Introduction

DiskExplorer X © 2010-2023 by Runtime Software LLC

Phone (USA): +1-888-777-6960
Email support: support@runtime.org
Email sales: info@runtime.org
Web: http://www.runtime.org

Runtime's DiskExplorer X lets you inspect and navigate any file system or on-disk structure. Details are displayed in an Internet Explorer window. Scripts and an integrated script interpreter generate DiskExplorer X views. The customizable scripts determine what information will be displayed and how. The script language is Pascal, so everybody with knowledge of a higher programming language can modify existing or create new scripts.

Over 25 Scripts

This version of DiskExplorer X comes with over 25 ready-to-use scripts for the following file systems:

  • NTFS
  • FAT12, FAT16, FAT32, EXFAT
  • EXT2, EXT3, EXT4
  • XFS
  • HFS+, APFS

These scripts show all relevant data structures, such as partition tables, boot records, and file system specific structures. The level of sophistication of those scripts goes to the point of you being able to retrieve individual files from the supported file systems. DiskExplorer X includes all the script's source codes. The script editor allows you to change and test your code quickly.

Write Your Own Data Recovery Software

Inside the script editor, you can call the debugger and trace through your script, inspecting its flow and variables.

The DiskExplorer X scripts show you how to extract programmatically files from NTFS, FAT, EXT, XFS, HFP+, and APFS. These scripts can be a blueprint for customized data recoveries or forensic investigations.

You can write additional scripts for other file systems or container structures, such as backup files, virtualization volumes, encrypted volumes, or surveillance disks. A rich set of built-in commands lets you access and process disks and image files. You could even develop your own data recovery software based on those scripts.

Create Educational Material and Documentation

As with any page you display in a browser, you can print DiskExplorer X's content on paper or in a PDF file. This feature makes it easy to create material and documentation for educational or forensic purposes.

DiskExplorer X is the perfect tool when using a standard recovery software, such as GetDataBack, is not sufficient to accomplish your objective. Create reports no other software offers for data recovery or forensic purposes.

Software Design

DiskExplorer X consists of two distinguished functions:

  • A script interpreter retrieves and formats the desired information from the inspected disk or image.
  • An Internet Explorer instance renders the script's output to the screen and processes user input.

The address bar of the Explorer windows tells the program the drive, sector, and view to be displayed. For example, the address http://local/partition_table/HD128:/0 tells DiskExplorer X to display the content of sector 0 on the first physical drive (HD128:) using the script partition table.

Scripts usually contain many links, allowing the user to navigate through the file system as she would navigate a Web site.

The usage of Internet Explorer enables you to print your windows easily. You can also save the current view or all visited views into HTML documents. This facilitates documentation of, for example, forensic jobs.

See also: Installation Menu

Introduction Menu Drives Views Scripting Navigation Options Support


Installation

Note: Do not install any software to the drive you want to recover data from.

After downloading DiskExplorer X run the dexsetup.exe. The setup wizard will guide you through the installation process.

You must have Administrator rights to run this program.

System requirements:

  • Windows Server 2008, 2012, Vista, Windows 7, Windows 8, Windows 10, Windows 11, 32 or 64-bit
  • Internet Explorer 5 or above must be installed


License Agreement

License Agreement and Disclaimer

The following are the conditions under which this Runtime Software software is sold, supported and may be used. By using or registering Runtime Software software, you are agreeing to these.
This document may be augmented or superseded by conditions included with specific applications.

Neither the author(s) nor Runtime Software assume responsibility for any expense, damage or loss caused by your use of this software, however it occurs.
All the registered trademarks used herein are registered to whoever it is that owns them. This notification is given in lieu of any specific list of trademarks and their owners.

No portion of the documentation for this software or any of its attendant files may be reproduced in whole or in part in any medium or form of transmission exclusive of the archive file for the software without the express written permission of Runtime Software. You may not modify or patch the software's executable files in any way, including but not limited to decompiling, disassembling, or otherwise reverse engineering the program.

Registering this software buys you a named single-user license to use it in perpetuity, subject to the terms discussed herein. With a named single-user license you are the only user of the license, installed on one computer owned or controlled by you. If you want to have the software installed on more than one computer at the same time, you need to purchase additional licenses. If you want the software to be used by additional users, you need to purchase additional licenses. A single-user license does not permit you to make the registered software available over a network for multiple users to access, to distribute it in any form or to provide it in conjunction with any other product without the express written permission of Runtime Software. The license is not transferable to another party without written permission of Runtime Software. If you have any questions about the software license, feel free to get in touch with us.

A "Technician's License" has the same rights and restrictions as the above "named single-user license", but allows you to perform data recovery services on computers not owned or controlled by you.


Views

"Views" in DiskExplorer X are created by scripts in a way similar to Websites where HTML content is created with PHP scripts. At the time a view is called, e.g. by a clicking a link in a previous view, its script is executed and puts HTML code into the "result" variable. Once the script has completed, this variable is rendered by the Internet Explorer window.

Currently, DiskExplorer X comes with the following set of views:

Script name | VIEWNAME | VIEWNAMEALT | HOTKEY | CONTEXT (File system) | Description
root.scr |  |  |  | none | Displays the list of used drives & images
hex.scr | Hex | HEX | F3 | none, but FS aware | Provides the hex view
partition_table.scr | Partition Table | PartTable | F9 | none | Shows the partition table
gpt.scr | GUID Partition table | GPT |  | none | Shows the GUID partition table
search.scr | Search |  |  | none | Shows previous search
dir_ext.scr | Directory | DIR | F5 | EXT | Directory
groupdesc.scr | Group Description | GroupDesc | F6 | EXT | Group description
inodes.scr | Inodes | Inodes | F7 | EXT | Inode list
super_ext.scr | Superblock | SuperEXT | F10 | EXT | Ext2FS Superblock
boot_fat.scr | Boot | BootFAT | F10 | FAT | FAT boot record
dir.scr | Directory | DIR | F5 | FAT | FAT12, 16, 32 Directory
exdir.scr | exFAT Directory | exDir |  | FAT | EXFAT directory
fat12.scr | FAT12 | FAT12 | F6 | FAT | 12-bit FAT
fat16.scr | FAT16 | FAT16 | F7 | FAT | 16-bit FAT
fat32.scr | FAT32 | FAT32 | F8 | FAT | 32-bit FAT
clusterchain.scr | Cluster Chain | ClusterChain |  | FAT | Displays a file's cluster chain in EXFAT
boot_nt.scr | Boot | BootNT | F10 | NTFS | NTFS boot record
index.scr | Index | INDX | F5 | NTFS | Index Allocation (NTFS directory)
mft.scr | MFT | MFT | F7 | NTFS | MFT entry
mftlist.scr | MFT List | MFTList | F6 | NTFS | List of MFT entries
dir_xfs | Directory | DIR | F5 | XFS | XFS block directory
e-bptree.scr | Extent B+Tree | exTree |  | XFS | Extent B+Tree, BMAP
i-bptree.scr | Inode B+Tree | iTree | F5 | XFS | Inode B+Tree, IABT
inode_xfs.scr | Inode | Inode | F8 | XFS | Inode
inodes_xfs.scr | Inodes | Inodes | F7 | XFS | Inode list
super_xfs.scr | Superblock | SuperXFS | F10 | XFS | XFS Superblock, AGF, AGI
block_apfs.scr | Block | BlockAPFS | F10 | APFS | APFS block
map_apfs.scr | Map | MapAPFS |  | APFS | APFS block map
btree_hfs.scr | B-Tree | TreeHFS |  | HFS | HFS B-Tree
vol_hfs.scr | Boot | BootHFS | F10 | HFS | HFS+ boot record

