1JCAT(1)                     General Commands Manual                    JCAT(1)
2
3
4

NAME

6       jcat - Show the contents of a block in the file system journal.
7

SYNOPSIS

9       jcat  [-f  fstype  ]  [-vV]  [-i  imgtype]  [-o imgoffset] [-b dev_sec‐
10       tor_size] image [images] ] [ inode ] jblk
11
12

DESCRIPTION

14       jcat shows the contents of a journal block in the file system  journal.
15       The  inode  address of the journal can be given or the default location
16       will be used.  Note that the block address is a journal  block  address
17       and not a file system block.  The raw output is given to STDOUT.
18
19

ARGUMENTS

21       -f fstype
22              Specify  the  file  system type.  Use '-f list' to list the sup‐
23              ported file system types. If not  given,  autodetection  methods
24              are used.
25
26       -i imgtype
27              Identify  the type of image file, such as raw or split.  Use '-i
28              list' to list the supported types. If not  given,  autodetection
29              methods are used.
30
31       -o imgoffset
32              The sector offset where the file system starts in the image.
33
34       -b dev_sector_size
35              The  size,  in  bytes, of the underlying device sectors.  If not
36              given, the value in the image format is used (if it  exists)  or
37              512-bytes is assumed.
38
39       -V     Display version
40
41       -v     verbose output
42
43       image [images]
44              One  (or more if split) disk or partition images whose format is
45              given with '-i'.
46
47       [inode]
48              The inode where the file system journal can be found.
49
50
51       jblk   The journal block to display.
52
53

EXAMPLES

55       jcat -f linux-ext3 img.dd 34 | xxd
56
57

AUTHOR

59       Brian Carrier <carrier at sleuthkit dot org>
60
61       Send documentation updates to <doc-updates at sleuthkit dot org>
62
63
64
65                                                                       JCAT(1)
Impressum