|
|
| (One intermediate revision by one user not shown) |
| Line 1: |
Line 1: |
| − | ==icat==
| + | Back to [[Help Documents]] |
| − | Version 2.09<br />
| + | |
| − | This software is distributed under the IBM Public License found on the [[Licenses]] page.
| + | |
| | | | |
| − | ===Purpose===
| + | icat outputs the contents of a file in a disk image to STDOUT. It is similar to cat on a local file, but it takes a meta data structure address as input instead of a file name. |
| − | Opens the named image(s) and copies the file with the specified inode number to standard output.
| + | |
| | | | |
| − | ===Usage===
| + | * [http://www.sleuthkit.org/sleuthkit/man/icat.html Automatically Updated man Page] |
| − | icat [-hrsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] inode
| + | |
| − | | + | |
| − | ===Options===
| + | |
| − | | + | |
| − | {| border="1" cellpadding="5"
| + | |
| − | !Switch
| + | |
| − | !Purpose
| + | |
| − | |-
| + | |
| − | | -f fstype || Specifies the file system type. Use the -? argument to view all supported types. If not given, the default type for the platform is used.
| + | |
| − | |-
| + | |
| − | | -h || Skip over holes in sparse files, so that absolute address information is lost. This option saves space when copying sparse files.
| + | |
| − | |-
| + | |
| − | | -r || Use file recovery techniques if the file is deleted.
| + | |
| − | |-
| + | |
| − | | -s || Include the slack space in the output.
| + | |
| − | |-
| + | |
| − | | -i imgtype || Identify the type of image file, such as raw or split. Raw is the default.
| + | |
| − | |-
| + | |
| − | | -o imgoffset || The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using ’@’ (32@2048).
| + | |
| − | |-
| + | |
| − | | -v || Enable verbose mode, output to stderr.
| + | |
| − | |-
| + | |
| − | | -V || Display version
| + | |
| − | |-
| + | |
| − | | image [images] || One (or more if split) disk or partition images whose format is given with ’-i’.
| + | |
| − | |-
| + | |
| − | | inode || Inode number. icat concatenates the contents of all specified files.
| + | |
| − | |}
| + | |
| − | | + | |
| − | ===Example===
| + | |
| − | ''No examples available.''
| + | |
| − | | + | |
| − | ===History===
| + | |
| − | First appeared in The Coroners Toolkit (TCT) 1.0 and is now in The Sleuth Kit.
| + | |
| − | | + | |
| − | ===Author===
| + | |
| − | Wietse Venema
| + | |
| − | IBM T.J. Watson Research
| + | |
| − | P.O. Box 704
| + | |
| − | Yorktown Heights, NY 10598, USA
| + | |
| − | | + | |
| − | This version is maintained by Brian Carrier (carrier@sleuthkit.org).
| + | |
icat outputs the contents of a file in a disk image to STDOUT. It is similar to cat on a local file, but it takes a meta data structure address as input instead of a file name.
