NAME

       blkcat - Display the contents of file system data unit in a disk image.

SYNOPSIS

       blkcat  [-ahswvV]  [-f  fstype]  [-u  unit_size]  [-i  imgtype] [-o imgoffset] [-b dev_sector_size] image
       [images] unit_addr [num]

DESCRIPTION

       blkcat displays num data units (default is one) starting at the unit  address  unit_addr  from  image  to
       stdout in different formats (default is raw).  blkcat was called dcat in TSK versions prior to 3.0.0.

ARGUMENTS

       -a     Display the contents in ASCII

       -f fstype
              Specify  image  as  a specific file type.  If 'swap' is given here, the image will be displayed in
              pages of size 4096 bytes.  If 'raw' is given, then 512-bytes is used as  the  default  size.   The
              '-u' flag can change the default size.  Use '-f list' to list the supported file system types.  If
              not given, autodetection methods are used.

       -h     Display the contents in hexdump

       -s     Display statistics on the image (unit size, file block size,  and number of fragments).

       -u unit_size
              Specify the size of the default data unit for raw, blkls, and swap images.

       -i imgtype
              Identify  the type of image file, such as raw.  Use '-i list' to list the supported types.  If not
              given, autodetection methods are used.

       -o imgoffset
              The sector offset where the file system starts in the image.

       -b dev_sector_size
              The size, in bytes, of the underlying device sectors.  If not given, the value in the image format
              is used (if it exists) or 512-bytes is assumed.

       -v     Verbose output to stderr.

       -V     Display version.

       -w     Display the contents in an HTML table format.

       image [images]
              The disk or partition image to read, whose format is given with '-i'.  Multiple image  file  names
              can  be  given if the image is split into multiple segments.  If only one image file is given, and
              its name is the first in a sequence (e.g., as indicated by ending  in  '.001'),  subsequent  image
              segments will be included automatically.

       unit_addr
              Address  of  the  disk  unit to display.  The size of a unit on this file system can be determined
              using the -s option.

       num    Number of data units to display.

       The basic functionality of blkcat can also be achieved using dd.  To determine which inode has  allocated
       a given unit, the ifind(1) command can be used.

EXAMPLES

       # blkcat -hw image 264 4

       or

       # blkcat -hw image 264

SEE ALSO

       ifind(1)

AUTHOR

       Brian Carrier <carrier at sleuthkit dot org>

       Send documentation updates to <doc-updates at sleuthkit dot org>

                                                                                                       BLKCAT(1)