JCAT(1)

💫 JCAT(1) — the journal block peeking page 💫

okay bestie, so this is jcat, from the General Commands Manual — yes, the same iconic family as all your other sleuthkit faves. it's giving "let me show you inside the file system journal" and honestly? obsessed. 🦋

✨ NAME ✨

jcat — show the contents of a block in the file system journal. that's it, that's the whole job, and she does it flawlessly. 💅

🌸 SYNOPSIS 🌸

jcat [-f fstype ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
image [images] ] [ inode ] jblk

no cap, that's the exact shape of it — flags first, then your image(s), then optionally an inode, then the journal block. 🎀

👑 DESCRIPTION 👑

jcat shows the contents of a journal block in the file system journal. literally its whole main character moment. ✨

you can either hand it the inode address of the journal yourself, or just vibe and let the default location be used — either way works. ⚠️ important though: the block address you pass is a journal block address, not a file system block address. don't mix those up bestie, they are not the same thing and the universe will humble you. 😭

the raw output goes straight to STDOUT. no filter, no garnish, just the raw goods. periodt. 💖

💖 ARGUMENTS 💖

• -f fstype — tell her which file system type you're working with. run -f list to get the whole lineup of supported file system types. if you don't say anything, autodetection methods are used and she'll just figure it out herself. 🧚
• -i imgtype — identify the type of image file, like raw. use -i list to see all the supported types. skip it and again, autodetection methods are used. she's perceptive like that. 🌸
• -o imgoffset — the sector offset where the file system starts inside the image. lowkey essential when your fs is not sitting right at the front. 📍
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't give it, the value in the image format gets used (if it exists), or otherwise 512-bytes is assumed. no biggie either way. ⭐
• -V — display version. quick little flex. 💅
• -v — verbose output. she will tell you everything and honestly? love that for us. 🗣️
• image [images] — the disk or partition image to read, whose format you declare with -i. you can pass multiple image file names if the image is split into multiple segments. and here's the cute part: if you only give one image file, and its name is the first in a sequence (e.g., as indicated by ending in .001), the subsequent image segments will be included automatically. she just knows. ✨
• [inode] — the inode where the file system journal can be found. optional, but sometimes you gotta be specific. 🎀
• jblk — the journal block to display. this is the moment. the whole point. the reason we're here. 🔥

🌈 EXAMPLES 🌈

here's the vibe, bestie:

jcat -f linux-ext3 img.dd 34 | xxd

that's jcat reading journal block 34 out of img.dd (a linux-ext3 file system) and piping it into xxd so it's actually readable instead of a wall of raw bytes. iconic combo, no notes. 💜

🫶 AUTHOR 🫶

Brian Carrier <carrier at sleuthkit dot org> — king behavior, we stan. 👑

and pls pls pls send documentation updates to <doc-updates at sleuthkit dot org> — they genuinely want them, fr fr. 💖

and that's the whole page!! thanks for coming to my ted talk, this was JCAT(1) from the General Commands Manual. go peek at some journal blocks responsibly bestie, ily, bye!! 💅✨🦋🎀