From SleuthKitWiki
Revision as of 06:50, 4 January 2010 by Carrier (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Back to Help Documents

blkcalc is used to map between the output of blkls and the original file system data units. blkls can be used to extract the unallocated data units from a file system. Once data is found in the unallocated data though, you may want to know where the data was in the original file system. blkcalc is used for that. blkcalc used to be called dcalc.