Difference between revisions of "Blkcalc"

From SleuthKitWiki
Jump to: navigation, search
m (Dcalc moved to Blkcalc: Changed tool name.)
Line 1: Line 1:
 
Back to [[Help Documents]]
 
Back to [[Help Documents]]
  
dcalc is used to map between the output of [[Dls]] and the original file system blocks. dls can be used to extract the  unallocated blocks from a file system.  Once data is found in the unallocated data though, you may want to know where the data was in the original file system.  dcalc is used for that.
+
blkcalc is used to map between the output of [[blkls]] and the original file system blocks. blkls can be used to extract the  unallocated blocks from a file system.  Once data is found in the unallocated data though, you may want to know where the data was in the original file system.  blkcalc is used for that. blkcalc used to be called dcalc.
  
* [http://www.sleuthkit.org/sleuthkit/man/dcalc.html Automatically Updated man Page]
+
* [http://www.sleuthkit.org/sleuthkit/man/blkcalc.html Automatically Updated man Page]

Revision as of 16:05, 19 October 2008

Back to Help Documents

blkcalc is used to map between the output of blkls and the original file system blocks. blkls can be used to extract the unallocated blocks from a file system. Once data is found in the unallocated data though, you may want to know where the data was in the original file system. blkcalc is used for that. blkcalc used to be called dcalc.