See also: Scripting Navigation


Script Language

Scripting

"Views" in DiskExplorer X are created by "scripts" in a way similar to Web sites where PHP scripts create HTML content. When a view is called, e.g., by clicking a link in a previous view, its script is executed and puts HTML code into the "result" variable. Once the script completes, this variable is rendered by the Internet Explorer window.

Scripts are based on PASCAL, allowing you to access drives and images with many elements available in a higher programming language. DiskExplorer X works with three kinds of files:

  • .SCR - Script source code
  • .PSC - Library source code
  • .PCU - Compiled SCR or PSC files

SCR files are visible from DiskExplorer X as "views". PSC files contain procedures that are used from other scripts. A PSC file is referenced by a "unit" declaration at the start of an SCR file. PCU files are compiled versions of source files (SCR, PSC), speeding up the processing time. In Options, you can set if you want to use source files only and if you're going to create compiled versions automatically.

Example:

The script partition_table.scr contains the source code of that view. partition_table.scr uses two libraries, utils.psc, and navigation.psc. Here are the files:

File name | Description
partition_table.scr | Source code of the script
partition_table.pcu | Compiled version
utils.psc | Source code of the library utils
utils.pcu | Compiled version
navigation.psc | Source code of the library navigation
navigation.pcu | Compiled version

Script source file (SCR) contains two constants that will cause DiskExplorer X to integrate the view into its menu structure:

Constant | Description
CONTEXT | The "context" of the script, used to group related scripts together. Current contexts are FAT, NTFS, EXT, XFS, HFS, and APFS
VIEWNAME | Name as it appears in the Views menu
VIEWNAMEALT | Name as it appears in in-script navigation
HOTKEY | Hotkey associated with that view

Version Management

All script files must be in the same directory as the DiskExplorer X application (dex.exe). DiskExplorer X usually tracks the versions of source and compiled files. Only changes to libraries must be compiled manually, and DiskExplorer X must be restarted. To manually recompile all scripts, click "File->Compile all scripts".

Load and Run a Script

A script is loaded automatically when its file name is referenced from another script. For example, the script partition_table.scr is referenced by an anchor in the script root.scr:

Script root.scr:

  ...
  BuildLink('partition_table', DriveList.GetDrive(i).DriveLetter, 0, DriveList.GetDrive(i).Info)
  ...

To load a script into the editor, click on File->Load script. To run a loaded script, press F9. You can inspect the HTML output of the script in the box at the bottom. Clicking File->Exit will render that HTML code in the Internet Explorer window.

Debugger

Inside the script editor, you can call the debugger and trace through your script, inspecting its flow and variables.

