1JCAT(1) General Commands Manual JCAT(1)
2
3
4
6 jcat - Show the contents of a block in the file system journal.
7
9 jcat [-f fstype ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sec‐
10 tor_size] image [images] ] [ inode ] jblk
11
12
14 jcat shows the contents of a journal block in the file system journal.
15 The inode address of the journal can be given or the default location
16 will be used. Note that the block address is a journal block address
17 and not a file system block. The raw output is given to STDOUT.
18
19
21 -f fstype
22 Specify the file system type. Use '-f list' to list the sup‐
23 ported file system types. If not given, autodetection methods
24 are used.
25
26 -i imgtype
27 Identify the type of image file, such as raw or split. Use '-i
28 list' to list the supported types. If not given, autodetection
29 methods are used.
30
31 -o imgoffset
32 The sector offset where the file system starts in the image.
33
34 -b dev_sector_size
35 The size, in bytes, of the underlying device sectors. If not
36 given, the value in the image format is used (if it exists) or
37 512-bytes is assumed.
38
39 -V Display version
40
41 -v verbose output
42
43 image [images]
44 One (or more if split) disk or partition images whose format is
45 given with '-i'.
46
47 [inode]
48 The inode where the file system journal can be found.
49
50
51 jblk The journal block to display.
52
53
55 jcat -f linux-ext3 img.dd 34 | xxd
56
57
59 Brian Carrier <carrier at sleuthkit dot org>
60
61 Send documentation updates to <doc-updates at sleuthkit dot org>
62
63
64
65 JCAT(1)