | Gives the number of the main partition to use. This    |
|                   | number must be between 1 and 4 for MBR partitions      |
|                   | table, 1 and 4294967295 for GUID partitions table.     |
|                   | For this option to be used, "disk" option must be      |
|                   | given.                                                 |
+-------------------+-------------------------------+------------------------+
| ext_part          | <number>                      | detect all partitions  |
|                   |                               | if "main_part" not     |
|                   |                               | given, 0 else          |
|                   +-------------------------------+------------------------+
|                   | Gives the number of the extended partition to use.     |
|                   | This number must be between 1 and the number of        |
|                   | extended partition corresponding to main partition. It |
|                   | can be used only in case of MBR partitions table.      |
|                   | For this option to be used, "main_part" option must be |
|                   | given.                                                 |
+-------------------+-------------------------------+------------------------+
| mount             | <drive number>:<disk          | asked to user          |
|                   | number>/<main partition       |                        |
|                   | number>,<extended partition   |                        |
|                   | number>                       |                        |
|                   | or                            |                        |
|                   | DOS/Windows: <drive           |                        |
|                   | number>:<device letter>       |                        |
|                   | Linux: <drive number>:<block  |                        |
|                   | device>                       |                        |
|                   +-------------------------------+------------------------+
|                   | Allows defining mounting options of a partition or a   |
|                   | device.                                                |
|                   | In first syntax, the first number is the drive number  |
|                   | used to identify mounted partition, it must be between |
|                   | 0 and 2147483647. The second number is the disk number |
|                   | on which partition to mount is, it must be between 0   |
|                   | and number of disks - 1. The third number is the main  |
|                   | partition number of partition to mount, it is between  |
|                   | 1 and 4 for a MBR partitions table and between 1 and   |
|                   | 4294967295 for a GUID partitions table. The last       |
|                   | number must not be given for a main partition (if it   |
|                   | is omitted, the colon before must be also) and is the  |
|                   | extended partition number where the main partition is  |
|                   | a logical partition, it must be between 1 and 255.     |
|                   | In second syntax, disk and partitions numbers are      |
|                   | replaced with the drive letter/device file of the      |
|                   | device to mount.                                       |
|                   | The drive number must be unique and a partition can    |
|                   | only be mounted with one number. When a mount is       |
|                   | defined, the "file" option can use this number to      |
|                   | define a file name.                                    |
|                   | Example:                                               |
|                   | mount=0:0/1 mounts as 0: the first main partition of   |
|                   | the first disk,                                        |
|                   | mount=10:3/2,2 mounts as 10: the second extended       |
|                   | partition in the second main partition of the forth    |
|                   | disk,                                                  |
|                   | file=0:\DISK_C.PAR (or FILE=//O/DISK_C.PAR for Linux   |
|                   | version) defines a file that is on the partition       |
|                   | mounted by the first mount.                            |
+-------------------+-------------------------------+------------------------+
| gmt               | <hours>h<minutes>             | automatic detection    |
|                   +-------------------------------+------------------------+
|                   | This option permits setting difference between your    |
|                   | hour and GMT hour (example: 1h00 in France in winter). |
|                   | It is used when writing file to NTFS partition because |
|                   | this one stores file modification time in GMT time.    |
|                   | This option is not mandatory, it only avoids having    |
|                   | some file modification time in future or past.         |
|                   | Automatic detection cannot be performed in DOS         |
|                   | version, in this case 0 is used.                       |
+-------------------+-------------------------------+------------------------+
| max_mem_size      | <number> [kB|MB]              | available memory       |
|                   +-------------------------------+------------------------+
|                   | This option allows reducing memory usage by program.   |
|                   | It shall be used only when getting the "Error: could   |
|                   | not allocate page table memory" error (mostly when     |
|                   | exploring compressed backup). This limit is not        |
|                   | absolute (program will use more memory than that in    |
|                   | case of need), but allows reducing biggest buffers     |
|                   | size. If you do not get the error, you do not need to  |
|                   | use it, if you get the error, try with giving half the |
|                   | memory you have (reduce it or try to free some DOS     |
|                   | memory if it is not enough).                           |
+-------------------+-------------------------------+------------------------+
| heads_sectors     | standard|extended|parttable|  | automatic detection    |
|                   | <heads number>/<sectors       |                        |
|                   | number>                       |                        |
|                   +-------------------------------+------------------------+
|                   | When fixing physical definition of a disk on a boot    |
|                   | sector, this option permits to choose which values to  |
|                   | use. Three first options (standard|extended|parttable) |
|                   | are to use predefined values, the last option is to    |
|                   | give your own values (the number of heads and the      |
|                   | number of sectors per track). In case this option is   |
|                   | not used and fix_first_sector option is used, program  |
|                   | updates first sector value only.                       |
|                   | In Windows and Linux versions, this option allows      |
|                   | forcing number of heads and sectors per cylinder for a |
|                   | disk in case these definitions cannot be obtained with |
|                   | reading partitions table (for this numbers shall be    |
|                   | given, not predefined values).                         |
|                   | This option allows also forcing the definition when    |
|                   | using a raw file.                                      |
+-------------------+-------------------------------+------------------------+
| stdaccess         | <number>                      | detection of type of   |
|                   |                               | access                 |
|                   +-------------------------------+------------------------+
|                   | This option allows forcing use of standard access for  |
|                   | disks that support both access modes (disks of less    |
|                   | than 8 GB). The <number> allows giving disk number for |
|                   | which access mode shall be forced (see "disk" option). |
|                   | This option can be given several times with different  |
|                   | disk numbers.                                          |
|                   | This option shall be carefully used and only in case   |
|                   | of a disk found as using extended access but that does |
|                   | not support it (case of very old disks). Before using  |
|                   | this option, it is better to check disks with          |
|                   | partinfo.exe with and without "-s" option, then to try |
|                   | exploring a partition to check what program sees.      |
|                   | This situation is in most cases bad. It shows that     |
|                   | disk is badly recognised and that can lead to some     |
|                   | loss of data, overlapping partitions, ... (moreover in |
|                   | case of using disk with several OS). It can            |
|                   | potentially be corrected with changing disk parameters |
|                   | into BIOS, but this can lead to the loss of all data   |
|                   | of this disk (it is better after such a change to      |
|                   | destroy all partitions and create them again to be     |
|                   | sure they are correctly defined).                      |
+-------------------+-------------------------------+------------------------+
| cfg_file          | <filename>                    | default configuration  |
|                   +-------------------------------+------------------------+
|                   | Gives the configuration file to use (same as -cfg      |
|                   | option on command line).                               |
|                   | Please read command line option description to get     |
|                   | more details.                                          |
+-------------------+--------------------------------------------------------+


Hoping this program will be useful,

D. Guibouret <damien.guibouret@partition-saving.com>

------
All trademarks and registered trademarks are property of their respective
holders.