Reference - Special Functions

Function | Purpose | Example
class TBinData | Basic buffer structure, used to store sector data
function TBinData.CreateZero(Cnt: integer): TBinData; | Creates a TBinData with Cnt bytes. All bytes are initialized to 0 | BD := TBinData.CreateZero(512);
function TBinData.CreateFromString(S: string[; Encoding: string=BYTES|ANSI|UTF8|OEM|UNICODE|HEX]): TBinData; Creates a TBinData from a string;
Encoding can be:
BYTES (uninterpreted 1-byte characters) (Default),
ANSI (interpreted 1-byte characters),
UTF8 (interpreted multi-byte UTF8 characters),
UNICODE (uninterpreted 2-byte characters),
OEM (interpreted as 1-byte OEM characters),
HEX? (as 1-byte hex values with ? as delimiter) 		BD := TBinData.CreateFromString('ABC');
BD := TBinData.CreateFromString('414243', 'HEX');
//creates TBinData with 3 bytes: $41,$42,$43
BD := TBinData.CreateFromString('ABC', 'UNICODE');
//create 6 bytes: $41,$00,$42,$00,$43,$00
function TBinData.Copy(Offset, Len: integer): TBinData; Duplicates the TBinData, with bytes beginning at Offset, with a length of Len. BD := TBinData.CreateFromString('ABC');
BD2 := BD.Copy(2,1);
//BD2 contains 'C'
function TBinData.String(Offset: integer[; Len: integer[; Encoding: string=BYTES|ANSI|UTF8|OEM|UNICODE|HEX]]): string Creates a string from TBinData.
Encoding can be:
BYTES (uninterpreted 1-byte characters) (Default),
ANSI (interpreted 1-byte characters),
UTF8 (interpreted multi-byte UTF8 characters),
UNICODE (uninterpreted 2-byte characters),
OEM (interpreted as 1-byte OEM characters),
HEX? (as 1-byte hex values with ? as delimiter) 		BD := TBinData.CreateFromString('410042004300', 'HEX');
S := BD.String(0, maxint, 'UNICODE');
//S contains 'ABC'
procedure TBinData.SetByte(Offset, B: integer); Set byte at Offset to B BD := TBinData.CreateFromString('ABC');
BD.SetByte(0, 64);
//BD now contains '@BC'
function TBinData.Bytes(Offset, Len: integer; Signed: string): int64; Returns the number at Offset, Len in Little-Endian notation. Maximum for Len is 8. If Signed is 'SIGNED', the two-complement of the number will be returned. BD := TBinData.CreateFromString('FFFFFFFF','HEX');
I := BD.Bytes(0, 4);
//I is 4294967295
I := BD.Bytes(0, 4, 'SIGNED');
//I is -1
function TBinData.BytesAsStr(Offset, Len: integer; Signed: string): int64; | Same as Bytes but returns the number as string
function TBinData.BytesAsStrT(Offset, Len: integer; Signed: string): int64; | Same as Bytes but returns the number as string with thousand delimiters
function TBinData.BytesAsHex(Offset, Len: integer; Signed: string): int64; Same as Bytes but returns the hex representation of the number. BD := TBinData.CreateFromString('FFFFFFFF','HEX');
S := BD.BytesAsHex(0,4);
//S contains 'FFFFFFFF'
S := BD.BytesAsHex(0,4,'SIGNED');
//S contains 'FFFFFFFFFFFFFFFF' (-1 in int64)
function TBinData.BEBytes(Offset, Len: integer; Signed: string): int64; | As Bytes, but using Big-Endian notation
function TBinData.BEBytesAsStr(Offset, Len: integer; Signed: string): int64; | As BytesAsStr, but using Big-Endian notation
function TBinData.BEBytesAsStrT(Offset, Len: integer; Signed: string): int64; | As BytesAsStrT, but using Big-Endian notation
function TBinData.BEBytesAsHex(Offset, Len: integer; Signed: string): int64; | As BytesAsHex, but using Big-Endian notation
property TBinData.Count: integer; Get or set the number of bytes in the TBinData structure. Existing bytes lower than Count are being preserved. New bytes are initialized to 0 BD := TBinData.CreateFromString('ABC');
I := BD.Count;
//I is 3
BD.Count := 4;
//BD is $41,$42,$43,$00
function TBinData.GetPointer: pointer; Returns a pointer to the buffer containing the data of the TBinData structure BD := TBinData.CreateFromString('ABC');
P := BD.GetPointer;
//P now points to a memory area containing $41,$42,$43
procedure TBinData.Append(BD: TBinData); Appends an existing TBinData structure with another one BD := TBinData.CreateFromString('ABC');
BD2 := TBinData.CreateFromString('DEF');
BD.Append(BD2);
//BD now contains 'ABCDEF'
procedure TBinData.SetUpcase; Upcases all bytes in the TBinData structure, if possible BD := TBinData.CreateFromString('abc');
BD.SetUpcase;
//BD now contains 'ABC'
function TBinData.Pos(Needle: TBinData; Index: integer): integer; Searches for Needle bytes in a TBinData, beginning at Index. First index is 0. Returns -1 if not found, otherwise the offset in the TBinData structure BD := TBinData.CreateFromString('ABCDEF');
Needle := TBinData.CreateFromString('CD');
I := BD.Pos(Needle);
//I is 2
Drive functions
function Drives(D: string): TDrive; Define a drive Drive := Drives('hd128');
Drive := Drives('c:\myimage.img');
Drive := Drives['D:');
function Drives(i: integer): TDrive; | Define a drive | Drive := Drives(128);
class TDriveList
function BuildDriveList(DriveString: string): TDriveList | Generates the DriveList | DriveList := BuildDriveList('HD128:,HD129:,C:,D:);
function DriveList.GetDrive(No: integer): TDrive; | Return a drive from the drivelist | Drive := DriveList.GetDrive(0);
function DriveList.Count: integer; | Returns number of drives in DriveList | Cnt := DriveList.Count;
class TDrive
function Drive.InfoCapaciy: string; | Capacity of the drive as string | ShowMessage(Drive.InfoCapacity);
function Drive.TotalSectors: int64; | Capacity of the drive in sectors, returns an int64. | ShowMessage(IntToStr(Drive.TotalSectors));
function Drive.ReadAsPointer(LBAStart, Count: int64; Buffer: pointer; var ErrCode: integer): boolean; Read from the drive into a buffer GetMem(Buffer, 512);
if Drive.Read(0, 1, Buffer, ErrCode) then
ShowMessage('Ok')
else
ShowMessage('Error ' + IntToStr(ErrCode));
function Drive.Read(LBAStart, Count: int64; var Error: integer): TBinData; Read from the drive into a TBinData structure Sector := Read(0, 1, ErrCode);
SomeStream.WriteBuffer(Sector.GetPointer, Sector.Count);
function Drive.DriveLetter: string; | Returns the drive letter, e.g. HD128:, C:, C:\image.img | ShowMessage(Drive.DriveLetter);
procedure Drive.FirstSector; Set drive to the first sector Drive.FirstSector;
while not Drive.EndOfDrive do
begin
ShowStatus(IntToStr(Drive.CurrentSector));
WriteImage(Image, Drive.GetSector);
Drive.NextSector;
end;
procedure Drive.NextSector[(IncBy: int64)]; | Move to the next sector
function Drive.EndOfDrive: boolean; | Test if end of drive is reached
function Drive.GetSector: TBinData; | Read current sector into a TBinData buffer
function Drive.CurrentSector: int64; | Determine the current sector (int64)
procedure Drive.LastSector; | Set drive to the last sector | Drive.LastSector;
procedure Drive.GotoSector(Sec: int64); | Move to a sector | Drive.GotoSector(1000);
function Drive.GetSectorAsPointer: pointer; | Read one sector into a buffer | P := Drive.GetSectorAsPointer:
function Drive.ReadSectors(NumSecs: integer): TBinData; | Read NumSec sectors into a TBinData buffer, starting with the current sector | BD := Drive.ReadSectors(128):
function Drive.String(Ofs: integer[; Len: integer[; Encoding: string=BYTES|ANSI|UTF8|OEM|UNICODE|HEX[; Sec: int64]]]): string;

