*BOOT BOOT: The BOOT command will display detailed BootSector Information for a selected Partition. Usage: BOOT Modes: PARTITION *CD CD: The CD command will change the working directory in the local partition. Usage: CD Modes: PARTITION *CDE CDE: The CDE (Chain Directory Entry) command will display the FAT chain which is associated with the specified file (directory entry). Usage: CDE [filename] Modes: PARTITION *CFE CFE: The CFE (Chain Fat Entry) command will display the FAT chain which starts at the specified cluster in the File Allocation Table. Usage: CFE [cluster] Modes: PARTITION *CLS CLS: The CLS command simply clears the screen. Usage: CLS Modes: ALL *CLUSTER CLUSTER: The CLUSTER command enables browsing the logical partition on a cluster-by-cluster (sector-by-sector) basis. The contents of each sector is displayed in a side-by-side hexidecimal and ASCII display. Once in CLUSTER mode, the [Up],[Dn],[PgDn] and [PgUp] keys can be used to move forward and backward a line or screen at a time. [Ctrl][Up] or [Ctrl][Dn] can be used to move in sector increments, while [Alt][Up] and [Alt][Dn] will move in cluster increments. You can go to the first or last cluster of the partition by pressing [Home] or [End] respectively. ECHO is automatically suspended in CLUSTER mode but you can snap a screen shot to the logfile (if you entered CLUSTER mode with ECHO enabled) by pressing the [Insert] key. Usage: CLUSTER [Cluster] Modes: PARTITION *COPY COPY: The COPY command will copy specified files from the current partition to the specified directory or to the working directory which was in effect at the time DRIVESPY was started. Type "HELP SWITCHES" for comprehensive help on using Wildcards or the Attribute, Recursion, Sorting, File Type, or File Group switches. Usage: COPY [filespec] {destination path} {/S} {/A} {/O} {/T} {/G} Modes: PARTITION Extensions: This command will select files based on their attributes or internal header information (user extensible), recurse subdirectories, and does not trip file access dates. *COPYDRIVE COPYDRIVE: The COPYDRIVE command will forensically copy the contents of the current drive to a specified target drive. In the event that the source drive is smaller than the target drive, an option will be provided to pad the remainder of the target drive with sectors full of zero's. In the event that the target drive is smaller than the source drive, the image may optionally be truncated to fit. Usage: COPYDRIVE [D[Drive Number]] Example: COPYDRIVE D2 (Copy Current Drive to Drive 2) Modes: DRIVE, PARTITION *COPYPART COPYPART: The COPYPART command will forensically copy the contents of the current partition to a specified target partition. In the event that the source partition is smaller than the target partition, an option will be provided to pad the remainder of the target partition with sectors full of zero's. In the event that the target partition is smaller than the source partition, the image may optionally be truncated to fit. Usage: COPYPART [D[Drive Number]P[Partition Number]] Example: COPYPART D2P2 (Copy Current Partition to Partition 2 on Drive 2) Modes: PARTITION *COPYSECT COPYSECT: The COPYSECT command will copy the specified sectors to the requested location on the same, or different, drive. The start of the sectors to be copied are specified by a drive number, followed by a colon, followed by the starting sector number. The starting sector should then be followed immediately by either a comma and the number of sectors to be copied, or, a hyphen and the last sector to be copied. Only the destination drive and starting destination cluster need to be specified as DRIVESPY will automatically calculate the destination range. If no drive is specified, the currently active drive is assumed. Furthermore, if no drive is specified and DRIVESPY is in partition mode, sector addresses are assumed to be relative to the start of the partition. For Example: COPYSECT 0:0,1024 1:0 Copies 1024 sectors from drive 0 sector 0 to drive 1 sector 0 COPYSECT 0:64-1200 1:2468 Copies sectors 64 to 1200 from drive 0 to drive 1 sector 2468 Type "HELP SECTORRANGE" for more help on specifying Sector Ranges Usage: COPYSECT [Source Sector Range] [Destination Start Sector] Modes: SYSTEM, DRIVE, PARTITION *DBEXPORT DBEXPORT: The DBEXPORT command will export selected directory entry information to a TAB delimited text file. This export file may then be imported into the database of choice for analysis. The fields which are exported are as follows (listed as first record): Path, Name, Extension, Long File Name, File Size, Starting Cluster, Archive, Directory, Volume, System, Hidden, and Read-Only Attributes, Erased