Difference between revisions of "Icat"

From SleuthKitWiki
Jump to: navigation, search
(New page: Version 2.09 Man Page NAME icat - copy files by inode number SYNOPSIS icat [-hrsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] inode DESCRIPTION ...)
 
(Added link to man page.)
 
(3 intermediate revisions by one user not shown)
Line 1: Line 1:
Version 2.09 Man Page
+
Back to [[Help Documents]]
  
NAME
+
icat outputs the contents of a file in a disk image to STDOUT.  It is similar to cat on a local file, but it takes a meta data structure address as input instead of a file name.
      icat - copy files by inode number
+
  
SYNOPSIS
+
* [http://www.sleuthkit.org/sleuthkit/man/icat.html Automatically Updated man Page]
      icat  [-hrsvV]  [-f  fstype] [-i imgtype] [-o imgoffset] image [images]
+
      inode
+
 
+
DESCRIPTION
+
      icat opens the named image(s) and copies the file  with  the  specified
+
      inode number to standard output.
+
 
+
      Arguments:
+
 
+
      -f fstype
+
              Specifies the file system type. Use the -? argument to view all
+
              supported types.  If not given, the default type for  the  plat-
+
              form is used.
+
 
+
      -h    Skip over holes in sparse files, so that absolute address infor-
+
              mation is lost. This option  saves  space  when  copying  sparse
+
              files.
+
 
+
      -r    Use file recovery techniques if the file is deleted.
+
 
+
      -s    Include the slack space in the output.
+
 
+
      -i imgtype
+
              Identify  the  type of image file, such as raw or split.  Raw is
+
              the default.
+
 
+
      -o imgoffset
+
              The sector offset where the file system  starts  in  the  image.
+
              Non-512 byte sectors can be specified using ’@’ (32@2048).
+
 
+
      -v    Enable verbose mode, output to stderr.
+
 
+
      -V    Display version
+
 
+
      image [images]
+
              One  (or more if split) disk or partition images whose format is
+
              given with ’-i’.
+
 
+
      inode  Inode number. icat concatenates the contents  of  all  specified
+
              files.
+
 
+
LICENSE
+
      This software is distributed under the IBM Public License.
+
 
+
HISTORY
+
      First appeared in The Coroners Toolkit (TCT) 1.0 and is now in The
+
      Sleuth Kit.
+
 
+
AUTHOR(S)
+
      Wietse Venema
+
      IBM T.J. Watson Research
+
      P.O. Box 704
+
      Yorktown Heights, NY 10598, USA
+
 
+
      This version is maintained by Brian Carrier (carrier@sleuthkit.org).
+

Latest revision as of 18:20, 11 September 2008

Back to Help Documents

icat outputs the contents of a file in a disk image to STDOUT. It is similar to cat on a local file, but it takes a meta data structure address as input instead of a file name.