Int 21H, AH=11H

1 and higher

FIND FIRST MATCHING FILE USING FCB

DosFindFirst

      AH = 11h
      DS:DX -> unopened FCB (see #01345), may contain '?' wildcards

AL = status
          00h successful
              [DTA] unopened FCB for first matching file
          FFh no matching filename, or bad FCB

the type of the returned FCB depends on whether the input FCB was a

        normal or an extended FCB
      the data returned in the DTA (disk transfer area) is actually the
        drive number (or extended FCB header and drive number) followed by
        the file's directory entry (see #01352); this format happens to be
        compatible with an unopened FCB
      for extended FCBs with search attribute 08h, the volume label (if any)
        will be returned even if the current directory is not the root dir.
      DOS 3.0+ also allows the '*' wildcard
      the search FCB at DS:DX must not be modified if AH=12h will be used to
        continue searching; DOS 3.3 has set the following parts of the FCB:
               0Ch    BYTE    ???
               0Dh    WORD    directory entry number of matching file
               0Fh    WORD    cluster number of current directory
               11h  4 BYTEs   ???
               15h    BYTE    drive number (1=A:)
      this function is used by many copy protection schemes to obtain the
        starting cluster of a file

BUG: under Windows95, if a .EXE program (“MZ” header) rather than a true

        .COM calls this function from a DOS box, the ten bytes of the
        directory entry from 0Ch to 15h may be filled with zeros rather than
        the additional file times

Format of DOS directory entry: Offset Size Description (Table 01352) 00h 8 BYTEs blank-padded filename

              first character is set to E5h for deleted files (05h for
                pending delete files under Novell DOS / OpenDOS)

08h 3 BYTEs blank-padded file extension 0Bh BYTE attributes 0Ch 10 BYTEs (MS-DOS 1.0-6.22) reserved

              (DR DOS) used to store file password / owner (see #01354)
                      (see also INT 21/AX=4302h)
              (Novell DOS 7) DELWATCH data (see #01354)
              (MS-DOS 7/Windows95) additional file times (see #01353)

16h WORD time of creation or last update (see #01665 at AX=5700h) 18h WORD date of creation or last update (see #01666 at AX=5700h) 1Ah WORD starting cluster number (see also AX=440Dh/CX=0871h)

              (may not be set in INT 21/AH=11h return data for FAT32 drives)

1Ch DWORD file size SeeAlso: #01355,#02628,#02629

Format of MS-DOS 7/Windows95 additional file times: Offset Size Description (Table 01353) 00h BYTE reserved 01h BYTE 10-millisecond units past creation time below 02h WORD file creation time 04h WORD file creation date 06h WORD last-access date 08h WORD (FAT32) high word of starting cluster number Note: this data is stored beginning at offset 0Ch in a standard directory

        entry

SeeAlso: #01352

Format of DR DOS 6/Novell DOS 7 additional file information: Offset Size Description (Table 01354) 0Ch BYTE reserved (00h)

              (DOSPLUS v1.2) user-defined attributes for CP/M compatibility
                (bit 7 = F1,...,bit 4 = F4, bits 3-0 reserved (0))

0Dh BYTE first character of original filename for deleted file 0Eh WORD encrypted file/directory password 10h WORD reserved (00h)

              (Novell DOS 7 DELWATCH) original file time
                  cleared when file is undeleted or purged

12h WORD (DR DOS 6) file owner ID

              (Novell DOS 7 DELWATCH) original file date
                  cleared when file is undeleted or purged

14h WORD single/multiuser file/directory access rights (see AX=4302h) —deleted files— 16h WORD (Novell DOS 7 DELWATCH) time of deletion 18h WORD (Novell DOS 7 DELWATCH) date of deletion Note: offsets are within the full directory entry SeeAlso: #01352

Format of MS-DOS 7/Windows95 long-filename directory entry: Offset Size Description (Table 01355) 00h BYTE LFN record sequence and flags

              bits 5-0: sequence number
              bit 6: set if last long-filename record for file
              bit 7: set if file deleted

01h 10 BYTEs long filename, first part 0Bh BYTE 0Fh (otherwise impossible file attribute, used as signature) 0Ch BYTE reserved??? (00h) 0Dh BYTE checksum for short filename 0Eh 12 BYTEs long filename, second part 1Ah WORD first cluster number (always 0000h for LFN records) 1Ch 4 BYTEs long filename, third part Notes: long-filename entries are always stored in the directory just prior

        to the short-name entry for a file
      multiple LFN records are used if the long filename does not fit into
        a single record
      the short-filename checksum byte is computed by adding up the
        eleven bytes of the short filename, rotating the intermediate
        sum right one bit before adding the next character
      the long filename is encoded as 16-bit Unicode characters; for most
        filenames, this appears in the directory as the ASCII character
        followed by 00h

SeeAlso: #01352,INT 21/AX=5704h,INT 21/AH=71h

SeeAlso: AH=12h,AH=1Ah,AH=4Eh,INT 2F/AX=111Bh

Text based on Ralf Brown Interrupt List Release 61