Pseudo-Attribute, Creation Date, Modification Date, Access Date, MD5 file Hash if requested with the "/MD5" switch, and first 12 bytes of each file if requested with the "/HDR" switch. By default the DBEXPORT command will process all directory entries in the current partition (including erased files). Specific file filters can be implemented if desired by providing a file specification and standard attribute switches. Type "HELP SWITCHES" for comprehensive help on using Wildcards or the Attribute, Recursion, Sorting, File Type, or File Group switches. Usage: DBEXPORT {filespec} [export filename] {/MD5} {/HDR} {/S} {/A} {/O} {/T} {/G} Modes: PARTITION *DIR DIR: The DIR command will display selected directory entries in the specified directory. Specify a valid DOS wildcard to limit the directory entries which are listed. Absolute or relative directories may be specified in the path. Type "HELP SWITCHES" for comprehensive help on using Wildcards or the Attribute, Recursion, Sorting, File Type, or File Group switches. Usage: DIR {path} {/S} {/A} {/O} {/T} {/G} Modes: PARTITION Extensions: This command will select files based on their attributes or internal header information (user extensible), recurse subdirectories, and does not trip file access dates. *DRIVE DRIVE: The DRIVE command can be used to select a particular physical drive (0 based) for processing. This command will place DRIVESPY in "DRIVE" mode. When in DRIVE mode, the DRIVESPY prompt will be a "D" followed by the physical drive number of the selected drive. Usage: DRIVE [Physical Drive Number] Modes: All *DRIVES DRIVES: The DRIVES command will display the physical characteristics of all hard drives attached to the system. Usage: DRIVES Modes: All *ECHO ECHO: The ECHO command will enable or disable output to a previously specified output file. "ECHO ON" will enable output. "ECHO OFF" will disable output. The ECHO command by itself will display the current status. An ouput file must be specified before enabling ECHO. Usage: ECHO {ON|OFF} Modes: All *GFE GFE: The GFE (Get Fat Entry) command will display the value for the specified cluster in the File Allocation Table. Usage: GFE [cluster] Modes: PARTITION *HELP1 DRIVESPY Online Help (Type "HELP {command}" for individual command Help) Command Abbr Function --------- ---- ------------------------------------------------------------- Help ? Get Help Page G Select/Show Pagination Status Output O Select/Show Output File Status Echo E Select/Show Echo State LFN L Select/Show Long File Name Status (on/off) Ver A Display Version and License Information CLS Clear Screen Win Force Windows Detection On/Off INT13x Enable/Disable Support for Int13 Extensions Script Process sequence of commands in Script File Mem Spawn a temporary DOS process to display System Memory Usage Spawn Spawn a DOS sub-process for dynamic interaction (CAUTION!) Quit Q Exit DRIVESPY System Z Select SYSTEM View Drive D Select a DRIVE to Examine Part P Select a PARTITION to Examine Sector S Select a SECTOR to View (Hex) Cluster C Select a CLUSTER View (Hex) *HELP2 Drives V Show Physical Drives in System Tables T Show Partition Tables on Drive Parts F Show a Summary of Partitions on Drive Boot B Show Details of a Partitions Boot Sector Partmap M Show a Sector Map of Areas in a Partition Dir Display a Directory Listing Cd Change the Working Directory Copy Copy files to a specified workspace Unerase Unerase files to a specified workspace Search Search a Drive, Partition, or Files for specified text or codes DBExport Export Directory Entries in a Partition to a Database File Wipe Wipe Drive, Partition, Slack, Free Space, MBR, or Sector Range MD5 Calculate MD5 Hash of a Drive, Partition, or specified Files *HELP3 GFE Get value of a specified Fat Entry CFE Identify the Chain of clusters which follow a Fat Entry CDE Identify the Chain of clusters which follow a Directory Entry TDC Determine the full path of a cluster containing directory info Image Create a Forensic Image of the current Partition or Drive Restore Restore a Forensic Image to the current Partition or Drive SaveFree Write all Free Clusters to specified File SaveSlack Write All Slack, RAM Slack, or File Slack to specified file CopySect Forensically Copy of a Range of Sectors between Drives SaveSect Create a Forensic Image of a Range of Sectors WriteSect Restore a Forensic Image of a Range of Sectors CopyPart Forensically Copy a Physical Partition between Drives SavePart Create a Forensic Image of a Physical Partition WritePart Restore a Forensic Image of a Physical Partition CopyDrive Forensically Copy one Physical Drive to Another SaveDrive Create a Forensic Image of a Physical Drive WriteDrive Restore a Forensic