1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
.TH FCAT "1" "Dec 2013" "FCAT" "Output the contents of a file based on its name"
.\" Text automatically generated by txt2man
.SH NAME
\fBfcat \fP- Output the contents of a file based on its name.
.SH SYNOPSIS
.nf
.fam C
\fBfcat\fP [\fB-hRsvV\fP] [\fB-f\fP \fIfstype\fP] [\fB-i\fP \fIimgtype\fP] [\fB-o\fP \fIimgoffset\fP] [\fB-b\fP \fIdev_sector_size\fP] \fIpath_of_file\fP \fIimage\fP [\fIimages\fP]
.fam T
.fi
.fam T
.fi
.SH DESCRIPTION
\fBfcat\fP opens the named \fBimage\fP(s) and copies the file at the path \fIpath_of_file\fP to standard output.
.SH ARGUMENTS
.TP
.B
\fB-f\fP \fIfstype\fP
Specifies the file system type. Use \fB-f\fP 'list' to list the supported file system types. If not given,
autodetection methods are used.
.TP
.B
\fB-h\fP
Skip over holes in sparse files, so that absolute address information is lost. This option saves
space when copying sparse files.
.TP
.B
\fB-R\fP
Suppress errors if a deleted file is being recovered.
.TP
.B
\fB-s\fP
Include the slack space in the output.
.TP
.B
\fB-i\fP \fIimgtype\fP
Identify the type of \fIimage\fP file, such as raw. Use '\fB-i\fP list' to list the supported types. If not given,
autodetection methods are used.
.TP
.B
\fB-o\fP \fIimgoffset\fP
The sector offset where the file system starts in the \fIimage\fP.
.TP
.B
\fB-b\fP \fIdev_sector_size\fP
The size, in bytes, of the underlying device sectors. If not given, the value in the \fIimage\fP
format is used (if it exists) or 512-bytes is assumed.
.TP
.B
\fB-v\fP
Enable verbose mode, output to stderr.
.TP
.B
\fB-V\fP
Display version
.TP
.B
\fIimage\fP [\fIimages\fP]
The disk or partition \fIimage\fP to read, whose format is given with '\fB-i\fP'. Multiple \fIimage\fP file names can
be given if the \fIimage\fP is split into multiple segments. If only one \fIimage\fP file is given, and its name
is the first in a sequence (e.g., as indicated by ending in ’.001’), subsequent \fIimage\fP segments will
be included automatically.
.TP
.B
\fIpath_of_file\fP
Path of file to extract the contents of. Surround the path in quotes if there is a space in a file or
directory name. Use forward slashes.
.SH AUTHOR
The Sleuth Kit was written by Brian Carrier <carrier@sleuthkit.org>.
.PP
This manual page was written by Joao Eriberto Mota Filho <eriberto@debian.org> for the Debian project (but may be used by others).
|
