ICAT(1)

💖 ICAT(1) 💖

okay bestie, gather round, because we're about to talk about icat from the General Commands Manual (section 1, the big leagues 💅). she's a little command with big main character energy and honestly? iconic.

✨ NAME ✨

icat — Output the contents of a file based on its inode number.

like. she reads a file by its inode number and just... spits it out. no drama, no crumbs, just bytes. periodt. 👑

🌸 SYNOPSIS 🌸

icat [-hrsvV] [-f fstype ] [-i imgtype ] [-o imgoffset ] [-b
dev_sector_size] image [images] inode

look at her. compact. efficient. a whole vibe. 🦋

💫 DESCRIPTION 💫

So basically: icat opens the image(s) you named and copies the file with the inode number you specified straight to standard output. that's it. that's the whole thing. she opens, she finds, she streams. lowkey flawless. ✨

🎀 ARGUMENTS 🎀

• -f fstype — tells her which file system type you're working with. wanna see your options? use -f list and she'll list every supported file system type for you, bestie. if you don't give her one, she'll just use autodetection methods. she's smart like that. 🙈
• -h — skips over holes in sparse files, which means absolute address information is lost. that's the tradeoff, no cap. but it saves space when you're copying sparse files, so it's giving budget-friendly. 💸
• -r — pulls out the file recovery techniques if the file is deleted. she can bring things back. resurrection era. 🔥
• -s — includes the slack space in the output. yes, all of it. she's thorough. 💅
• -i imgtype — identifies the type of image file, like raw. use -i list to see all the supported types. if you skip this, autodetection methods kick in. again: she's smart. 🌈
• -o imgoffset — the sector offset where the file system starts in the image. tell her where the party begins. 🎉
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't tell her, she uses the value in the image format (if it exists) or just assumes 512-bytes. default queen behavior. 👑
• -v — enables verbose mode, and she outputs to stderr. she will literally tell you everything. not me loving a chatty command. 😭
• -V — displays version. quick lil flex. ⭐
• image [images] — the disk or partition image to read, whose format is given with -i. you can hand her multiple image file names if the image is split into multiple segments. and here's the cute part: if you only give her one image file and its name is the first in a sequence (e.g., as indicated by ending in .001), the subsequent image segments will be included automatically. she just knows. 🫶
• inode — the inode number. and heads up: icat concatenates the contents of all specified files. all of them. together. 💜

🌟 LICENSE 🌟

this software is distributed under the IBM Public License. read it, respect it, love her. 🎀

🦋 HISTORY 🦋

she first appeared in The Coroners Toolkit (TCT) 1.0 and is now in The Sleuth Kit. glow up of the century honestly. ✨

👑 AUTHOR(S) 👑

Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA

this version is maintained by Brian Carrier (carrier at sleuthkit at org).

send documentation updates to <doc-updates at sleuthkit dot org> 💌

and that's the tea, bestie 🍓 — this was the ICAT(1) page, straight out of the General Commands Manual for The Sleuth Kit. go forth and read those inodes. slay. 💖✨🦋