Image of a Physical Drive *** Type "Help {command}" for help on individual commands *** Type "Help Switches" for help on common command switches *** Type "Help SectorRange" for help on using Sector Ranges *IMAGE IMAGE: The IMAGE command will create a forensic image of the current object being examined (Drive or Partition). This command essentially transfers control to the corresponding SAVEDRIVE (if in DRIVE mode) or SAVEPART (if in PARTITION mode). The stream file name should not include any file extension as these will be generated by DriveSpy when the stream is created. "/C" may be specified to create a compressed stream. "/H" may be specified to use hexidecimal stream file extensions (000-FFF)(decimal extensions are the default: 000-999). "/SIZE=[MB]" may be specified to set the individual stream file size (in MB). 2GB is the default. Notes may be provided when prompted. Usage: IMAGE [Stream Name] {/C} {/H} {/SIZE=Stream File Size (MB)} Modes: DRIVE, PARTITION *INT13X INT13X: The INT13X command will enable or disable support for the Interrupt 13 extensions. "INT13X ON" will enable support while "INT13X OFF" will disable support. This command is generally used for troubleshooting older machines with problematic or incomplete support for the Interrupt 13 Extensions. "INT13X" by itself will display the current status. Usage: INT13X {ON|OFF} Modes: All *LFN LFN: The LFN command will enable or disable the display of Long File Names in Directory Listings. "LFN ON" will enable LFN Listings. "ECHO OFF" will disable LFN LFN listings. The LFN command by itself will display the current status. Usage: LFN {ON|OFF} Modes: All *MD5 MD5: The MD5 command will generate an RFC Compliant MD5 hash for the specified sector range (/sectors=), the selected physical Drive (if in Drive Mode), Partition (if in Partition Mode), or the specified file(s) if in Partition Mode and a filename or wildcard is specified. Type "HELP SWITCHES" for comprehensive help on using Wildcards or the Attribute, Recursion, Sorting, File Type, or File Group switches. Type "HELP SECTORRANGE" for more help on specifying Sector Ranges. Usage: MD5 {filespec} {/S} {/A} {/O} {/T} {/G} {/SECTORS=[Sector Range]} Modes: DRIVE, PARTITION *MEM MEM: The MEM command will spawn a temporary DOS subprocess to display system memory utilization. Useful for determining the amount of available memory after DRIVESPY has been loaded. A minimum of 200K free is recommended with DRIVESPY currently in memory. Usage: MEM Modes: SYSTEM, DRIVE, PARTITION *OUTPUT OUTPUT: The OUTPUT command is used to specify a file for logging information sent to the screen. Once a file is specified, the ECHO command can be used to turn logging on and off. If the OUTPUT command is issued without a filename, the name of the file currently in use (if any) will be identified. If the file already exists it will be appended to. Usage: OUTPUT {filename} Modes: All *PAGE PAGE: The PAGE command will enable or disable automatic screen clearing before each command is processed. "PAGE ON" will enable screen clearing. "PAGE OFF" will disable it. The PAGE command all by itself will display the current status. Usage: PAGE {ON|OFF} Modes: All *PART PART: The PART command can be used to enter PARTITION mode by specifying a particular partition to be processed. The number of the partition should be identified as displayed by the "PARTS" command. When in PARTITION mode, the DRIVESPY prompt will be a "D" followed by the associated physical drive number, followed by a "P" and then the selected partition number. Usage: PART [Partition Number] Modes: DRIVE, PARTITION *PARTMAP PARTMAP: The PARTMAP command can be used to display basic architectural information regarding a given partition. The displayed information includes relative sector offsets to the various system areas. Usage: PARTMAP Modes: PARTITION *PARTS PARTS: The PARTS command can be used to identify a summary of all the Partitions defined on a given physical drive. Usage: PARTS Modes: DRIVE, PARTITION *RESTORE RESTORE: The RESTORE command will restore a forensic image to the current object being examined (Drive or Partition). This command essentially transfers control to the corresponding WRITEDRIVE (if in DRIVE mode) or WRITEPART (if in PARTITION mode). Usage: RESTORE [Stream Name] Modes: DRIVE, PARTITION *SAVEDRIVE SAVEDRIVE: The SAVEDRIVE command will create a forensic image of the current drive being examined. The contents of the specified stream file(s) may then be used by the WRITEDRIVE command to restore the image contents to a physical drive of equal or greater size. The stream file name should not include any file extension as these will be generated by DriveSpy when the stream is accessed. "/C" may be specified to create a compressed stream. "/H" may be specified to use hexidecimal stream file extensions (000-FFF) (decimal extensions are the default: 000-999). "/SIZE=[MB]" may be specified to set the individual stream file size (in MB). 