1BLKCAT(1)                   General Commands Manual                  BLKCAT(1)
2
3
4

NAME

6       blkcat - Display the contents of file system data unit in a disk image.
7

SYNOPSIS

9       blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset]
10       [-b dev_sector_size] image [images] unit_addr [num]
11
12

DESCRIPTION

14       blkcat displays num data units (default is one) starting  at  the  unit
15       address unit_addr from image to stdout in different formats (default is
16       raw).  blkcat was called dcat in TSK versions prior to 3.0.0.
17
18

ARGUMENTS

20       -a     Display the contents in ASCII
21
22       -f fstype
23              Specify image as a specific file type.  If 'swap' is given here,
24              the  image  will  be  displayed in pages of size 4096 bytes.  If
25              'raw' is given, then 512-bytes is used as the default size.  The
26              '-u'  flag  can  change the default size.  Use '-f list' to list
27              the supported file system types.  If  not  given,  autodetection
28              methods are used.
29
30       -h     Display the contents in hexdump
31
32       -s     Display  statistics  on  the  image (unit size, file block size,
33              and number of fragments).
34
35       -u unit_size
36              Specify the size of the default data unit for  raw,  blkls,  and
37              swap images.
38
39       -i imgtype
40              Identify  the type of image file, such as raw.  Use '-i list' to
41              list the supported types.  If not given,  autodetection  methods
42              are used.
43
44       -o imgoffset
45              The sector offset where the file system starts in the image.
46
47       -b dev_sector_size
48              The  size,  in  bytes, of the underlying device sectors.  If not
49              given, the value in the image format is used (if it  exists)  or
50              512-bytes is assumed.
51
52       -v     Verbose output to stderr.
53
54       -V     Display version.
55
56       -w     Display the contents in an HTML table format.
57
58       image [images]
59              The  disk or partition image to read, whose format is given with
60              '-i'.  Multiple image file names can be given if  the  image  is
61              split  into multiple segments.  If only one image file is given,
62              and its name is the first in a sequence (e.g., as  indicated  by
63              ending  in  '.001'),  subsequent image segments will be included
64              automatically.
65
66       unit_addr
67              Address of the disk unit to display.  The size of a unit on this
68              file system can be determined using the -s option.
69
70       num    Number of data units to display.
71
72
73       The  basic  functionality  of blkcat can also be achieved using dd.  To
74       determine which inode has allocated a given unit, the ifind(1)  command
75       can be used.
76
77

EXAMPLES

79       # blkcat -hw image 264 4
80
81       or
82
83       # blkcat -hw image 264
84
85

SEE ALSO

87       ifind(1)
88
89

AUTHOR

91       Brian Carrier <carrier at sleuthkit dot org>
92
93       Send documentation updates to <doc-updates at sleuthkit dot org>
94
95
96
97                                                                     BLKCAT(1)