 Returns the string starting at Ofs, length Len of the current sector, or, sector Sec if provided. If Len is not provided, the data from the current offset to the end of the sector is used.
Encoding can be:
BYTES (uninterpreted 1-byte characters) (Default),
ANSI (interpreted 1-byte characters),
UTF8 (interpreted multi-byte UTF8 characters),
UNICODE (uninterpreted 2-byte characters),
OEM (interpreted as 1-byte OEM characters),
HEX? (as 1-byte hex values with ? as delimiter) 		S :=Drive.String(0, 4, 'BYTES', 0);
//S is 'NTFS'
S :=Drive.String(0, 4, 'ANSI', 0);
//S is 'NTFS'
S :=Drive.String(0, 4, 'UTF8', 0);
//S is 'NTFS'
S :=Drive.String(0, 4, 'UNICODE', 0);
//S is '??'
S :=Drive.String(0, 4, 'HEX-', 0);
//S is '4E-54-46-53'
function Drive.Bytes(Ofs, Len: integer[; Sec: int64]): int64; Returns the value starting at Ofs, length Len of the current sector, or, sector Sec if provided. I := Drive.Bytes(8, 5);
//I is 123456890
function Drive.BytesAsStr(Ofs, Len: integer[; Sec: int64]): int64; same as Drive.Bytes but returning a string representation of the value S := Drive.BytesAsStr(8, 5);
//S is '1234567890'
function Drive.BytesAsStrT(Ofs, Len: integer[; Sec: int64]): int64; same as Drive.Bytes but returning a string representation with thousand delimiters of the value S := Drive.BytesAsStrT(8, 5);
//S is '1,234,567,890'
function Drive.BytesAsHex(Ofs, Len: integer[; Sec: int64]): int64; same as Drive.Bytes but returning a string representation of the value S := Drive.BytesAsHex(8, 5);
//S is '499602D2'
function Drive.Entropy: float Shannon entropy of current sector F := Drive.Entropy;
//f is between 0.00 and 1.00
function Drive.DriveKind: integer; Indicates the kind of drive:
0: Physical drive (HD128:,...)
1: Logical drive (C:,D:,...)
2: Image file (*.img, *.imc)
3: Virtual image file (*.vim)
4: Remote physcial drive 		I := Drive.DriveKind;
function Drive.Info: string; | Returns a more descriptive string for the drive, e.g. "1st hard drive 466 GB (HD128:) - ST95005620AS" | S := Drive.Info
function Drive.Partition(i: integer): TPartItem | Returns a drive's partition at index i, 0-based | Part := Drive.Partition(0);
function Drive.PartitionCount: integer; | Number of partitions on drive | I := Drive.PartitionCount;
class TPartItem
function PartItem.Info: string Descriptive string for this partition S := Drive.Partition.Info;
if Drive.Partition(1).IsExtended then
S := 'Extended ' + Drive.Partition(1).Info
else
S := 'Primary ' + Drive.Partition(1).Info;
ShowMessage(S);
function PartItem.IsExtended: booleean; | Indicates if this is a primary or extended partition
function PartItem.StartSector: int64; | This partition's start sector on the drive | I := Drive.Partition(1).StartSector;
function PartItem.Sectors: int64; | Length in sectors of this partition | I := Drive.Partition(1).Sectors;
function PartItem.Type: integer; | Type of this partition, e.g. NTFS | I := Drive.Partition(1).Type;
Memory functions
procedure GetMem(var P: pointer; MemSize: integer); Allocate a buffer GetMem(P, 1024);
//do something with P
FreeMem(P);
procedure FreeMem(P: pointer); | Free a buffer
Image functions
function CreateImage(FileName: string; Compressed: boolean): integer; Create a new image file for output Image := CreateImage('c:\newimage.img', false);
Drive.FirstSector;
while not Drive.EndOfDrive do
begin
WriteImage(Image, Drive.GetSector);
Drive.NextSector;
end;
CloseImage(Image);
function WriteImage(Image: integer; Sec: string): integer; | Write a string (sector) to the image file
procedure CloseImage(Image: integer); | Close image file
class TFileStream
function TFileStream.Create(FileName: string; FileMode: integer): TFileStream; Create new file FStrm := TFileStream.Create('somefile', fmCreate);
try
Sectors := Drive.GetSector;
FStrm.WriteBuffer(Sectors.GetPointer, Sectors.Count);
finally
FStrm.Free;
end;
procedure TFileStream.WriteBuffer(P: pointer; Size: integer); | Write to TFileStream
procedure TFileStream.Free; | Free the object
Statusline functions
procedure ShowStatus(Info: string); | Display a message in Scripter's window | ShowStatus('Current Sector' + IntToStr(Drive.CurrentSector));
procedure SetStatusRefreshRate(MS: integer); | Set the refresh rate of the status message in Millie seconds | SetStatusRefreshRate(10);
Dialogs
MessageDlg(Msg: string; DlgType; Buttons: variantarray): integer; Displays Windows' message dialog if MessageDlg('File exists. Overwrite?', mtConfirmation, [mbYes,mbNo]) = mrYes then
...
File functions
function FileExists(FileName: string): boolean; Tests if a file already exists if FileExists('c:\myimage.img') then
...
Conversion routines
function PartTypeToString(PartType: integer): string; | Converts partition type into a string, e.g. 7 -> 'NTFS' | S := PartTypeToString(Drive.Partition(1).Type);
function PartitionGUIDToString(GUID: string): string; | Converts GPT partition GUID into a string, e.g. 'EBD0A0A2-B9E5-4433-87C0-68B6B72699C7' -> 'Windows or Linux data partition' | S := PartitionGUIDToString('EBD0A0A2-B9E5-4433-87C0-68B6B72699C7');
function FmtSignificanceByte(i: int64; digits: integer): string; Converts a byte number S := FmtSignificanceByte(1000000, 4);
//returns '976.6 KB'
function IntToStr(i: int64): string; Converts an int64 to a string S := IntToStr(12345);
//returns '12345'
function IntToStrT(i: int64): string; Converts an int64 to a string with thousand delimiters S := IntToStrT(12345);
//returns '12,345'
function IntToHex(i: int64[; MinDigits, MaxDigits: integer]): string; Converts an int64 to a hex string S := IntToHex(12345);
//returns '3039'
S := IntToHex(12345, 8);
//returns '00003039'
S := IntToHex(12345, 4, 2);
//returns '39'
function IntToDual(i: int64[; MinDigits: integer]): string; Converts an int64 to a binary string S := IntToDual(12345);
//returns '11000000111001'
S := IntToDual(12345, 16);
//returns '0011000000111001'
function StrToInt(s: string): int64; Converts a string to an int64 I := StrToInt('12345678901234');
//returns 12345678901234
Bit operations
function Int32OR(i1, i2: integer): integer; Returns i1 OR i2. Use instead of bug with OR operator. i := Int32OR(1, 2);
//returns 3
function Int32AND(i1, i2: integer): integer; Returns i1 AND i2. Use instead of bug with AND operator. i := Int32AND(1, 3);
//returns 1
function Int32SHL(i1, i2: integer): integer; Returns i1 SHL i2. Use instead of bug with SHL operator. i := Int32SHL(1, 2);
//returns 4
