Icat

Version 2.09 Man Page

NAME

      icat - copy files by inode number

SYNOPSIS

      icat  [-hrsvV]  [-f  fstype] [-i imgtype] [-o imgoffset] image [images]
      inode

DESCRIPTION

      icat opens the named image(s) and copies the file  with  the  specified
      inode number to standard output.

      Arguments:

      -f fstype
             Specifies the file system type.  Use the -? argument to view all
             supported types.  If not given, the default type for  the  plat-
             form is used.

      -h     Skip over holes in sparse files, so that absolute address infor-
             mation is lost. This option  saves  space  when  copying  sparse
             files.

      -r     Use file recovery techniques if the file is deleted.

      -s     Include the slack space in the output.

      -i imgtype
             Identify  the  type of image file, such as raw or split.  Raw is
             the default.

      -o imgoffset
             The sector offset where the file system  starts  in  the  image.
             Non-512 byte sectors can be specified using ’@’ (32@2048).

      -v     Enable verbose mode, output to stderr.

      -V     Display version

      image [images]
             One  (or more if split) disk or partition images whose format is
             given with ’-i’.

      inode  Inode number. icat concatenates the contents  of  all  specified
             files.

LICENSE

      This software is distributed under the IBM Public License.

HISTORY

      First appeared in The Coroners Toolkit (TCT) 1.0 and is now in The
      Sleuth Kit.

AUTHOR(S)

      Wietse Venema
      IBM T.J. Watson Research
      P.O. Box 704
      Yorktown Heights, NY 10598, USA

      This version is maintained by Brian Carrier (carrier@sleuthkit.org).