Difference between revisions of "Blkls"

From SleuthKitWiki
Jump to: navigation, search
(New page: Version 2.09 Man Page NAME dls - disk data recovery SYNOPSIS dls [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] [start-stop] DESCRIPTION ...)
 
m (Reformatted)
Line 1: Line 1:
−
Version 2.09 Man Page
+
Back to [[Help Documents]]
  
−
NAME
+
==dls==
−
      dls - disk data recovery
+
Version 2.09
  
−
SYNOPSIS
 
−
      dls  [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images]
 
−
      [start-stop]
 
  
−
DESCRIPTION
+
===Purpose===
−
      dls opens the named image(s) and copies data blocks (disk units).   By
+
Opens the named image(s) and copies data blocks (disk units). By default, dls copies unallocated data blocks (addressable disk units) only. dls was called unrm in TCT.
−
      default, dls copies unallocated data blocks (addressable disk units)
+
−
      only. dls was called unrm in TCT.
+
  
−
      Arguments:
 
  
−
      -b    With file systems that have logical blocks that consist of frag-
+
===Usage===
−
              ments,  don’t insert null-byte padding to preserve logical block
+
dls [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] [start-stop]
−
              alignment in the output.  This option is a no-op with the  LINUX
+
−
              ext2fs  file system, where logical blocks and fragments have the
+
−
              same size.
+
  
−
      -e    Copy every block. The output should be similar to dd(1).
 
  
−
      -a    Display all allocated blocks (same as -e if -A is also given).
+
===Options===
  
−
      -A     Display all unallocated blocks (same as -e if -a is also given).
+
{| border="1" cellpadding="5"
−
              This is the default behavior.
+
!Switch
 +
!Purpose
 +
|-
 +
|-b || With file systems that have logical blocks that consist of fragments, don’t insert null-byte padding to preserve logical block alignment in the output. This option is a no-op with the LINUX ext2fs file system, where logical blocks and fragments have the same size.
 +
|-
 +
| -e || Copy every block. The output should be similar to dd(1).
 +
|-
 +
| -a || Display all allocated blocks (same as -e if -A is also given).
 +
|-
 +
| -A || Display all unallocated blocks (same as -e if -a is also given). This is the default behavior.
 +
|-
 +
| -f fstype || Specifies the file system type. Use the -? argument for a list of all supported types. If not given, the default type for the platform is used.
 +
|-
 +
| -i imgtype || Identify the type of image file, such as raw or split. Raw is the default.
 +
|-
 +
| -o imgoffset || The sector offset where the file system starts in the image.  Non-512 byte sectors can be specified using ’@’ (32@2048).
 +
|-
 +
| -l || List the data information in time machine format.
 +
|-
 +
| -s || Copy only the slack space of the image.
 +
|-
 +
| -v || Turn on verbose mode, output to stderr.
 +
|-
 +
| -V || Display version.
 +
|}
  
−
      -f fstype
 
−
              Specifies the file system type.  Use the -? argument for a list
 
−
              of all supported types.  If not given, the default type for  the
 
−
              platform is used.
 
  
−
      -i imgtype
+
===Example===
−
              Identify  the  type of image file, such as raw or split.  Raw is
+
''No example given.''
−
              the default.
+
  
−
      -o imgoffset
 
−
              The sector offset where the file system  starts  in  the  image.
 
−
              Non-512 byte sectors can be specified using ’@’ (32@2048).
 
  
−
      -l    List the data information in time machine format.
+
===History===
 +
First appeared in The Coroners Toolkit (TCT) 1.0.
 +
<br />This software is distributed under the IBM Public License which can be found on the [[Licenses]] page.
  
−
      -s    Copy only the slack space of the image.
 
  
−
      -v    Turn on verbose mode, output to stderr.
+
===Author===
−
 
+
Wietse Venema
−
      -V    Display version.
+
Now maintained by Brian Carrier <carrier@sleuthkit.org>
−
 
+
−
      image [images]
+
−
              One  (or more if split) disk or partition images whose format is
+
−
              given with ’-i’.
+
−
 
+
−
      start-stop ...
+
−
              Examine the specified block number or number range.
+
−
 
+
−
LICENSE
+
−
      This software is distributed under the IBM Public License.
+
−
 
+
−
HISTORY
+
−
      First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema).  Now
+
−
      maintained by Brian Carrier <carrier@sleuthkit.org>.
+

Revision as of 04:34, 18 November 2007

Back to Help Documents

dls

Version 2.09


Purpose

Opens the named image(s) and copies data blocks (disk units). By default, dls copies unallocated data blocks (addressable disk units) only. dls was called unrm in TCT.


Usage

dls [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] [start-stop]


Options

Switch Purpose
-e Copy every block. The output should be similar to dd(1).
-a Display all allocated blocks (same as -e if -A is also given).
-A Display all unallocated blocks (same as -e if -a is also given). This is the default behavior.
-f fstype Specifies the file system type. Use the -? argument for a list of all supported types. If not given, the default type for the platform is used.
-i imgtype Identify the type of image file, such as raw or split. Raw is the default.
-o imgoffset The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using ’@’ (32@2048).
-l List the data information in time machine format.
-s Copy only the slack space of the image.
-v Turn on verbose mode, output to stderr.
-V Display version.


Example

No example given.


History

First appeared in The Coroners Toolkit (TCT) 1.0.
This software is distributed under the IBM Public License which can be found on the Licenses page.


Author

Wietse Venema Now maintained by Brian Carrier <carrier@sleuthkit.org>

Retrieved from "https://wiki.sleuthkit.org/index.php?title=Blkls&oldid=117"