1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
.TH BLKCAT 1
.SH NAME
blkcat \- Display the contents of file system data unit in a disk image.
.SH SYNOPSIS
.B blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
.I image [images] unit_addr [num]
.SH DESCRIPTION
.B blkcat
displays
.B num
data units (default is one) starting at the unit address
.B unit_addr
from
.B image
to stdout in different formats (default is raw).
.B blkcat
was called
.B dcat
in TSK versions prior to 3.0.0.
.SH ARGUMENTS
.IP -a
Display the contents in ASCII
.IP "-f fstype"
Specify image as a specific file type. If 'swap' is given
here, the image will be displayed in pages of size 4096 bytes. If 'raw'
is given, then 512-bytes is used as the default size. The '\-u' flag
can change the default size.
Use '\-f list' to list the supported file system types.
If not given, autodetection methods are used.
.IP -h
Display the contents in hexdump
.IP -s
Display statistics on the image (unit size, file block size, \
and number of fragments).
.IP "-u unit_size"
Specify the size of the default data unit for raw, blkls, and swap
images.
.IP "-i imgtype"
Identify the type of image file, such as raw.
Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image.
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output to stderr.
.IP -V
Display version.
.IP -w
Display the contents in an HTML table format.
.IP "image [images]"
The disk or partition image to read, whose format is given with '\-i'.
Multiple image file names can be given if the image is split into multiple segments.
If only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in '.001'), subsequent image segments will be included automatically.
.IP unit_addr
Address of the disk unit to display. The size of a unit on this
file system can be determined using the \-s option.
.IP num
Number of data units to display.
.PP
The basic functionality of
.B blkcat
can also be achieved using
.BR dd.
To determine which inode has allocated
a given unit, the
.BR ifind(1)
command can be used.
.SH EXAMPLES
# blkcat \-hw image 264 4
or
# blkcat \-hw image 264
.SH "SEE ALSO"
.BR ifind (1)
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
|
