Provided by: sleuthkit_2.52-1_i386 bug

NAME

       dls - disk data recovery

SYNOPSIS

       dls  [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images]
       [start-stop]

DESCRIPTION

       dls opens the named image(s) and copies data blocks (disk  units).   By
       default,  dls  copies  unallocated data blocks (addressable disk units)
       only.  dls was called unrm in TCT.

       Arguments:

       -b     With file systems that  have  logical  blocks  that  consist  of
              fragments,  don’t  insert  null-byte padding to preserve logical
              block alignment in the output.  This option is a no-op with  the
              LINUX  ext2fs  file  system,  where logical blocks and fragments
              have the same size.

       -e     Copy every block. The output should be similar to dd(1).

       -a     Display all allocated blocks (same as -e if -A is also given).

       -A     Display all unallocated blocks (same as -e if -a is also given).
              This is the default behavior.

       -f fstype
              Specifies the file system type.   Use the -? argument for a list
              of all supported types.  If not given, the default type for  the
              platform is used.

       -i imgtype
              Identify  the  type of image file, such as raw or split.  Raw is
              the default.

       -o imgoffset
              The sector offset where the file system  starts  in  the  image.
              Non-512 byte sectors can be specified using ’@’ (32@2048).

       -l     List the data information in time machine format.

       -s     Copy only the slack space of the image.

       -v     Turn on verbose mode, output to stderr.

       -V     Display version.

       image [images]
              One  (or more if split) disk or partition images whose format is
              given with ’-i’.

       start-stop ...
              Examine the specified block number or number range.

LICENSE

       This software is distributed under the IBM Public License.

HISTORY

       First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema).  Now
       maintained by Brian Carrier <carrier@sleuthkit.org>.