Table of Contents
dls - List or output file system data units.
dls [-aAbelsvV] [-f
fstype ] [-i imgtype ] [-o imgoffset ] image [images] [start-stop]
dls
opens the named image(s) and copies file system data units (blocks). By
default, dls copies the contents of unallocated data blocks. dls was
called unrm in TCT.
- -b
- With file systems that have logical blocks
that consist of fragments, don’t insert null-byte padding to preserve logical
block alignment in the output. This option is a no-op with the LINUX ext2fs
file system, where logical blocks and fragments have the same size.
- -e
- Copy
every block. The output should be similar to dd.
- -a
- Display all allocated blocks
(same as -e if -A is also given).
- -A
- Display all unallocated blocks (same as
-e if -a is also given). This is the default behavior.
- -f fstype
- Specifies the
file system type. Use ’-f list’ to list the supported file system types.
If not given, autodetection methods are used.
- -i imgtype
- Identify the type
of image file, such as raw or split. Use ’-i list’ to list the supported types.
If not given, autodetection methods are used.
- -o imgoffset
- The sector offset
where the file system starts in the image. Non-512 byte sectors can be specified
using ’@’ (32@2048).
- -l
- List the data information in time machine format.
- -s
- Copy
only the slack space of the image.
- -v
- Turn on verbose mode, output to stderr.
- -V
- Display version.
- image [images]
- One (or more if split) disk or partition
images whose format is given with ’-i’.
- start-stop ...
- Examine the specified block
number or number range.
This software is distributed under the IBM
Public License.
First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse
Venema). Now maintained by Brian Carrier <carrier at sleuthkit dot org>.
Table of Contents