INT 21 - DOS 1+ - FIND FIRST MATCHING FILE USING FCBsee File Control Block AH = 11h DS:DX -> unopened FCBsee File Control Block (see #01345), may contain '?' wildcards Return: AL = status 00h successful [DTAsee Disk Transfer Address] unopened FCBsee File Control Block for first matching file FFh no matching filename, or bad FCBsee File Control Block Notes: the type of the returned FCBsee File Control Block depends on whether the input FCBsee File Control Block was a normal or an extended FCBsee File Control Block the data returned in the DTAsee Disk Transfer Address (disk transfer area) is actually the drive number (or extended FCBsee File Control Block header and drive number) followed by the file's directory entry (see #01352); this format happens to be compatible with an unopened FCBsee File Control Block for extended FCBs with search attribute 08h, the volume label (if any) will be returned even if the current directory is not the root dir. DOS 3.0+ also allows the '*' wildcard the search FCBsee File Control Block at DS:DX must not be modified if AH=12h will be used to continue searching; DOS 3.3 has set the following parts of the FCBsee File Control Block: 0Ch BYTE ??? 0Dh WORD directory entry number of matching file 0Fh WORD cluster number of current directory 11h 4 BYTEs ??? 15h BYTE drive number (1=A:) this function is used by many copy protection schemes to obtain the starting cluster of a file BUG: under Windows95, if a .EXE program ("MZThe letters M and Z appear in numerous places in DOS (memory control blocks, .EXE header, etc.); the conventional explanation is that these are the initials of Mark Zbikowski, one of the principal architects of MSDOS 2.0." header) rather than a true .COM calls this function from a DOS box, the ten bytes of the directory entry from 0Ch to 15h may be filled with zeros rather than the additional file times SeeAlso: AH=12h,AH=1Ah,AH=4Eh,INT 2F/AX=111Bh Format of DOS directory entry: Offset Size Description (Table 01352) 00h 8 BYTEs blank-padded filename first character is set to E5h for deleted files (05h for pending delete files under Novell DOS / OpenDOS) 08h 3 BYTEs blank-padded file extension 0Bh BYTE attributes 0Ch 10 BYTEs (MS-DOS 1.0-6.22) reserved (DR DOS) used to store file password / owner (see #01354) (see also INT 21/AX=4302h) (Novell DOS 7) DELWATCH data (see #01354) (MS-DOS 7/Windows95) additional file times (see #01353) 16h WORD time of creation or last update (see #01665 at AX=5700h) 18h WORD date of creation or last update (see #01666 at AX=5700h) 1Ah WORD starting cluster number (see also AX=440Dh/CX=0871h) (may not be set in INT 21/AH=11h return data for FAT32 drives) 1Ch DWORDDoubleword; four bytes. Commonly used to hold a 32-bit segment:offset or selector:offset address. file size SeeAlso: #01355,#02628,#02629 Format of MS-DOS 7/Windows95 additional file times: Offset Size Description (Table 01353) 00h BYTE reserved 01h BYTE 10-millisecond units past creation time below 02h WORD file creation time 04h WORD file creation date 06h WORD last-access date 08h WORD (FAT32) high word of starting cluster number Note: this data is stored beginning at offset 0Ch in a standard directory entry SeeAlso: #01352 Format of DR DOS 6/Novell DOS 7 additional file information: Offset Size Description (Table 01354) 0Ch BYTE reserved (00h) (DOSPLUS v1.2) user-defined attributes for CP/M(Control Program for Microcomputers) An early operating system for micros based on the 8-bit Intel 8080 CPU (and later the compatible 8085 and Zilog Z80 CPUs). MSDOS version 1.0 was essentially a clone of CP/M for the Intel 8086. compatibility (bit 7 = F1,...,bit 4 = F4, bits 3-0 reserved (0)) 0Dh BYTE first character of original filename for deleted file 0Eh WORD encrypted file/directory password 10h WORD reserved (00h) (Novell DOS 7 DELWATCH) original file time cleared when file is undeleted or purged 12h WORD (DR DOS 6) file owner ID (Novell DOS 7 DELWATCH) original file date cleared when file is undeleted or purged 14h WORD single/multiuser file/directory access rights (see AX=4302h) ---deleted files--- 16h WORD (Novell DOS 7 DELWATCH) time of deletion 18h WORD (Novell DOS 7 DELWATCH) date of deletion Note: offsets are within the full directory entry SeeAlso: #01352 Format of MS-DOS 7/Windows95 long-filename directory entry: Offset Size Description (Table 01355) 00h BYTE LFN record sequence and flags bits 5-0: sequence number bit 6: set if last long-filename record for file bit 7: set if file deleted 01h 10 BYTEs long filename, first part 0Bh BYTE 0Fh (otherwise impossible file attribute, used as signature) 0Ch BYTE reserved??? (00h) 0Dh BYTE checksum for short filename 0Eh 12 BYTEs long filename, second part 1Ah WORD first cluster number (always 0000h for LFN records) 1Ch 4 BYTEs long filename, third part Notes: long-filename entries are always stored in the directory just prior to the short-name entry for a file multiple LFN records are used if the long filename does not fit into a single record the short-filename checksum byte is computed by adding up the eleven bytes of the short filename, rotating the intermediate sum right one bit before adding the next character the long filename is encoded as 16-bit Unicode characters; for most filenames, this appears in the directory as the ASCII character followed by 00h SeeAlso: #01352,INT 21/AX=5704h,INT 21/AH=71h