Man Linux: Main Page and Category List


       blkcat - Display the contents of file system data unit in a disk image.


       blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset]
       [-b dev_sector_size] image [images] unit_addr [num]


       blkcat  displays  num  data units (default is one) starting at the unit
       address unit_addr from image to stdout in different formats (default is
       raw).  blkcat was called dcat in TSK versions prior to 3.0.0.


       -a     Display the contents in ASCII

       -f fstype
              Specify image as a specific file type.  If ’swap’ is given here,
              the image will be displayed in pages of  size  4096  bytes.   If
              ’raw’ is given, then 512-bytes is used as the default size.  The
              ’-u’ flag can change the default size.  Use ’-f  list’  to  list
              the  supported  file  system types.  If not given, autodetection
              methods are used.

       -h     Display the contents in hexdump

       -s     Display statistics on the image (unit  size,  file  block  size,
              and number of fragments).

       -u unit_size
              Specify  the  size  of the default data unit for raw, blkls, and
              swap images.

       -i imgtype
              Identify the type of image file, such as raw or split.  Use  ’-i
              list’  to list the supported types.  If not given, autodetection
              methods are used.

       -o imgoffset
              The sector offset where the file system starts in the image.

       -b dev_sector_size
              The size, in bytes, of the underlying device  sectors.   If  not
              given,  the  value in the image format is used (if it exists) or
              512-bytes is assumed.

       -v     Verbose output to stderr.

       -V     Display version.

       -w     Display the contents in an HTML table format.

       image [images]
              One (or more if split) disk or partition images whose format  is
              given with ’-i’.

              Address of the disk unit to display.  The size of a unit on this
              file system can be determined using the -s option.

       num    Number of data units to display.

       The basic functionality of blkcat can also be achieved  using  dd.   To
       determine  which inode has allocated a given unit, the ifind(1) command
       can be used.


       # blkcat -hw image 264 4


       # blkcat -hw image 264




       Brian Carrier <carrier at sleuthkit dot org>

       Send documentation updates to <doc-updates at sleuthkit dot org>