1MMCAT(1) General Commands Manual MMCAT(1)
2
3
4
6 mmcat - Output the contents of a partition to stdout
7
9 mmcat [-t mmtype ] [-o offset ] [ -i imgtype ] [-b dev_sector_size]
10 [-vV] image [images] part_num
11
13 mmcat outputs the contents of a specific volume to stdout. This allows
14 you to extract the contents of a partition to a separate file.
15
16
18 -t mmtype
19 Specify the media management type. Use '-t list' to list the
20 supported types. If not given, autodetection methods are used.
21
22 -o offset
23 Specify the offset into the image where the volume containing
24 the partition system starts. The relative offset of the parti‐
25 tion system will be added to this value.
26
27 -b dev_sector_size
28 The size, in bytes, of the underlying device sectors. If not
29 given, the value in the image format is used (if it exists) or
30 512-bytes is assumed.
31
32 -i imgtype
33 Identify the type of image file, such as raw. Use '-i list' to
34 list the supported types. If not given, autodetection methods
35 are used.
36
37 -v Verbose output of debugging statements to stderr
38
39 -V Display version
40
41 image [images]
42 The disk or partition image to read, whose format is given with
43 '-i'. Multiple image file names can be given if the image is
44 split into multiple segments. If only one image file is given,
45 and its name is the first in a sequence (e.g., as indicated by
46 ending in '.001'), subsequent image segments will be included
47 automatically.
48
49 part_num
50 Address of partition to process. See the mmls output to deter‐
51 mine the address of the partitions.
52
53
55 Brian Carrier <carrier at sleuthkit dot org>
56
57 Send documentation updates to <doc-updates at sleuthkit dot org>
58
59
60
61 MMCAT(1)