Man page or keyword search:   man All Sections 1 - General Commands 2 - System Calls 3 - Subroutines, Functions 4 - Special Files 5 - File Formats 6 - Games and Screensavers 7 - Macros and Conventions 8 - Maintenence Commands 9 - Kernel Interface New Commands Server 4.4BSD AIX Alpinelinux Archlinux Aros BSDOS BSDi Bifrost CentOS Cygwin Darwin Debian DigitalUNIX DragonFly ElementaryOS Fedora FreeBSD Gentoo GhostBSD HP-UX Haiku Hurd IRIX Inferno JazzOS Kali Knoppix LinuxMint MacOSX Mageia Mandriva Manjaro Minix MirBSD NeXTSTEP NetBSD OPENSTEP OSF1 OpenBSD OpenDarwin OpenIndiana OpenMandriva OpenServer OpenSuSE OpenVMS Oracle PC-BSD Peanut Pidora Plan9 QNX Raspbian RedHat Scientific Slackware SmartOS Solaris SuSE SunOS Syllable Tru64 UNIXv7 Ubuntu Ultrix UnixWare Xenix YellowDog aLinux   9211 pages apropos Keyword Search (all sections) Output format html ascii pdf view pdf save postscript

BLKLS(1)							      BLKLS(1)

NAME
       blkls - List or output file system data units.

SYNOPSIS
       blkls  [-aAelsvV]  [-f  fstype  ]  [-i  imgtype	]  [-o imgoffset ] [-b
       dev_sector_size] image [images] [start-stop]

DESCRIPTION
       blkls opens the named  image(s)	and  copies  file  system  data	 units
       (blocks).   By  default,	 blkls copies the contents of unallocated data
       blocks.	blkls was called dls in TSK versions prior  to	3.0.0.	 blkls
       was called unrm in TCT.

ARGUMENTS
       -e     Copy  every  block,  including  file system metadata blocks. The
	      output is the entire file system.

       -a     Display all allocated blocks (same as -e if -A is also given).

       -A     Display all unallocated blocks (same as -e if -a is also given).
	      This is the default behavior.

       -f fstype
	      Specifies	 the file system type.	Use '-f list' to list the sup‐
	      ported file system types.	 If not given,	autodetection  methods
	      are used.

       -i imgtype
	      Identify	the type of image file, such as raw.  Use '-i list' to
	      list the supported types.	 If not given,	autodetection  methods
	      are used.

       -o imgoffset
	      The sector offset where the file system starts in the image.

       -b dev_sector_size
	      The  size,  in  bytes, of the underlying device sectors.	If not
	      given, the value in the image format is used (if it  exists)  or
	      512-bytes is assumed.

       -l     List the data information in time machine format.

       -s     Copy only the slack space of the image.

       -v     Turn on verbose mode, output to stderr.

       -V     Display version.

       image [images]
	      The  disk or partition image to read, whose format is given with
	      '-i'.  Multiple image file names can be given if	the  image  is
	      split  into multiple segments.  If only one image file is given,
	      and its name is the first in a sequence (e.g., as	 indicated  by
	      ending  in  '.001'),  subsequent image segments will be included
	      automatically.

       start-stop ...
	      Examine the specified block number or number range.

LICENSE
       This software is distributed under the IBM Public License.

HISTORY
       First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema).   Now
       maintained by Brian Carrier <carrier at sleuthkit dot org>.

       Send documentation updates to <doc-updates at sleuthkit dot org>

								      BLKLS(1)

Vote for polarhome