MMCAT(1)

💖 MMCAT(1) — General Commands Manual, but make it cute ✨

okay bestie, welcome to mmcat, section 1 of the General Commands Manual 🎀 this is the little tool that yoinks a partition out of an image and dumps it straight to your terminal's stdout, so you can save it as its own file. she's simple, she's powerful, she's iconic 💅

🌸 NAME 🌸

mmcat — output the contents of a partition to stdout 🦋

✨ SYNOPSIS ✨

mmcat [-t mmtype ] [-o offset ] [ -i imgtype ] [-b dev_sector_size]
[-vV] image [images] part_num

🫶 DESCRIPTION 🫶

so like, mmcat outputs the contents of a specific volume to stdout. that's it, that's the whole vibe ✨ and the reason you'd ever want that? so you can extract the contents of a partition into a separate file. literally a partition unboxing 🎁

👑 ARGUMENTS 👑

• -t mmtype — tell her the media management type. use -t list if you need to see all the supported types (she'll list them for you, no cap). if you don't give this, autodetection methods get used instead 👀
• -o offset — specify the offset into the image where the volume containing the partition system starts. the relative offset of the partition system gets added to this value, so it's math o'clock fr fr 🧮
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't give it, the value in the image format is used (if it exists) or 512-bytes is assumed. default queen behavior 💅
• -i imgtype — identify the type of image file, like raw. use -i list to list the supported types (yes she will list them, she loves a list 📋). if not given, autodetection methods are used.
• -v — verbose output of debugging statements to stderr. for when you need to see the behind-the-scenes drama 🙈
• -V — display version. short and sweet, she ate ⭐
• image [images] — the disk or partition image to read, whose format is given with -i. you can pass multiple image file names if the image is split into multiple segments. and here's the cute part: if you only give one image file and its name is the first in a sequence (e.g., as indicated by ending in .001), subsequent image segments will be included automatically. she just knows 🧚
• part_num — address of the partition to process. peep the mmls output to determine the address of the partitions, iykyk 🔥

💜 AUTHOR 💜

Brian Carrier <carrier at sleuthkit dot org> 👑

Send documentation updates to <doc-updates at sleuthkit dot org> 📬

and that's the whole page bestie 🎀 this was MMCAT(1) from the General Commands Manual — go forth, extract a partition, and slay 💖✨🦋