1ICAT(1)                     General Commands Manual                    ICAT(1)
2
3
4

NAME

6       icat - Output the contents of a file based on its inode number.
7

SYNOPSIS

9       icat  [-hrsvV]  [-f fstype ] [-i imgtype ] [-o imgoffset ] [-b dev_sec‐
10       tor_size] image [images] inode
11

DESCRIPTION

13       icat opens the named image(s) and copies the file  with  the  specified
14       inode number to standard output.
15
16

ARGUMENTS

18       -f fstype
19              Specifies  the file system type.  Use '-f list' to list the sup‐
20              ported file system types.  If not given,  autodetection  methods
21              are used.
22
23       -h     Skip over holes in sparse files, so that absolute address infor‐
24              mation is lost. This option  saves  space  when  copying  sparse
25              files.
26
27       -r     Use file recovery techniques if the file is deleted.
28
29       -s     Include the slack space in the output.
30
31       -i imgtype
32              Identify  the type of image file, such as raw.  Use '-i list' to
33              list the supported types.  If not given,  autodetection  methods
34              are used.
35
36       -o imgoffset
37              The sector offset where the file system starts in the image.
38
39       -b dev_sector_size
40              The  size,  in  bytes, of the underlying device sectors.  If not
41              given, the value in the image format is used (if it  exists)  or
42              512-bytes is assumed.
43
44       -v     Enable verbose mode, output to stderr.
45
46       -V     Display version
47
48       image [images]
49              The  disk or partition image to read, whose format is given with
50              '-i'.  Multiple image file names can be given if  the  image  is
51              split  into multiple segments.  If only one image file is given,
52              and its name is the first in a sequence (e.g., as  indicated  by
53              ending  in  '.001'),  subsequent image segments will be included
54              automatically.
55
56       inode  Inode number. icat concatenates the contents  of  all  specified
57              files.
58
59

LICENSE

61       This software is distributed under the IBM Public License.
62

HISTORY

64       First  appeared  in  The  Coroners  Toolkit (TCT) 1.0 and is now in The
65       Sleuth Kit.
66

AUTHOR(S)

68       Wietse Venema IBM T.J. Watson Research P.O. Box 704  Yorktown  Heights,
69       NY 10598, USA
70
71       This  version  is  maintained by Brian Carrier (carrier at sleuthkit at
72       org).
73
74       Send documentation updates to <doc-updates at sleuthkit dot org>
75
76
77
78                                                                       ICAT(1)
Impressum