IMG_CAT(1)

💖 IMG_CAT — the "let me see what's actually inside" girlie 💖

okay so bestie, welcome to the img_cat page from the General Commands Manual section — yes she's a section 1 icon, we love that for her 👑

✨ NAME ✨

img_cat — outputs the contents of an image file. that's it, that's the whole vibe. she spills the contents, no cap 🫗✨

🌸 SYNOPSIS 🌸

img_cat [-i imgtype] [-b dev_sector_size] [-s start_sector] [-e
stop_sector] [-vV] image [images]

look at her. compact. efficient. the way she fits on two lines because even the synopsis has main character energy 💅

🦋 DESCRIPTION 🦋

so like, img_cat outputs the contents of an image file. fr fr, that's the job.

here's the tea tho 🍓: image files that are not raw have embedded data and metadata. they're layered, they're complicated, they're giving mystery novel. and img_cat will output only the data. just the data. nothing but the data. she filters out the noise like a true queen 👑

why do we care? because this lets you do two very slay things:

• convert an embedded format to raw ✨ (glow-up, but for file formats)
• calculate the MD5 hash of the data by piping the output to the appropriate tool 🧚 (yes bestie, pipe it. the pipe is the moment.)

🎀 ARGUMENTS 🎀

• -i imgtype — tells her the type of image file we're dealing with, like raw or aff. wanna see your options? use -i list and she'll list every supported type like a little menu. if you don't give her anything, she just uses autodetection methods. independent. self-sufficient. she figures it out 💅
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't say anything, she uses the value that's in the image format (if it exists), or she just assumes 512 bytes. default queen behavior 🙈
• -s start_sector — the sector number to start at. pick your starting point bestie, it's your story 🦋
• -e stop_sector — the sector number to stop at. know when to leave the party 💀
• -v — verbose output of debugging statements to stderr. she'll be yapping about what she's doing, but only on the side channel 🗣️
• -V — display version. know her name, know her number 🎀
• image [images] — the disk or partition image to read, whose format is given with -i. you can hand her multiple image file names if the image is split into multiple segments (she can hold more than one, she's versatile ✨). and here's the iconic part: if you only give her one image file, and its name is the first in a sequence (e.g., as indicated by ending in .001), then subsequent image segments will be included automatically. she finds the rest of the family herself, no directions needed 🫶

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org>

Send documentation updates to <doc-updates at sleuthkit dot org>

(if you find a typo, tell the docs girlies, they're so nice, they'll fix it 🌈)

💜 cute sign-off 💜

and that's the whole page bestie!! this one lives in the General Commands Manual for IMG_CAT(1) — go forth, convert those embedded formats to raw, pipe things into MD5, and remember: only the data, never the metadata. periodt. 💅✨🎀