BLKLS(1)

💖 BLKLS — bestie's guide to listing file system data units 💖

okay so this is blkls from the General Commands Manual, section 1, and it is literally the tool that digs through your disk image and hands you back raw file system data units (aka blocks). she's an icon, she's a classic, and she's about to make your forensic life so much easier. let's gooo ✨

✨ SYNOPSIS ✨

blkls [-aAelsvV] [-f fstype ] [-i imgtype ] [-o imgoffset ] [-b
dev_sector_size] image [images] [start-stop]

like yes bestie, that's a lot of flags, but we're gonna go through every single one, no skips, no cap. 🫶

🌸 DESCRIPTION 🌸

blkls opens up the image (or images!! plural!!) you name and copies file system data units — the blocks, babe. 💅

by default, blkls copies the contents of unallocated data blocks. that's the default vibe.

quick lore drop because iykyk: blkls was called dls in TSK versions prior to 3.0.0, and before that it was called unrm in TCT. so if you see those names floating around in old docs, that's her. glow-up complete. 👑

🎀 ARGUMENTS 🎀

• -e — copy every block, including the file system metadata blocks. the output is the entire file system. literally all of it, no crumbs left.
• -a — display all allocated blocks. (heads up: this is the same as -e if -A is also given 👀)
• -A — display all unallocated blocks. (also same as -e if -a is also given — these two are besties fr). this is the default behavior. ⭐
• -f fstype — specifies the file system type. use -f list to list the supported file system types. if you don't give it, autodetection methods are used. she'll figure it out herself, she's smart like that. 🧚
• -i imgtype — identify the type of image file, such as raw. use -i list to list the supported types. if you don't give it, autodetection methods are used. again, she's got it. ✨
• -o imgoffset — the sector offset where the file system starts in the image. basically telling her "bestie, the actual party starts over here." 🎯
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't give it, the value in the image format is used (if it exists) or 512-bytes is assumed. so like, 512 is the fallback fit. 💅
• -l — list the data information in time machine format. yes it's giving time travel, we love a themed output. 🕰️
• -s — copy only the slack space of the image. the in-between bits. the secret little gaps. 🙈
• -v — turn on verbose mode, output to stderr. she will talk to you. a lot. and it goes to stderr, so pipe accordingly bestie. 🗣️
• -V — display version. quick little "hi, here's who i am." 👋
• image [images] — the disk or partition image to read, whose format is given with -i. multiple image file names can be given if the image is split into multiple segments. if only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in .001), subsequent image segments will be included automatically. auto-gluing the split parts together?? obsessed. 💖
• start-stop ... — examine the specified block number or number range. pick your faves, or a whole lil range of them. 🍓

ngl the -a/-A/-e combo is the thing people get tripped up on — re-read it, because they literally overlap with each other. no skimming bestie, this is the whole point of the flag. 😭

👑 LICENSE 👑

this software is distributed under the IBM Public License. periodt. legal girlies, that's your section.

🌈 HISTORY 🌈

first appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema). now maintained by Brian Carrier <carrier at sleuthkit dot org>. 👑

send documentation updates to <doc-updates at sleuthkit dot org> — she loves feedback, don't be shy. 💌

and that's the whole page bestie!! this came out of the General Commands Manual, section 1, footer sitting there saying BLKLS(1) right back at you like a little mirror. now go copy some blocks, you absolute main character. 💅✨🦋🌸💖