function Int32SHR(i1, i2: integer): integer; Returns i1 SHR i2. Use instead of bug with SHR operator. i := Int32SHR(7, 2);
//returns 1
function Int64DIV(i1, i2: int64): int64; Divide two int64 numbers I := Int64DIV(10,3);
//returns 3
function Int64MOD(i1, i2: int64): int64; Modulo of two int64 numbers I := Int64MOD(10,3);
//returns 1
function Int64SHL(i1, i2: int64): integer; Returns i1 SHL i2. i := Int64SHL(1, 2);
//returns 4
String routines
function Token(No: integer; s: string; Separator: string): string; Extracts token No. 1-based S := Token(2, 'Monday;Tuesday', ';');
//returns 'Tuesday'
function TokCount(s, Separator: string): integer; Counts the number of tokens in s I := TokCount('M,T,W,T,F,S,S', ',');
//returns 7
function ParseTag(Src, StartTag, StopTag: string; var Index: integer): string; Extract tokens delimited by start/stop tags S := 'Drive HD128: 1TB'#13#10'Drive HD129: 2TB';
i := 1;
ShowMessage(ParseTag(S, 'Drive ', ':', I));
//returns 'HD128', I is 13
ShowMessage(ParseTag(S, 'Drive ', ':', I));
//returns 'HD129'
function CalculateString(Expression: string): float Compute the mathematical expression. Accepts hex prefixes $ and 0x
Supports:
+-/*^()
Ln, Exp, Abs 		F := CalculateString('5+6*2');
//returns 17
function Replace(StoDel, StoIns, s: string): string; Replace all occurrences of StoDel in s with StoIns S := Replace('ell', 'oh', 'hello');
//returns 'hoho'
function Replicate(s: string; Cnt: integer): string; Return Cnt times the string s S := Replicate('ab', 4);
//returns 'abababab'
function EnCodeStr(s: string): string; Encodes s in base64 S := EnCodeStr('abc');
ShowMessage(DeCodeStr(S));
//returns 'abc'
function DeCodeStr(s: string): string; | Decodes a base64-encoded string
function Reverse(s: string): string; Reverses a astring S := Reverse('123');
//returns '321'
function GroupString(s: string; CharsPerGroup: integer; Delimiter: string): string; Groups a string into of groups of CharsPerGroup characters each. Groups are delimited with Delimiter S := GroupString('EF1C77', 2, ' ');
//returns 'EF 1C 77'
function HexStringToGUID(s: string): string; Returns a 32-character Hex string formatted as a GUID S := HexStringToGUID('1234567890abcdef1234567890abcdef')
//returns '78563412-AB90-EFCD-1234-567890ABCDEF'
Date and time routines
function FileTimeToDateTime(f: float): float; | Convert NTFS file timestamps to TDateTime | dt := FileTimeToDateTime(f);
function FileDateToDateTime(i: integer): float; | Convert DOS file timestamps to TDateTime | dt := FileDateToDateTime(i);
function LinuxTimeToDateTime(i: integer): float; | Convert Linux file timestamps to TDateTime | dt := LinuxTimeToDateTime(i);
function HFSDateToDateTime(i: integer): float; | Convert HFS file timestamps to TDateTime | dt := HFSDateToDateTime(i);
function APFSDateToDateTime(i: int64): float; | Convert APFS file timestamps to TDateTime | dt := APFSDateToDateTime(ii);
HTML routines
function Linked(Link, Disp: string): string; Returns an <a> tag with Link being the href attribute and Disp being the display string. S := Linked('http://runtime.org', 'Runtime Software');
//returns <a href="http://runtime.org">Runtime Software</a>
function MakeTable(Params: variantarray): string; Creates HTML code for a table S := MakeTable(
[[8,4],[], [],[200,100,200,100],[], [0,2], ...8x4 elements... ]);
//8 rows, 4 columns, could get table attributes as 3rd param, e.g. width="100%"
//no flags, could be 'td-right=1', number of right-aligned columns
//no heights
//4 column widths
//no header rows
//0, 2 are header columns
//8x4 elements
function BuildLink(View, DriveLetter: string; Sector: int64; Display: string): boolean; | Creates a clickable <A> tag that will load the requested sector of the requested drive into the requested view. | BuildLink('partition_table', 'HD128:', 0, '1st HD');
Miscellaneous routines
function iif(Condition: boolean; s1, s2: string): string; Returns s1 if condition is true, otherwise s2 S := iif(x<0, 'negative', 'positive');
ShowMessage(S);
function iifarr(Needle: variant; HayArr, ThenArr: variantarray; ElseValue: variant): variant If Needle is found in array HayArr, the element with the same position in ThenArr is returned. If Needle is not found in array HayArr the variant ElseValue is returned. V := iifarr(-1, [-2, '-1', 0, 1, 2], ['-two', '-one', 'zero', 'one', 'two'], 'other'); //returns '-one'
V := iifarr(3, [-2, '-1', 0, 1, 2], ['-two', '-one', 'zero', 'one', 'two'], 'other'); //returns 'other'
function FlagArr(Flags: int64; Arr: variantarray; Delimiter: string): string; If a bit in Flags is set, the corresponding element of Arr is copied to the result, separated by Delimiter. s := FlagArr(5, ['bit0', 'bit1', 'bit2', 'bit3'], '-'); //returns 'bit0-bit2'
function VarType(V: variant): integer; Returns the type of the variant V.
0 (varEmpty)
1 (varNull)
2 (varSmallInt)
3 (varInteger)
4 (varSingle)
5 (varDouble)
6 (varCurrency)
7 (varDate)
8 (varOleStr)
9 (varDispatch)
10 (varError)
11 (varBoolean)
12 (varVariant)
13 (varUnknown)
17 (varByte)
18 (varWord)
19 (varLongWord)
20 (varInt64)
72 (varStrArg)
256 (varString)
257 (varAny)
4095 (varTypeMask) 		V := 1000000;
I := VarType(V);
//returns 3''''
function VarTypeToString(V: variant): string; Returns the variant type as a string. V := 1000000;
S := VarTypeToString(V);
//returns 'varInteger'
function GlobalExists(VarName: string): boolean; Returns TRUE if the variable with the name in VarName exists B := GlobalExists('myvar');
//returns TRUE if myvar exists
procedure Swap(var X, Y: variant); Swap the contents of two variables X := 'hello';
Y := 13;
Swap(X, Y);
//X now contains 13, Y contains 'hello'
function XorSectors(Sectors: variantarray): string; | XOR sec1,sec2...secx into a string | S := XorSectors([sec1, sec2, sec3]);
Array routines
function ArrayCreate(HighBound: integer): variantarray Creates a variant array with HighBound+1 elements Arr := ArrayCreate(10);
//creates an Arr with 11 elements, addressable as Arr[0]..Arr[10]
function ArrayRedim(V: variantarray; NewHighBound: integer): variantarray; Re-dimension a variant array v := ArrayCreate(6);
//v has 7 elements
v := ArrayRedim(v, 10);
//v has 11 elements
function ArrayHigh(V: variantarray): integer; Returns the index of the last element v := ArrayCreate(6);
I := ArrayHigh(v);
//I is 6
function ArrayContains(Arr: variantarray; V: variant): boolean; Tests if V is in Arr Arr := ['abc', 'def', 123];
B := ArrayContains(Arr, '123');
//returns TRUE

