Difference between revisions of "Blkcalc"

From SleuthKitWiki
Jump to: navigation, search
(New page: Version 2.09 Man Page NAME dcalc - Converts between unallocated disk unit numbers and regular disk unit numbers. SYNOPSIS dcalc [-dsu unit_addr] [-vV] [-i imgtype] [...)
 
m
Line 1: Line 1:
Version 2.09 Man Page
+
Back to [[Help Documents]]
  
NAME
+
==dcalc==
      dcalc - Converts between unallocated disk unit numbers and regular disk
+
Version 2.09
      unit numbers.
+
  
SYNOPSIS
 
      dcalc [-dsu unit_addr] [-vV] [-i imgtype] [-o  imgoffset]  [-f  fstype]
 
      image [images]
 
  
DESCRIPTION
+
===Purpose===
      dcalc creates a disk unit number mapping between two images, one normal
+
dcalc creates a disk unit number mapping between two images, one normal and another that only contains the unallocated units of the first (the default behavior of the dls(1) program). One of the -d, -s, or -u value is the disk unit address in the regular image (i.e. from dd(1) ). If the unit is unallocated, its address in an unallocated image is given. If the -u option is given, then the unit_addr value is the disk unit address in the unallocated unit image (i.e. from dls(1) ). Its disk unit address in the original image is determined. If the -s option is given, then the unit_addr value is the disk unit address in the slack image (i.e. from dls -s). The image is the full, original image (i.e. from dd(1)).
      and another that only contains the unallocated units of the first (the
+
      default behavior of the dls(1) program). One of the -d, -s, or -u
+
      options must be given.  If the -d option is given, then  the  unit_addr
+
      value is the disk unit address in the regular image (i.e. from dd(1) ).
+
      If the unit is unallocated, its address in an unallocated image is
+
      given. If the -u option is given, then the unit_addr value is the disk
+
      unit address in the unallocated unit image (i.e. from dls(1) ).   Its
+
      disk unit address in the original image is determined. If the -s
+
      option is given, then the unit_addr value is the disk unit address in
+
      the slack image (i.e. from dls -s). The image is the full, original
+
      image (i.e. from dd(1)).
+
  
      -f fstype
 
              Identify the File System type of the image.  Use the -? argument
 
              for  a  list  of supported file system types.  If not given, the
 
              default type for the platform is used.
 
  
      -i imgtype
+
===Usage===
              Identify the type of image file, such as raw or split.  Raw  is
+
dcalc [-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-f fstype] image [images]
              the default.
+
  
      -o imgoffset
 
              The  sector  offset  where  the file system starts in the image.
 
              Non-512 byte sectors can be specified using ’@’ (32@2048)
 
  
      -v    Verbose output to STDERR.
+
===Options===
  
      -V     Display version.
+
{| border="1" cellpadding="5"
 +
!Switch
 +
!Purpose
 +
|-
 +
| -f fstype || Identify the File System type of the image. Use the -? argument for a list of supported file system types. If not given, the default type for the platform is used.
 +
|-
 +
| -i imgtype || Identify the type of image file, such as raw or split. Raw is the default.
 +
|-
 +
| -o imgoffset || The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using ’@’ (32@2048)
 +
|-
 +
| -v || Verbose output to STDERR.
 +
|-
 +
| -V || Display version.
 +
|}
  
      This is useful when using lazarus or keyword searching an image  gener-
 
      ated by dls.  This allows one to identify the original unit address and
 
      provides better documentation.
 
  
EXAMPLE
+
===Example===
      # dcalc -u 64 images/wd0e
+
# dcalc -u 64 images/wd0e
  
SEE ALSO
 
      dd(1), dls(1), lazarus(1)
 
  
HISTORY
+
===History===
      dcalc first appeared in TCTUTILs v1.01. as blockcalc.
+
dcalc first appeared in TCTUTILs v1.01. as blockcalc.
  
AUTHOR
+
 
      Brian Carrier <carrier@sleuthkit.org>
+
===Author===
 +
Brian Carrier <carrier@sleuthkit.org>

Revision as of 04:13, 18 November 2007

Back to Help Documents

dcalc

Version 2.09


Purpose

dcalc creates a disk unit number mapping between two images, one normal and another that only contains the unallocated units of the first (the default behavior of the dls(1) program). One of the -d, -s, or -u value is the disk unit address in the regular image (i.e. from dd(1) ).  If the unit is unallocated, its address in an unallocated image is given. If the -u option is given, then the unit_addr value is the disk unit address in the unallocated unit image (i.e. from dls(1) ). Its disk unit address in the original image is determined. If the -s option is given, then the unit_addr value is the disk unit address in the slack image (i.e. from dls -s). The image is the full, original image (i.e. from dd(1)).


Usage

dcalc [-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-f fstype] image [images]


Options

Switch Purpose
-f fstype Identify the File System type of the image. Use the -? argument for a list of supported file system types. If not given, the default type for the platform is used.
-i imgtype Identify the type of image file, such as raw or split. Raw is the default.
-o imgoffset The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using ’@’ (32@2048)
-v Verbose output to STDERR.
-V Display version.


Example

# dcalc -u 64 images/wd0e


History

dcalc first appeared in TCTUTILs v1.01. as blockcalc.


Author

Brian Carrier <carrier@sleuthkit.org>