LDE(8)

NAME
lde - a file system viewer/editor for Linux

SYNOPSIS
lde device

DESCRIPTION
lde is a curses (ncurses) editor for the Linux MINIX file-system. One day it will support file system editing, ala Norton utilities, but for now it's main use is to poke around the file system looking for bits and pieces of a file which you may have erased. It is by no means an unerase, unless you get incredibly lucky.

OPTIONS

-a, --all
    indicates that searches should be performed on the entire disk. If -a is not specified, only data zones marked not in use will be searched.

-b (--block) block_number
    Dump block block_number to standard output (hex mode).

-B block_number
    Dump all blocks after block_number to standard output.

-c  Activate curses interface.

-d block_number
    Dump a block's data to standard out (pure binary data).

-g, --grep
    This option was designed to work with grep output. Grep a file for lost data, pipe it through awk to yield just byte offsets where the desired string lies. lde will then find the block corresponding to the desired offset and try to find an inode which references this block.

-h, --help
    Display extended help.

-i (--inode) inode_number
    Dump inode inode_number to standard output.

-I inode_number
    Dump all inodes after inode_number to standard output.

-p, --paranoid, --safe
    Open the device read only. This cannot be toggled within the program.

-q, --quiet
    Turn off bell.

--scrubxiafs
    Clobbers the xiafs magic number. This is stored on the very first block of the file system which is usually reserved for boot code (xiafs does reserve 512 bytes for booting). If you make another file system on a device which once housed an xiafs, lde will always autodetect xiafs (other progs may do the same). As of v2.2alpha4, lde will check block 1, then block 0, so it is not a problem any more. --unscrubxiafs will reverse the changes.

-S string
    search disk for data (questionable). The string must be at the start of the block. This was more for searching for a specific type of file rather than file data. To search for data, use the --grep option.

-t fstype
    Override the auto-detect. fstype = {no, minix, xiafs, ext2fs}

-T type
    search disk for data. This will search the start of each block for numbers found in /etc/magic for certain types of files, currently supported types are {gz, tgz, script}.

-V, --version
    Display version information.

-w, --write
    Allow writes to the disk.

CURSES INTERFACE
The lde main screen displays the file system's superblock in the workspace window. The header window will be the same for all modes and indicates the program name and version, the device, the current selected inode, and the current selected block. There are also nine digits (and some extra characters "0123456789:;<=>") which indicate the status of a bogus inode which can be used for file recovery. A digit means the inode block entry has not been filled yet, a minus sign indicates that it has been filled. From the main screen, use the case insensitive keys (these options are valid from any mode):

    b   - to enter block mode

    d   - to format the current block as a directory

    f   - menu of runtime flags

    h   - show list of valid keys (also F1)

    i   - to enter inode mode

    r   - to enter recover mode

    s   - return to super block mode (only valid from other modes)

    q   - to quit

    ^L  - to repaint the screen

    ^O  - display menu of valid choices (also F2)
I have tried to implement cursor motion modes similar to both vi and emacs (M = meta key, ^ = control key, ESC is recognized as the meta key, M-ESC is recognized occasionally as ESC -- to exit menus).
        vi     emacs
     UP    k      ^P
    DOWN    j      ^N
    LEFT    h      ^B
    RIGHT    l      ^F
    PG_UP    ^U      M-v
    PG_DN    ^D      ^V

Inode mode:
    Once in inode mode, the current inode will be displayed in the workspace window.

    PG_DOWN DOWN_ARROW
        - make next inode the current inode

    PG_UP UP_ARROW
        - make previous inode the current inode

    RT_ARROW
        - select next block (from those indexed by the inode, the cursor will follow your selection)

    LT_ARROW
        - select previous block

    0123456789:;<=>
        - switch to block mode viewing block indexed by number. For the minix file system, 7 is the indirect block, 8 is the double indirect block. In general, count backwards from the end: the ext2fs has a triple indirect block ">", double indirect block "=", and an indirect block "<".

