Difference between revisions of "Blkls"

From SleuthKitWiki
Jump to: navigation, search
m (Reformatted)
(Added data units link)
 
(3 intermediate revisions by one user not shown)
Line 1: Line 1:
 
Back to [[Help Documents]]
 
Back to [[Help Documents]]
  
==dls==
 
Version 2.09
 
  
 +
blkls lists details about file system [[data unit]]s.  In its default mode, it outputs the unallocated data unit contents to STDOUT.  It can also list the details about which are allocated and which are not. It used to be called dls.
  
===Purpose===
+
* [http://www.sleuthkit.org/sleuthkit/man/blkls.html Automatically Updated man Page]
Opens the named image(s) and copies data blocks (disk units). By default, dls copies unallocated data blocks (addressable disk units) only. dls was called unrm in TCT.
+
 
+
 
+
===Usage===
+
dls [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] [start-stop]
+
 
+
 
+
===Options===
+
 
+
{| border="1" cellpadding="5"
+
!Switch
+
!Purpose
+
|-
+
|-b || With file systems that have logical blocks that consist of fragments, don’t insert null-byte padding to preserve logical block alignment in the output. This option is a no-op with the LINUX ext2fs file system, where logical blocks and fragments have the same size.
+
|-
+
| -e || Copy every block. The output should be similar to dd(1).
+
|-
+
| -a || Display all allocated blocks (same as -e if -A is also given).
+
|-
+
| -A || Display all unallocated blocks (same as -e if -a is also given). This is the default behavior.
+
|-
+
| -f fstype || Specifies the file system type. Use the -? argument for a list of all supported types. If not given, the default type for the platform is used.
+
|-
+
| -i imgtype || Identify the type of image file, such as raw or split. Raw is the default.
+
|-
+
| -o imgoffset || The sector offset where the file system starts in the image.  Non-512 byte sectors can be specified using ’@’ (32@2048).
+
|-
+
| -l || List the data information in time machine format.
+
|-
+
| -s || Copy only the slack space of the image.
+
|-
+
| -v || Turn on verbose mode, output to stderr.
+
|-
+
| -V || Display version.
+
|}
+
 
+
 
+
===Example===
+
''No example given.''
+
 
+
 
+
===History===
+
First appeared in The Coroners Toolkit (TCT) 1.0.
+
<br />This software is distributed under the IBM Public License which can be found on the [[Licenses]] page.
+
 
+
 
+
===Author===
+
Wietse Venema
+
Now maintained by Brian Carrier <carrier@sleuthkit.org>
+

Latest revision as of 07:49, 4 January 2010

Back to Help Documents


blkls lists details about file system data units. In its default mode, it outputs the unallocated data unit contents to STDOUT. It can also list the details about which are allocated and which are not. It used to be called dls.