2GB is the default. Notes may be provided when prompted. Usage: SAVEDRIVE [Stream Name] {/C} {/H} {/SIZE=Stream File Size (MB)} Modes: DRIVE, PARTITION *SAVEFREE SAVEFREE: The SAVEFREE command will write the contents of all unallocated clusters in a partition to a file stream. An output file stream must be specified. If a specific path is not identified in the file stream specification, the file will be created in the default directory at the time DRIVESPY was started. "/C" may be specified to create a compressed stream. "/H" may be specified to use hexidecimal stream file extensions (000-FFF) (decimal extensions are the default: 000-999). "/SIZE=[MB]" may be specified to set the individual stream file size (in MB). 2GB is the default. Notes may be provided when prompted. Usage: SAVEFREE [Stream Name] {/C} {/H} {/SIZE=Stream File Size (MB)} Modes: PARTITION *SAVEPART SAVEPART: The SAVEPART command will create a forensic image of the current partition being examined. The contents of the specified stream file(s) may then be used by the WRITEPART command to restore the logical partition to a physical partition of equal or greater size. The stream file name should not include any file extension as these will be generated by DriveSpy when the stream is created. "/C" may be specified to create a compressed stream. "/H" may be specified to use hexidecimal stream file extensions (000-FFF) (decimal extensions are the default: 000-999). "/SIZE=[MB]" may be specified to set the individual stream file size (in MB). 2GB is the default. Notes may be provided when prompted. Usage: SAVEPART [Stream Name] {/C} {/H} {/SIZE=Stream File Size (MB)} Modes: PARTITION *SAVESECT SAVESECT: The SAVESECT command will copy the requested sectors to the specified stream file(s). The contents of the specified stream file(s) may then be used by the WRITESECT command to write them back. The stream file name should not include any file extension as these will be generated by DriveSpy when the stream is created. "/C" may be specified to create a compressed stream. "/H" may be specified to use hexidecimal stream file extensions (000-FFF) (decimal extensions are the default: 000-999). "/SIZE=[MB]" may be specified to set the individual stream file size (in MB). 2GB is the default. Notes may be provided when prompted. Type "HELP SECTORRANGE" for more help on specifying Sector Ranges Usage: SAVESECT [Sector Range] [Stream Name] {/C} {/H} {/SIZE=Stream File Size (MB)} Modes: DRIVE, PARTITION *SAVESLACK SAVESLACK: The SAVESLACK command will acquire all data in slack space in the default partition and write it into the specified stream file. As an option, the \"/RAM\" or \"/FILE\" switches may be used to specifically acquire only the slack which was generated from memory buffers or residual file information respectively. Type \"HELP SWITCHES\" for comprehensive help on using Wildcards or the Attribute, Recursion, Sorting, File Type, or File Group switches. "/C" may be specified to create a compressed stream. "/H" may be specified to use hexidecimal stream file extensions (000-FFF) (decimal extensions are the default: 000-999). "/SIZE=[MB]" may be specified to set the individual stream file size (in MB). 2GB is the default. Notes may be provided when prompted. Usage: SAVESLACK [Stream Name] {/RAM} {/FILE} {/S} {/A} {/O} {/T} {/G} {/C} {/H} {/SIZE=Stream File Size (MB)} Modes: PARTITION *SCRIPT SCRIPT: The SCRIPT command is used to specify a file to be read which contains commands as they would be normally entered from the keyboard. These commands will be processed exactly as they appear in the file. This is useful in automating groups of commands which may be routinely run during investigations. Usage: SCRIPT {filename} Modes: All *SEARCH SEARCH: The SEARCH command will search the current drive or partition for strings which match those specified in the specified Search String file. If the SEARCH command is issued when in Drive mode, the entire physical drive will be searched. If issued in Partition mode, the individual Partition will be searched. If a file specification or or wildcard is provided, then the specified files will be searched. Non-DOS partitions will be searched in a physical manner. The "/P" switch may be used to force the physical linear processing of a DOS partition. The specified Search String Section in DRIVESPY.INI should simply contain one line for each string to