    B   - switch to block mode, examining block under cursor

    b   - switch to block mode, examining current block (displayed in status line)

    c   - Copy inode to inode copy buffer.

    e   - edit inode information. Use the cursor to select the field you want to edit, then hit RET ^M ^J or e and a line will pop up at the bottom of the screen, enter the new value here. Entering a blank line will leave the value unchanged. If the current version of ncurses was working, I could modify a block when you start typing numbers, but it loses an interrupt somewhere and the display falls behind a keystroke (maybe it's not ncurses fault, but I haven't been able to fix it yet).

    p   - Paste inode from inode copy buffer.

    r   - switch to recover mode

    R   - switch to recover mode, copy current inode block information into recovery inode

    #   - this will prompt the user to enter a number and it will then make that the current inode. The number may be entered as hexadecimal (leading 'x', '0x', or '$'), octal (leading ''), or decimal.
Block Mode: In block mode, the current block will be displayed in hexadecimal and ASCII. The numbers along the left hand side of the screen are hexadecimal offsets from the beginning of the block. As much of the block as possible will be displayed. If the block is marked unused, the central row of ':' will spell out NOT USED.

    +   - display next chunk of this block

    -   - display previous chunk of this block

    PG_DOWN
        - make next block the current block

    PG_UP
        - make previous block the current block

    arrow
        - move cursor

    b   - view block under cursor. lde will interpret the byte under the cursor as the start of a block pointer (as if it were part of an indirect block). This will be a two byte pointer for the minix file system, four bytes for ext2fs and xiafs.

    B   - Interpret blocks under cursor as a block pointer and make it the current block.

    c   - Copy block to copy buffer.

    d   - Dump block as a directory. Currently only dumps one screenful and will only display (no commands except exit). Requires -DALPHA_CODE

    e   - edit the data in hex or ascii mode. TAB ( ^I) switches between hex and ascii editing. While in hex edit, the keys A-F and 0123456789:;<=> will be deactivated. In ascii mode, chars 32-126 are interpreted as data. Editing will exit on write block ( ^W ) or a command which goes to another block or leaves block mode. To lose your changes and re-read the block use ^A or view another block and come back. You will always be prompted [Y/N] before a write occurs. It is probably a good idea to unmount the file system before you do any writes to it. My guess is that bad things will happen if you try to write the inode/block tables while someone else is using the filesystem.

    I   - view inode under cursor. lde will interpret the byte under the cursor as the start of an inode pointer (as if it were part of an directory entry). This will be a two byte pointer for the minix file system, four bytes for ext2fs and xiafs.

    p   - Paste block from copy buffer.

    w   - write the current block to the recovery file.

    0123456789:;<=>
        - tag this block to be recovered. Under Minix, this will display nine blocks which represent the block pointers in an inode. 0-6 are direct blocks, 7 is the indirect block, and 8 is the double indirect block. One day there may be an option for more direct blocks to make recovery easier. When a block is tagged, the status line will reflect this. To untag a block, go to recover mode and set the block's pointer to zero.

    #   - this will prompt the user to enter a block number. The numbers may be entered in the same format described in inode mode.

    ^R  - look up inode which references this block.
Recover Mode: In recover mode, the tagged blocks are displayed and may be edited by hand. When they are correct the user can dump the file. The user is prompted for a filename which can be 80 chars, the default file is "./RECOVER.file".

    0123456789:;<=>
        - will prompt the user to enter a numeric value for the specified block index. The format of the input should be the same as that described in inode mode.

    r   - write out the recovered file
Directory View Accessable from inode and block mode. In block mode, it formats the current block as a directory entry with no syntax checking (i.e. it might not really be a directory block). In inode mode, it uses the block pointers to determine what to display. You can use the up and down arrow keys to scroll the display if there are too many entries to display at once.

d   - if the cursor is on a directory, it will follow the link and display that directory. Use D to do the same and set the current inode to the new directory inode.

i   - set the current inode to the inode under the cursor. I to set the current inode and immediately view it in inode mode.

n   - next block in directory. If you called the directory from inode mode, you can view the next block in the directory. It is equivalent to typing ``q DOWN d'' and will drop back to inode mode when it hits the last block. Currently the indirect blocks yield errors, so it drops back to inode mode when it runs out of direct blocks, or hits the first indirect inode.

SEE ALSO
fsck(8), fsck.minix(8), e2fsck(8), xfsck(8), debugfs(8)

AUTHOR
Scott D. Heavner (sdh@po.cwru.edu)