1BLKLS(1)                    General Commands Manual                   BLKLS(1)
2
3
4

NAME

6       blkls - List or output file system data units.
7

SYNOPSIS

9       blkls  [-aAelsvV]  [-f  fstype  ]  [-i  imgtype  ]  [-o imgoffset ] [-b
10       dev_sector_size] image [images] [start-stop]
11
12

DESCRIPTION

14       blkls opens the named  image(s)  and  copies  file  system  data  units
15       (blocks).   By  default,  blkls copies the contents of unallocated data
16       blocks.  blkls was called dls in TSK versions prior  to  3.0.0.   blkls
17       was called unrm in TCT.
18
19

ARGUMENTS

21       -e     Copy  every  block,  including  file system metadata blocks. The
22              output is the entire file system.
23
24       -a     Display all allocated blocks (same as -e if -A is also given).
25
26       -A     Display all unallocated blocks (same as -e if -a is also given).
27              This is the default behavior.
28
29       -f fstype
30              Specifies  the file system type.  Use '-f list' to list the sup‐
31              ported file system types.  If not given,  autodetection  methods
32              are used.
33
34       -i imgtype
35              Identify  the type of image file, such as raw.  Use '-i list' to
36              list the supported types.  If not given,  autodetection  methods
37              are used.
38
39       -o imgoffset
40              The sector offset where the file system starts in the image.
41
42       -b dev_sector_size
43              The  size,  in  bytes, of the underlying device sectors.  If not
44              given, the value in the image format is used (if it  exists)  or
45              512-bytes is assumed.
46
47       -l     List the data information in time machine format.
48
49       -s     Copy only the slack space of the image.
50
51       -v     Turn on verbose mode, output to stderr.
52
53       -V     Display version.
54
55       image [images]
56              The  disk or partition image to read, whose format is given with
57              '-i'.  Multiple image file names can be given if  the  image  is
58              split  into multiple segments.  If only one image file is given,
59              and its name is the first in a sequence (e.g., as  indicated  by
60              ending  in  '.001'),  subsequent image segments will be included
61              automatically.
62
63       start-stop ...
64              Examine the specified block number or number range.
65

LICENSE

67       This software is distributed under the IBM Public License.
68

HISTORY

70       First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema).   Now
71       maintained by Brian Carrier <carrier at sleuthkit dot org>.
72
73       Send documentation updates to <doc-updates at sleuthkit dot org>
74
75
76
77                                                                      BLKLS(1)
Impressum