be searched for. Each line should begin with a percent accuracy value (50-100) and be separated from the search string with a colon. The search string may be specified in quotes, or by decimal or hex values separated by commas. The name of the Search String Section in DRIVESPY.INI should be the same as that which is specified on the command line preceded with "Search ". Type "HELP SWITCHES" for comprehensive help on using Wildcards or the Attribute, Recursion, Sorting, File Type, or File Group switches. Usage: SEARCH {filespec} [Search Section] {/S} {/A} {/O} {/T} {/G} {/P} Modes: DRIVE, PARTITION *SECTOR SECTOR: The SECTOR command enables browsing the physical disk or logical partition on a sector-by-sector basis. The contents of each sector is displayed in a side-by-side hexidecimal and ASCII display. The manner in which the sector address is interpreted is different depending on the parent mode (DRIVE or PARTITION) from which SECTOR mode is entered. If entering from DRIVE mode, the sector address is understood to specify an ABSOLUTE location from the beginning of the physical disk. If entering from PARTITION mode, the sector address is understood to specify a RELATIVE location from the beginning of the partition. Both types of sector addresses are zero based. To access an ABSOLUTE sector when in PARTITION mode, use the "/ABS" switch. Once in sector mode, the [Up],[Dn],[PgDn] and [PgUp] keys can be used to move forward and backward a line or screen at a time. [Ctrl][Up] or [Ctrl][Dn] can be used to move on a sector-by-sector basis. You can go to the first or last sector of the disk or partition by pressing [Home] or [End] respectively. ECHO is automatically suspended in SECTOR mode but you can snap a screen shot to the logfile (if you entered SECTOR mode with ECHO enabled) by pressing the [Insert] key. Usage: SECTOR [sector] {/ABS} Modes: DRIVE, PARTITION\n"); *SECTORRANGE Specifying a [SECTOR RANGE]: Whenever a [Sector Range] is required as a parameter for a DRIVESPY command, it may be specified in two different formats. These are as follows: [Drive Number]:[Absolute Start Sector],[Number of Sectors] [Drive Number]:[Absolute Start Sector]-[Absolute End Sector] The first form is used to specify a sector range by identifying a starting sector and the total number of sectors. The second form specifies a range by identifying both the starting and ending sectors. (Comma vs Hyphen) If the drive number (and colon) is omitted from the above formats, the currently selected drive will be assumed. If the drive number (and colon) is omitted, and DRIVESPY is currently in PARTITION MODE, then the sector adresses will be assumed to be relative to the start of the current partition. (Otherwise all sector addresses are assumed to be specified as absolute sector addresses from the beginning of the drive) *SPAWN SPAWN: The SPAWN command will spawn a temporary DOS subprocess for interactive command execution. Type "EXIT" to return to DRIVESPY from the DOS sub-process. Be very careful with this command as it is possible to create system instability between DOS and DRIVESPY using this function. (This command should NOT be used if you don't understand the types of issues which could cause problems). Usage: SPAWN Modes: SYSTEM, DRIVE, PARTITION *SWITCHES1 COMMON COMMAND LINE SWITCHES: WILDCARDS: Standard DOS Wildcard characters (* and ?) may be used to select multiple files which meet a given file specification. ATTRIBUTES: The DOS DIR Attribute switch "/A" may be used with supporting commands to select files based on their respective attributes. Attributes which may be appended to the "/A" switch as follows: A=Archive, D=Directory, V=Volume, S=System, H=Hidden, R=ReadOnly. The standard DOS/DIR attribute switch has also been augmented to include E=Erased. Specify a hyphen (-) before the desired attribute in order to select those files which do not have the specified attribute. SORTING: The DOS DIR Output Sort switch "/O" may be used to control the order in which output is presented. The following characters may be appended to the "/O" switch to control sort precedence: N=Name, E=Extension, G=Directories, S=Size, D=Date and Time, A=Access Date. The Output Sort switch has been augmented to include X=Erased. Specify a hyphen (-) before the respective letter to invert the sort order for the associated field. RECURSION: The "/S" switch may be used to recurse (sub)directories. FILE TYPES: The "/T" switch may be used to select files based on their internal header information. File types are specified and may be augmented by modifying the contents of DRIVESPY.INI. *SWITCHES2 FILE GROUPS: Multiple file types may be associated with file type groups in