Reference - Variables

Variable | Description
Storage Storage.AsInt['varname'] Storage.AsInt64['varname'] Storage.AsFloat['varname'] Storage.AsString['varname'] Storage.AsBinary['varname'] Storage.AsBinData['varname'] Storage.Count | Provides a data container that is accessible over all scripts.
AvailableViews | A TDictionary<string,string> with information about the available views.
AvailableViews.Items['boot_fat,VIEWNAME'] | Returns the VIEWNAME of boot_fat.scr
AvailableViews.Items['*INDEX*0'] | Returns the first available view
Drive: TDrive | Current drive
ExtendedPartitionBase: float | do not use
Sector0: float | do not use
ClusterSize: integer | do not use
DriveList: TDriveList | List of active drives
CurrentURL: string | Currently displayed URL
CurrentView: string | Currently used view

Reference - Constants

Constants | Description
tag_br, tag_hr | '<br>', '<hr>'
DRIVE_KIND_PHYSICAL DRIVE_KIND_LOGICAL DRIVE_KIND_IMAGE DRIVE_KIND_SCHEDULE | Drive types (0,1,2,3)
maxint | Largest possible integer: 2147483647 ($7fff ffff)
maxint64 | Largest possible int64: 9223372036854775807‬ ($7fff ffff ffff ffff)
fmCreate, fmOpenRead, fmOpenWrite, fmOpenReadWrite | File mode constants for TFileStream.Create
AppDir | Application directory
TempDir | System's temp directory
mtWarning, mtError mtInformation, mtConfirmation | Message type constants
mbYes, mbNo, mbOK, mbCancel, mbAbort, mbRetry, mbIgnore, mbAll, mbNoToAll, mbYesToAll | Message dialog button constants
mrNone, mrOk, mrCancel, mrAbort, mrRetry, mrIgnore, mrYes, mrNo, mrAll, mrNoToAll, mrYesToAll | Message dialog result constants

Reference - System Functions

Abs
AnsiCompareStr
AnsiCompareText
AnsiLowerCase
AnsiUpperCase
Append
ArcTan
Assigned
AssignFile
Beep
Chdir
Chr
CloseFile
CompareStr
CompareText
Copy
Cos
CreateOleObject
Date
DateTimeToStr
DateToStr
DayOfWeek
Dec
DecodeDate
DecodeTime
Delete
EncodeDate
EncodeTime
EOF 		Exp
FilePos
FileSize
FloatToStr
Format
FormatDateTime
FormatFloat
Frac
GetActiveOleObject
High
Inc
IncMonth
InputQuery
Insert
Int
IntToHex
IntToStr
IsLeapYear
IsValidIdent
Length
Ln
Low
LowerCase
Now
Odd
Ord
Pos
Raise
Random
 ShowMessage
Sin
Sqr
Sqrt
StrToDate
StrToDateTime
StrToFloat
StrToInt
StrToIntDef
StrToTime
Time
TimeToStr
Trim
TrimLeft
TrimRight
Trunc
UpperCase
VarArrayCreate
VarArrayHighBound
VarArrayLowBound
VarIsNull
VarToStr
Write
WriteLn
ReadLn
Reset
Rewrite
Round

Reference - Basic PASCAL Syntax

begin .. end
procedure and function declarations
if .. then .. else
for .. to .. do .. step
while .. do
repeat .. until
try .. except and try .. finally blocks
case statements
array constructors (x:=[ 1, 2, 3 ];)
^ , * , / , and , + , - , or , <> , >=, <= , = , > , < , div , mod , xor , shl , shr operators
access to object properties and methods (ObjectName.SubObject.Property)
comments: // or (* *) or {}
variable declarations: var a;

See also: Views Navigation


Navigation

DiskExplorer X offers two ways to navigate your drive: built-in controls and script-defined navigation controls.

Built-in Navigation

These controls are accessible from the "Navigation" menu:

Navigation-> | Shortcut | Description
Last session | Ctrl-Alt-O | goto to the page that was open when the software was last exited.
Root | display the drive list as rendered by root.scr
Back | Left | show previous window
Forward | Right | show the next window
First | Ctrl-Home | load the current drive's first sector in the current view
Prev fast | Shift-Ctrl-Left | load the current sector minus 1000
Prev | Ctrl-Left | load the previous sector in the current view
Jump | Ctrl-G | Jump to a different location
Next | Ctrl-Right | load the next sector in the current view
Next fast | Shift-Ctrl-Right | load the current sector plus 1000
Last | Ctrl-End | load the current drive's last sector in the current view

Note that you can change the behavior of some of these navigation controls in your scripts. For example, our demo scripts regularly overwrite the number of sectors to be advanced when clicking on "Next" or "Prev".

Worth mentioning is also the "Jump" command. It lets you quickly go to a different location on the current drive. The jump dialog accepts a wide variety of inputs. It opens, showing the current sector number. You can enter a new number in 4 different ways:

Input format | Example
Decimal number | 1234
Hex number, starting with $ | $4D2
Hex number, starting with 0x | 0x4D2
Mathematical expression, built from decimal or hex numbers. Possible operators are +-*/^() Ln Exp Abs $4D2 + (8*128)
2^10

You can jump to sector numbers and file system specific locations, such as cluster, block, and more (see below).

Script-defined Navigation

In-script navigation is realized by tagging an "address" to a link in the Internet Explorer window.

Sample address:

http://local/hex/HD128:/412572

This address will load sector 412572 on HD128: into the hex view.

The address always begins with "http://local/". The following information follows it:

Address element Description Example
View Script name without extension hex
partition_table
Drive or Image Drive or image where the data is retrieved from HD128:
c:\myimage.img
Sector Sector number or first sector of data being displayed 412572
0

All demo scripts contain ample navigation links, e.g., changing the current view or jumping to a different sector on the drive. The links enable you to navigate a file system like a Website.

Your script can customize the jump command. Depending on the current context, the following customizations are currently implemented:

Jump target | Prefix | Example | NTFS | FAT | EXT | APFS | HFS | XFS
Sector | s | s 128 | x | x | x | x | x | x
Cluster | c | c $80 | x | x | x | x
Block | b | b 100+2*128 | x | x | x | x
Inode | i | i1111 | x
Mft entry | m | m 123 | x
Allocation group:Block | a | a4:1000 | x

See also: Views Scripting Search


Search

DiskExplorer X provides a fast and comfortable search function. To search for specific data on the disk or image, click Tools->Search.

