1BLKCAT(1)                   General Commands Manual                  BLKCAT(1)
2
3
4

NAME

6       blkcat - Display the contents of file system data unit in a disk image.
7

SYNOPSIS

9       blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset]
10       [-b dev_sector_size] image [images] unit_addr [num]
11
12

DESCRIPTION

14       blkcat displays num data units (default is one) starting  at  the  unit
15       address unit_addr from image to stdout in different formats (default is
16       raw).  blkcat was called dcat in TSK versions prior to 3.0.0.
17
18

ARGUMENTS

20       -a     Display the contents in ASCII
21
22       -f fstype
23              Specify image as a specific file type.  If 'swap' is given here,
24              the  image  will  be  displayed in pages of size 4096 bytes.  If
25              'raw' is given, then 512-bytes is used as the default size.  The
26              '-u'  flag  can  change the default size.  Use '-f list' to list
27              the supported file system types.  If  not  given,  autodetection
28              methods are used.
29
30       -h     Display the contents in hexdump
31
32       -s     Display  statistics  on  the  image (unit size, file block size,
33              and number of fragments).
34
35       -u unit_size
36              Specify the size of the default data unit for  raw,  blkls,  and
37              swap images.
38
39       -i imgtype
40              Identify  the type of image file, such as raw or split.  Use '-i
41              list' to list the supported types.  If not given,  autodetection
42              methods are used.
43
44       -o imgoffset
45              The sector offset where the file system starts in the image.
46
47       -b dev_sector_size
48              The  size,  in  bytes, of the underlying device sectors.  If not
49              given, the value in the image format is used (if it  exists)  or
50              512-bytes is assumed.
51
52       -v     Verbose output to stderr.
53
54       -V     Display version.
55
56       -w     Display the contents in an HTML table format.
57
58       image [images]
59              One  (or more if split) disk or partition images whose format is
60              given with '-i'.
61
62       unit_addr
63              Address of the disk unit to display.  The size of a unit on this
64              file system can be determined using the -s option.
65
66       num    Number of data units to display.
67
68
69       The  basic  functionality  of blkcat can also be achieved using dd.  To
70       determine which inode has allocated a given unit, the ifind(1)  command
71       can be used.
72
73

EXAMPLES

75       # blkcat -hw image 264 4
76
77       or
78
79       # blkcat -hw image 264
80
81

SEE ALSO

83       ifind(1)
84
85

AUTHOR

87       Brian Carrier <carrier at sleuthkit dot org>
88
89       Send documentation updates to <doc-updates at sleuthkit dot org>
90
91
92
93                                                                     BLKCAT(1)