1ICAT(1)                     General Commands Manual                    ICAT(1)
2
3
4

NAME

6       icat - Output the contents of a file based on its inode number.
7

SYNOPSIS

9       icat  [-hrsvV]  [-f fstype ] [-i imgtype ] [-o imgoffset ] [-b dev_sec‐
10       tor_size] image [images] inode
11

DESCRIPTION

13       icat opens the named image(s) and copies the file  with  the  specified
14       inode number to standard output.
15
16

ARGUMENTS

18       -f fstype
19              Specifies  the file system type.  Use '-f list' to list the sup‐
20              ported file system types.  If not given,  autodetection  methods
21              are used.
22
23       -h     Skip over holes in sparse files, so that absolute address infor‐
24              mation is lost. This option  saves  space  when  copying  sparse
25              files.
26
27       -r     Use file recovery techniques if the file is deleted.
28
29       -s     Include the slack space in the output.
30
31       -i imgtype
32              Identify  the type of image file, such as raw or split.  Use '-i
33              list' to list the supported types.  If not given,  autodetection
34              methods are used.
35
36       -o imgoffset
37              The sector offset where the file system starts in the image.
38
39       -b dev_sector_size
40              The  size,  in  bytes, of the underlying device sectors.  If not
41              given, the value in the image format is used (if it  exists)  or
42              512-bytes is assumed.
43
44       -v     Enable verbose mode, output to stderr.
45
46       -V     Display version
47
48       image [images]
49              One  (or more if split) disk or partition images whose format is
50              given with '-i'.
51
52       inode  Inode number. icat concatenates the contents  of  all  specified
53              files.
54

LICENSE

56       This software is distributed under the IBM Public License.
57

HISTORY

59       First  appeared  in  The  Coroners  Toolkit (TCT) 1.0 and is now in The
60       Sleuth Kit.
61

AUTHOR(S)

63       Wietse Venema IBM T.J. Watson Research P.O. Box 704  Yorktown  Heights,
64       NY 10598, USA
65
66       This  version  is  maintained by Brian Carrier (carrier at sleuthkit at
67       org).
68
69       Send documentation updates to <doc-updates at sleuthkit dot org>
70
71
72
73                                                                       ICAT(1)
Impressum