There are five different search modes you can choose from:

Search mode Description Examples
Text Search for simple text.
XFS Search for text "XFS"
Unicode text Search for simple Unicode text.
$MFT Search for Unicode text "$MFT"
Hex Search for hex code.
74 61 62 6C 65 Search for hex 74-61-62-6C-65 ("table")
Text code mix Search for a mix of simple text and characters encoded by their Ascii value, e.g., #255. Expand the control code to 3 characters to avoid ambiguity with trailing text
#0abc | Search for Null character, followed by "abc"
#0000 | Search for Null character, followed by "0"
Entropy Search for a sector with a given entropy
0.95 to 1.00 Search for high-entropy data such as JPGs or compressed files.

"Ignore case" ignores the case of the searched text. Specify "Test only at offset" to look for the search string at a certain offset only.

Once a sector containing the search string was found, it is displayed using the current view. If the current view is the Hex view, all occurrences of the search string are highlighted. The search algorithm also works in cases where the search string is located at the end of a sector and stretches into the following sector.

Press "Ctrl-L" to start looking for the next sector containing the search string.


Drives

Drives & Images

Besides physical and logical drives, DiskExplorer X accepts image files and virtual images as data sources:

  • Physical drives
  • Logical drives
  • Image files
  • Virtual images

Physical drives are tangible media like hard drives, floppies, RAIDs, USB drives, memory sticks, flashcards, etc. In DiskExplorer X, they are called HD128 for the 1st drive, HD129 for the 2nd drive, etc.

Logical drives are what you usually access in Windows through a drive letter, such as C:, D:, etc.

Image files are files containing raw images of a drive. You can process an image file in the same way you can process a physical or logical drive. Image files must have been previously created, typically with Runtime's GetDataBack, DiskExplorer, or RAID Reconstructor. DiskExplorer X accepts whole images file and split image files. They can be uncompressed (IMG) or compressed (IMC, IMZ). The format most compatible with other software is the whole and uncompressed image. Split image files consist of files where the first has the extension IMG (or IMC, IMZ), and the subsequent files have the extensions 001, 002, etc.

Virtual images are short text files describing the data to be loaded. Thus, you can "glue" together different data sources. Virtual images are especially helpful if you want to recover RAID arrays. RAID Reconstructor creates virtual images that you can use here. The extension of a virtual image file is VIM. More information...

In DiskExplorer X, the list of used drives and images can be viewed and modified under "Tools->Manage drives & images." If you wish to add a drive to the used list, move it from the right to the left panel. You can also add image files and virtual images here. Click on "Add image" and select the image file. If you only need to add one image to the list, click on "File->Add image" in the main window.

See also: Virtual images


Virtual Images

Virtual Images are short XML files describing the data to be loaded. Thus, you can "glue" together different data sources. This flexibility is beneficial if you want to recover RAID arrays. RAID Reconstructor creates virtual images that you can use in Runtime's GetDataBack, DiskExplorer, Captain Nemo, and DiskExplorer X.

Virtual images always have the extension "vim".

You can create your own virtual image using the commands ("tags") below. It may contain any number of drives. Virtual images may contain other virtual images.

<virtualimage>

This tag is the root tag that encloses all other tags.

Example:

    <virtualimage>
    :
    :(other tags)
    :
    </virtualimage>

<sector>

This tag sets the sector number of the virtual image to a new value. Any gaps you create by that will be filled with 0's.

Example:

    <virtualimage>
    :
      <sector>1000</sector>
    :
    </virtualimage>

<drive>

This tag defines a drive within the virtual image. You can also specify a specific area of that drive.

Example:

    <virtualimage>
      <drive>HD128:</drive>
    </virtualimage>

This example of a virtual image uses your first hard drive (HD128:). Make sure you always append a colon to the drive's name.

Another example:

    <virtualimage>
      <drive>HD128:0-999</drive>
      <drive>c:\images\myimage.img:1000-</drive>
    </virtualimage>

This example maps the first 1000 sectors of HD128 to your virtual image. Sector 1000 and up of your virtual image will come from sector 1000 and up of the image file "c:\images\myimage.img". You declare ranges with two numbers separated by a dash. If you leave out the second number, the range will extend to the end of the respective drive.

Example with a NULL drive:

    <virtualimage>
      <drive>NULL:0-8000000000</drive>
    </virtualimage>

This NULL drive defines an empty 4 TB drive with 8,000,000,001 sectors.

NULL drive example with labeled and numbered sectors:

    <virtualimage>
      <drive>NULL(Sector Number):0-8000000000</drive>
    </virtualimage>

This NULL drive creates a virtual 4 TB drive with numbered sector numbers. Look what sector 4711 would look like:

Numbered sectors are an excellent feature for research purposes. When experimenting with RAID fragments, you can see where a sector originated.

Possible drive names are:

Name | Description
HD128:, HD129:, etc | 1st, 2nd physical drive, etc.
FD0:, FD1: | 1st, 2nd floppy drive
C:, D:, etc. | Logical volume C:, D:, etc.
myfile.img, myfile.imc, myfile.vim | Image files
NULL: | Virtual drive, delivers empty sectors. It must be followed by a range.
NULL(LABEL): | Virtual drive, delivers labeled and numbered sectors. It must be followed by a range.

<loop>

Use the <loop> tag to define RAID arrays.

Example definition of a 3-drive RAID-5 with a block size of 128, backward rotation:

    <virtualimage>
      <loop>
        <drive>c:\img\raid5\r1.img:</drive>
        <drive>c:\img\raid5\r2.img:</drive>
        <drive>c:\img\raid5\r3.img:</drive>
        <cycle blocksize="128">
          <stripe>1,2</stripe>
          <stripe>1,3</stripe>
          <stripe>2,3</stripe>
        </cycle>
      </loop>
    </virtualimage>

After the wrapping <loop> tag, specify the drives you will use in the RAID. See the specification above on the <drive> tag's syntax.

<cycle> and <stripe>

In the <cycle> tag, define the stripes making up the RAID using the <stripe> tag. Each stripe is a sequence of data taken from the previously defined drives. Specify the block size as an attribute for the <cycle> tag. You would read the example above as:

  1. Take 128 sectors from the 1st drive (r1.img, sectors 0-127).

  2. Take 128 sectors from the 2nd drive (r2.img, sectors 0-127).

  3. Take 128 sectors from the 1st drive (r1.img, sectors 128-255).

  4. Take 128 sectors from the 3rd drive (r3.img, sectors 128-255).

  5. Take 128 sectors from the 2nd drive (r2.img, sectors 256-383).

  6. Take 128 sectors from the 3rd drive (r3.img, sectors 256-383).

These six steps continue until the end of one drive has been reached. The smallest drive determines the size of the loop. If the smallest drive is 10000 sectors, the total size is 20000, rounded up to a complete cycle of 20736. You can change the size of the loop in two ways:

1) Specify the number of times the loop should be repeated. You can do this by adding an attribute with the name "repeat" to the <loop> tag, e.g., <loop repeat="27">. In the RAID example, repeating the cycle 27 times will yield 6*128*27 sectors, which is 20736.

