Man page or keyword search:   man All Sections 1 - General Commands 2 - System Calls 3 - Subroutines, Functions 4 - Special Files 5 - File Formats 6 - Games and Screensavers 7 - Macros and Conventions 8 - Maintenence Commands 9 - Kernel Interface New Commands Server 4.4BSD AIX Alpinelinux Archlinux Aros BSDOS BSDi Bifrost CentOS Cygwin Darwin Debian DigitalUNIX DragonFly ElementaryOS Fedora FreeBSD Gentoo GhostBSD HP-UX Haiku Hurd IRIX Inferno JazzOS Kali Knoppix LinuxMint MacOSX Mageia Mandriva Manjaro Minix MirBSD NeXTSTEP NetBSD OPENSTEP OSF1 OpenBSD OpenDarwin OpenIndiana OpenMandriva OpenServer OpenSuSE OpenVMS Oracle PC-BSD Peanut Pidora Plan9 QNX Raspbian RedHat Scientific Slackware SmartOS Solaris SuSE SunOS Syllable Tru64 UNIXv7 Ubuntu Ultrix UnixWare Xenix YellowDog aLinux   44335 pages apropos Keyword Search (all sections) Output format html ascii pdf view pdf save postscript

BLKCAT(1)							     BLKCAT(1)

NAME
       blkcat - Display the contents of file system data unit in a disk image.

SYNOPSIS
       blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset]
       [-b dev_sector_size] image [images] unit_addr [num]

DESCRIPTION
       blkcat displays num data units (default is one) starting	 at  the  unit
       address unit_addr from image to stdout in different formats (default is
       raw).  blkcat was called dcat in TSK versions prior to 3.0.0.

ARGUMENTS
       -a     Display the contents in ASCII

       -f fstype
	      Specify image as a specific file type.  If 'swap' is given here,
	      the  image  will	be  displayed in pages of size 4096 bytes.  If
	      'raw' is given, then 512-bytes is used as the default size.  The
	      '-u'  flag  can  change the default size.	 Use '-f list' to list
	      the supported file system types.	If  not	 given,	 autodetection
	      methods are used.

       -h     Display the contents in hexdump

       -s     Display  statistics  on  the  image (unit size, file block size,
	      and number of fragments).

       -u unit_size
	      Specify the size of the default data unit for  raw,  blkls,  and
	      swap images.

       -i imgtype
	      Identify	the type of image file, such as raw.  Use '-i list' to
	      list the supported types.	 If not given,	autodetection  methods
	      are used.

       -o imgoffset
	      The sector offset where the file system starts in the image.

       -b dev_sector_size
	      The  size,  in  bytes, of the underlying device sectors.	If not
	      given, the value in the image format is used (if it  exists)  or
	      512-bytes is assumed.

       -v     Verbose output to stderr.

       -V     Display version.

       -w     Display the contents in an HTML table format.

       image [images]
	      The  disk or partition image to read, whose format is given with
	      '-i'.  Multiple image file names can be given if	the  image  is
	      split  into multiple segments.  If only one image file is given,
	      and its name is the first in a sequence (e.g., as	 indicated  by
	      ending  in  '.001'),  subsequent image segments will be included
	      automatically.

       unit_addr
	      Address of the disk unit to display.  The size of a unit on this
	      file system can be determined using the -s option.

       num    Number of data units to display.

       The  basic  functionality  of blkcat can also be achieved using dd.  To
       determine which inode has allocated a given unit, the ifind(1)  command
       can be used.

EXAMPLES
       # blkcat -hw image 264 4

       or

       # blkcat -hw image 264

SEE ALSO
       ifind(1)

AUTHOR
       Brian Carrier <carrier at sleuthkit dot org>

       Send documentation updates to <doc-updates at sleuthkit dot org>

								     BLKCAT(1)

Vote for polarhome