BLKCAT(1)

💖 BLKCAT 💖

okay bestie, sit down, hydrate, because we're about to read raw disk units together and it's gonna be adorable. this is blkcat, a General Commands Manual girlie from section 1, and she's here to show you what's actually inside your disk image, one data unit at a time. no cap. 🎀

✨ NAME ✨

blkcat — display the contents of a file system data unit in a disk image. yes literally just. showing you the vibes of one unit. iconic. 💅

🌸 SYNOPSIS 🌸

blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset]
[-b dev_sector_size] image [images] unit_addr [num]

🦋 DESCRIPTION 🦋

so here's the tea: blkcat displays num data units (default is one, just one, a lil single unit, she's low maintenance) starting at the unit address unit_addr from image, and it dumps all of that to stdout in different formats — default is raw. like, no fancy packaging, just the raw truth. ✨

fun lore drop: blkcat was called dcat in TSK versions prior to 3.0.0. so if you're reading ancient docs, that's her old name. glow-up era. 👑

🎀 ARGUMENTS 🎀

• -a — display the contents in ASCII. cute, readable, letters and everything. 💖
• -f fstype — specify image as a specific file type, like you're telling her "bestie, i already know what this is." if swap is given here, the image will be displayed in pages of size 4096 bytes. if raw is given, then 512-bytes is used as the default size. and psst — the -u flag can change that default size. use -f list to list the supported file system types. if you don't give this at all, autodetection methods are used. she'll figure it out herself, she's smart. 🧚
• -h — display the contents in hexdump. hex girlies rise. 🔥
• -s — display statistics on the image: unit size, file block size, and number of fragments. the receipts. the numbers. the data. 📊
• -u unit_size — specify the size of the default data unit for raw, blkls, and swap images.
• -i imgtype — identify the type of image file, such as raw. use -i list to list the supported types. if not given, autodetection methods are used. again — she's got it, she'll clock it herself. 💅
• -o imgoffset — the sector offset where the file system starts in the image. like, where does the actual party begin inside this image. 🎉
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if not given, the value in the image format is used (if it exists) or 512-bytes is assumed. assumed! she's guessing! (well, defaulting. same energy.) 🙈
• -v — verbose output to stderr. she'll yap. affectionately.
• -V — display version. say hi to her properly. 👑
• -w — display the contents in an HTML table format. she can do web design too apparently. 🌈
• image [images] — the disk or partition image to read, whose format is given with -i. multiple image file names can be given if the image is split into multiple segments. and here's the cute part: if only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in .001), subsequent image segments will be included automatically. she just knows to bring her friends. 🫶
• unit_addr — address of the disk unit to display. the size of a unit on this file system can be determined using the -s option. so if you're confused, run -s first, bestie, that's the vibe check. ⭐
• num — number of data units to display.

side note fr fr: the basic functionality of blkcat can also be achieved using dd. and to determine which inode has allocated a given unit, the ifind(1) command can be used. crossover episode. 😭

💜 EXAMPLES 💜

# blkcat -hw image 264 4

or

# blkcat -hw image 264

🔥 SEE ALSO 🔥

• ifind(1)

🌟 AUTHOR 🌟

Brian Carrier <carrier at sleuthkit dot org>

Send documentation updates to <doc-updates at sleuthkit dot org>

and that's the whole page, bestie!! 💖 this manual page lives in the General Commands Manual, section 1, and it signs off the exact same way it came in — BLKCAT(1). go read a disk image, you absolute main character. periodt. 🎀✨💅