1MMLS(1)                     General Commands Manual                    MMLS(1)
2
3
4

NAME

6       mmls  -  Display  the  partition  layout of a volume system  (partition
7       tables)
8

SYNOPSIS

10       mmls [-t mmtype ] [-o offset ] [  -i  imgtype  ]  [-b  dev_sector_size]
11       [-BrvV] [-aAmM] image [images]
12

DESCRIPTION

14       mmls  displays  the  layout of the partitions in a volume system, which
15       include partition tables and disk labels.
16
17

ARGUMENTS

19       -t mmtype
20              Specify the media management type.  Use '-t list'  to  list  the
21              supported types. If not given, autodetection methods are used.
22
23       -o offset
24              Specify  the  offset  into the image where the volume containing
25              the partition system starts.  The relative offset of the  parti‐
26              tion system will be added to this value.
27
28       -b dev_sector_size
29              The  size,  in  bytes, of the underlying device sectors.  If not
30              given, the value in the image format is used (if it  exists)  or
31              512-bytes is assumed.
32
33       -i imgtype
34              Identify  the  type of image file, such as raw or split.  If not
35              given, autodetection methods are used.
36
37       -B     Include a column with the partition sizes in bytes
38
39       -r     Recurse into DOS partitions and look for other partition tables.
40              This  setup frequently occurs when Unix is installed on x86 sys‐
41              tems.
42
43       -v     Verbose output of debugging statements to stderr
44
45       -V     Display version
46
47       -a     Show allocated volumes
48
49       -A     Show unallocated volumes
50
51       -m     Show metadata volumes
52
53       -M     Hide metadata volumes
54
55       image [images]
56              One (or more if split) disk images whose format  is  given  with
57              '-i'.
58
59
60       ´mmls´  is  similar  to  'fdisk  -lu'  in Linux with a few differences.
61       Namely, it will show which sectors are not being used so that those can
62       be searched for hidden data.  It also gives the length value so that it
63       can be plugged into 'dd' more easily for extracting the partitions.  It
64       also will show BSD disk labels for Free, Open, and NetBSD and will dis‐
65       play the output in sectors and not cylinders.  Lastly, it works on non-
66       Linux systems.
67
68       If  none  of  -a, -A, -m, or -M are given then all volume types will be
69       listed.  If any of them are given, then only the types specified on the
70       command line will be listed.
71
72       Allocated volumes are those that are listed in a partition table in the
73       volume system AND can store data.  Unallocated  volumes  are  virtually
74       created  by mmls to show you which sectors have not been allocated to a
75       volume.  The metadata volumes overlap  the  allocated  and  unallocated
76       volumes  and  describe  where  the  partition tables and other metadata
77       structures are located.  In some volume systems, these  structures  are
78       in  allocated  space  and  in others they are in unallocated space.  In
79       some volume systems, their location is explicitly given in  the  parti‐
80       tion tables and in others they are not.
81
82

EXAMPLES

84       To list the partition table of a Windows system using autodetect:
85
86       # mmls disk_image.dd
87
88       To  list  the contents of a BSD system that starts in sector 12345 of a
89       split image:
90
91       # mmls -t bsd -o 12345 -i split disk-1.dd disk-2.dd
92
93

AUTHOR

95       Brian Carrier <carrier at sleuthkit dot org>
96
97
98
99                                                                       MMLS(1)
Impressum