BLKCALC(1)

💖 BLKCALC(1) 💖

okay bestie, gather round, because this is blkcalc from the General Commands Manual, and she is lowkey the translator of the Unix world 🫶

✨ NAME ✨

blkcalc — the girl who converts between unallocated disk unit numbers and regular disk unit numbers. it's giving bilingual icon 💅

🌸 SYNOPSIS 🌸

blkcalc [-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-f fstype] image [images]

🦋 DESCRIPTION 🦋

so here's the vibe: blkcalc creates a disk unit number mapping between two images — one normal, and another one that only contains the unallocated units of the first (that second one is literally the default behavior of the blkls(1) program, no cap). 🎀

⚠️ bestie listen. One of the -d, -s, or -u options must be given. not optional. periodt.

here's how the three main character options work:

• if -d is given, then the unit_addr value is the disk unit address in the regular image (i.e. from dd). and if the unit is unallocated, its address in an unallocated image is given. 💫
• if -u is given, then the unit_addr value is the disk unit address in the unallocated unit image (i.e. from blkls(1)). its disk unit address in the original image is determined. ✨
• if -s is given, then the unit_addr value is the disk unit address in the slack image (i.e. from blkls -s). the image is the full, original image (i.e. from dd). 🌈

also, tiny lore drop for the historians in the chat: blkcalc was called dcalc in TSK versions prior to 3.0.0. glow-up behavior fr fr 👑

💅 OPTIONS 💅

• -f fstype — identify the File System type of the image. use '-f list' to list the supported file system types. if you don't give it, autodetection methods are used. she'll figure it out herself, she's smart 💜
• -i imgtype — identify the type of image file, such as raw. use '-i list' to list the supported types. if not given, autodetection methods are used. 🍓
• -o imgoffset — the sector offset where the file system starts in the image. 🎀
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if not given, the value in the image format is used (if it exists), or 512-bytes is assumed. default queen 💖
• -v — Verbose output to STDERR. she will tell you everything, and honestly? we love that 🌸
• -V — Display version. gotta know which era of her we're dealing with ⭐
• image [images] — the disk or partition image to read, whose format is given with '-i'. multiple image file names can be given if the image is split into multiple segments. if only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in '.001'), subsequent image segments will be included automatically. she just knows 😭🫶

this is useful when keyword searching an image generated by blkls. it allows one to identify the original unit address and provides better documentation. like, receipts. we love receipts. 🔥

🌟 EXAMPLE 🌟

# blkcalc -u 64 images/wd0e

look at her go 💀✨

👑 SEE ALSO 👑

blkls(1),

🧚 AUTHOR 🧚

Brian Carrier <carrier at sleuthkit dot org>

send documentation updates to <doc-updates at sleuthkit dot org> 💌

and that's the whole page, bestie — this was BLKCALC(1) from the General Commands Manual, mwah 💋 stay iconic, go map some disk units 🦋💖