2) Specify a range. Do this by adding the attribute "range" to the <loop> tag, e.g., <loop range="10-20".

The "repeat" takes precedence over the implicit size as determined by the drives. The "range" takes precedence over the "repeat".

<stripe>

You can even define incomplete RAID-5 arrays. If, in the example above, the 3rd drive is missing, you could describe the array like this:

    <virtualimage>
      <loop>
        <drive>c:\img\raid5\r1.img:</drive>
        <drive>c:\img\raid5\r2.img:</drive>
        <cycle blocksize="128">
          <stripe>1,2</stripe>
          <stripe>1,1x2</stripe>
          <stripe>2,1x2</stripe>
        </cycle>
      </loop>
    </virtualimage>

The expression 1x2 will calculate the missing sector, originally on the 3rd drive, by applying a byte-wise XOR operation.

The <stripe> tag can have a "repeat" attribute, e.g.

    <stripe repeat="16">1,2</stripe>

This attribute will cause a repeat of the <stripe> tag sixteen times.

<searchbootranges>

This tag does not change the Virtual Image. It is only information for programs using the VIM file, such as Captain Nemo.

For example,

    <searchbootranges>64200-64300;8450200-8450300;12643200-12643300</searchbootranges>

will instruct Captain Nemo to look for boot records at the sectors indicated.

See also: Drives


Support

You can contact us for support:

USA

Phone | 1-888-777-6960
Email | support@runtime.org
Website | http://www.runtime.org

If you have any questions related to the use of this software, please call us or send us an email.

See also: Troubleshooting


Troubleshooting

These are the most common warnings or errors you might run into:

Error message | Description
Access denied This message is displayed if you are trying to
  • open a file that is already in exclusive use by another process or
  • open a file in read/write mode that is write-protected.
COMCTRL32 outdated | You should update your Internet Explorer to a newer version.
No drives show up in Root view | You must run DiskExplorer X with administrator rights. Right-click the program icon and select "Run as administrator".
I/O Error The drive you are trying to read has "bad sectors". You should consider to stop working as this drive is physically damaged.
If it is a USB drive, you should attach it directly to the motherboard. Consider making an image.

If you get a runtime error, please submit a screenshot to: support@runtime.org.

See also: Support


Menu Structure

File-> |  |
 | Add image | add an image to the list of available drives
 | Compile all scripts | forces recompilation of all scripts
 | Load script | load the currently displayed script into the editor
 | Save page | save the current view into an HTML document
 | Save all pages | save all visited views into HTML documents
 | Print | print the current window
 | Exit | quit this program
Navigation-> |  |
 | Last session | load all pages that were open when the program was last exited
 | Root | display the drive list as rendered by root.scr
 | Back | show previous window
 | Forward | show the next windows
 | First | load the current drive's first sector in the current view
 | Prev fast | load current sector-1000
 | Prev | load the previous sector in the current view
 | Jump | Jump to a different location
 | Next | load the next sector in the current view
 | Next fast | load current sector+1000
 | Last | load the current drive's last sector in the current view
Views-> |  |
 | GUID Partition Table | display sector as a GPT
 | Hex | display sector in hex
 | Partition Table | display sector as partition table
 | Search | display search results
 | APFS->Block | APFS: show an APFS block
 | APFS->Map | APFS: show block map
 | EXT->Directory | EXT: show as directory
 | EXT->Group Description | EXT: show as group description
 | EXT->Inodes | EXT: show as inode list
 | EXT->Superblock | EXT: show as superblock
 | FAT->Boot | FAT: show as FAT boot record
 | FAT->Cluster Chain |
 | FAT->Directory | FAT: show as FAT directory
 | FAT->exFAT Directory | FAT: show as exFAT directory
 | FAT->FAT12 | FAT: show as FAT12 file allocation table
 | FAT->FAT16 | FAT: show as FAT16 file allocation table
 | FAT->FAT32 | FAT: show as FAT32 file allocation table
 | HFS->B-Tree | HFS+: show B-Tree entry
 | HFS->Boot | HFS+: show as HFS+ boot record
 | NTFS->Boot | NTFS: show as NTFS boot record
 | NTFS->Index | NTFS: show as NTFS directory (index entry list)
 | NTFS->MFT | NTFS: show as Master File Table record
 | NTFS->MFT List | NTFS: show as Master File Table record list
 | XFS->Directory | XFS: show as XFS directory
 | XFS->Extent B+Tree | XFS: show as data extent B+Tree
 | XFS->Inode B+Tree | XFS: show as inode B+Tree
 | XFS->Inode | XFS: show as individual inode
 | XFS->Inodes | XFS: show as inode list
 | XFS->Superblock | XFS: show as XFS superblock
Tools-> |  |
 | Search | search for occurrences of specified data
 | Search again | continue last search
 | Manage drives & images | Manage the list of available drives and images
 | Edit script variables | View or edit current script variables (Storage)
 | Options | change program settings
Help-> |  |
 | Content | call the integrated help (this)
 | About | displays copyright, license and version information


Options

You can view and modify the program options in the file DEX.INI. Click "Tools->Options" to load this file into the editor.

The DEX.INI is organized in sections, and each section can have several keys. The keys can have values.

Script editor

  • Show view as source: can be empty, "All", or a script file name. Setting this key will cause the script to open in the script editor instead of executing it. The default is empty.
  • Root script: the root script's name, which will be called first when the program is started. The default is "http://local/root//".

Script compilation

  • Use SCR files only: Call script source file even if a valid compiled version of that script exists. It can be "Yes" or "No". The default is "Yes".
  • Save compiled scripts: Save compiled scripts automatically. It can be "Yes" or "No". The default is "Yes".
  • Variables must be declared before use: When "yes", all variables must be declared before use. The default is "Yes".

Script variables

  • Used drives & images: this is the list of used drives. You can modify that list here or in "Tools->Manage drives & images".

Key/Value pairs defined in this section will be saved in the script variable "Storage" and can be retrieved from any script.

Other options

  • Use 4KB sectors: Setting this option to "Yes" will interpret sectors as blocks of 4096 bytes instead of 512 bytes. The default is "No".
  • Show page info: Display script information at the bottom of each page. The default is "No".
  • Track history URLs: Keep track of the visited pages even if you exit the program. After restarting, you can go there by clicking "Navigation->Last session".