DRIVESPY.INI and then specified as selection criteria using the "/G" switch. This information is also user extensible. SUPPORTING COMMANDS: COPY, DIR, MD5, UNERASE, SEARCH, SAVESLACK *SYSTEM SYSTEM: The SYSTEM command is used to return DRIVESPY to the SYSTEM mode. (Highest Processing Level) When in SYTEM mode, the DRIVESPY prompt will be \"SYS>\". Usage: SYSTEM Modes: All *TABLES TABLES: The TABLES command can be used to display the details of each of the Partition Tables defined on a given physical drive. Usage: TABLES Modes: DRIVE, PARTITION *TDC TDC: The TDC (Trace Directory Cluster) command will walk the directory chain backwards from the specified directory cluster to determine the absolute path of the respective directory. Usage: TDC [cluster] Modes: PARTITION *UNERASE UNERASE: The UNERASE command will attempt to recover erased files from the current partition being examined. Files will be unerased to the specified destination or to the working directory which was in use at the time DRIVESPY was started. Type "HELP SWITCHES" for comprehensive help on using Wildcards or the Attribute, Recursion, Sorting, File Type, or File Group switches. Usage: UNERASE [filespec] {destination path} {/S} {/A} {/O} {/T} {/G} Modes: PARTITION *VER VER: The VER command will display Version, Copyright, and Legal Information about DRIVESPY. Usage: VER Modes: All *WIN WIN: The WIN command will force the Windows detection to the specified value. This command is useful when it is desireable to force Windows detection off such that commands normally inhibited under Windows are re-enabled. This command should not be used unless you are absolutely sure about what you are doing! Usage: WIN {ON|OFF} Modes: All *WIPE WIPE: The WIPE command will wipe (overwrite with zero's) the entire selected physical Drive (if in Drive Mode), the selected Partition (if in Partition Mode), or the Master Boot Record (via the "/MBR" switch). If wiping a Partition, the "/L" switch may be used to preserve the integrity of the logical drive without reformatting. The "/SLACK" or "/FREE" switches can also be used when processing a partition to wipe file slack or unallocated space respecively. Using the "/UNUSED" switch will wipe both slack and unallocated space in a partition. The "/RAND" switch can be used to wipe the requested area using a pseudo-random sequence rather than zero's. Specifying the "/C" switch and following it with a colon and a decimal or hex value, will force the wipe command to use the associated character during the wipe (i.e. "/C:65" or "/C:0x27"). The "/SA" switch can be used to write Int13 and Int13x Sector Address information into each sector as it is Wiped. Wiping an entire Drive or Partition will require reboot of the system at the termination of the DRIVESPY Session. Specific Sector Ranges may also be specified for Wiping if desired. Type "HELP SECTORRANGE" for more help on specifying Sector Ranges Usage: WIPE [Sector Range] {/L} {/MBR} {/SLACK} {/FREE} {/UNUSED} {/RAND} {/C:[val]} {/SA} Modes: DRIVE, PARTITION *WRITEDRIVE WRITEDRIVE: The WRITEDRIVE command will restore a compressed forensic image of a drive to the drive being examined. The specified stream file(s) should have been created by the SAVEDRIVE command. The drive to which the image is being restored should be of equal or greater size. Usage: WRITEDRIVE [Stream Name] Modes: DRIVE, PARTITION *WRITEPART WRITEPART: The WRITEPART command will restore a compressed forensic image of a partition to the partition being examined. The specified stream file(s) should have been created by the SAVEPART command. The partition to which the image is being restored should be of equal or greater size. Usage: WRITEPART [Stream Name] Modes: PARTITION *WRITESECT WRITESECT: The WRITESECT command will restore the requested sectors from the specified stream. If no path is included in the stream, the stream will be assumed to be in the default directory at the time DRIVESPY was started. The sectors to be written are specified by a drive number, followed by a colon, followed by the starting sector number. The starting sector should then be followed immediately by either a comma and the number of sectors to be written, or, a hyphen and the last sector to be written. If no drive is specified, the currently active drive is assumed. Furthermore, if no drive is specified and DRIVESPY is in partition mode, sector addresses are assumed to be relative to the start of the partition. For Example: Type "HELP SECTORRANGE" for more help on specifying Sector Ranges Usage: WRITESECT [Stream Name] [Target Sector Range] Modes: DRIVE, PARTITION *QUIT QUIT: The QUIT Command will exit the DRIVESPY Utility. Usage: QUIT Modes: All