1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
.\" Process this file with
.\" groff -man -Tascii foo.1
.\"
.TH DCALC 1 "JAN 2005" "User Manuals"
.SH NAME
dcalc \- Converts between unallocated disk unit numbers and regular
disk unit numbers.
.SH SYNOPSIS
.B dcalc
[-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-f fstype] image [images]
.SH DESCRIPTION
.B dcalc
creates a disk unit number mapping between two images, one normal and
another that only contains the unallocated units of the first (the
default behavior of the
.B dls(1)
program). One of the
.B -d, -s,
or
.B -u
options must be given. If the
.B -d
option is given, then the
.B unit_addr
value is the disk unit address in the regular image (i.e. from
.B dd(1)
).
If the unit is unallocated, its address in an unallocated image
is given. If the
.B -u
option is given, then the
.B unit_addr
value is the disk unit address in the unallocated unit image (i.e.
from
.B dls(1)
). Its disk unit address in the original image is determined. If the
.B -s
option is given, then the
.B unit_addr
value is the disk unit address in the slack image (i.e. from dls -s).
The
.B image
is the full, original image (i.e. from dd(1)).
.IP "-f fstype"
Identify the File System type of the image. Use the -? argument for a
list of supported file system types.
If not given, the default type for the platform is used.
.IP "-i imgtype"
Identify the type of image file, such as raw or split. Raw is the default.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048)
.IP -v
Verbose output to STDERR.
.IP -V
Display version.
.PP
This is useful when using
.B lazarus
or keyword searching an image generated by
.B dls.
This allows one to identify the original unit address and provides
better documentation.
.SH EXAMPLE
# dcalc -u 64 images/wd0e
.SH "SEE ALSO"
.BR dd (1),
.BR dls (1),
.BR lazarus (1)
.SH HISTORY
.BR "dcalc" " first appeared in " "TCTUTILs" " v1.01. as " "blockcalc."
.SH AUTHOR
Brian Carrier <carrier@sleuthkit.org>
|
