BLK Package

BLKCALC

blkcalc is a tool of BLK Package creates a disk unit number mapping between two images, one normal and another that only contains the unallocated units of the first program.

Usage

Syntax

blkcalc [-dsu unit_addr] [-vV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] image [images]

Options

One of the following must be given:
	  -d: The given address is from a 'dd' image 
	  -s: The given address is from a 'blkls -s' (slack) image
	  -u: The given address is from a 'blkls' (unallocated) image
	-f fstype: The file system type (use '-f list' for supported types)
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-o imgoffset: The offset of the file system in the image (in sectors)
	-v: verbose output to stderr
	-V: Print version

Example

cyborg@cyborg:~$ blkcalc -u 2048 image.dd
4378



BLKCAT

 

blkcat displays num data units (default is one) starting at the unit address unit_addr from image to stdout in different formats (default is raw).

 

Usage

 

Syntax

 blkcat [-ahsvVw] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] [-u usize] image [images] unit_addr [num]

Options

        -a: displays in all ASCII 
	-h: displays in hexdump-like fashion
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-o imgoffset: The offset of the file system in the image (in sectors)
	-f fstype: File system type (use '-f list' for supported types)
	-s: display basic block stats such as unit size, fragments, etc.
	-v: verbose output to stderr
	-V: display version
	-w: displays in web-like (html) fashion
	-u usize: size of each data unit in image (for raw, blkls, swap)
	[num] is the number of data units to display (default is 1)

Example

cyborg@cyborg:~$ blkcat -hw image.dd 264 4
<html>
<head>
<title>Unit: 264   Size: 16384 bytes</title>
</head>
<body>
<table border=0>
<tr><td>0</td><td>00000000</td><td>00000000</td><td>00000000</td><td>00000000</td>	<td>....</td><td>....</td><td>....


BLKSTAT

blkstat displays the allocation status of the given data unit.

Usage

Syntax

 blkstat [-vV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] image [images] addr

Options

        -f fstype: File system type (use '-f list' for supported types)
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-o imgoffset: The offset of the file system in the image (in sectors)
	-v: Verbose output to stderr
	-V: Print version

Example

cyborg@cyborg:~$ blkstat -v image.dd 2088
tsk_img_open: Type: 0   NumImg: 1  Img1: image.dd
fsopen: Auto detection mode at offset 0
raw_read: byte offset: 0 len: 65536
ntfs_dinode_lookup: Processing MFT 0
raw_read: byte offset: 34951168 len: 65536
ntfs_proc_attrseq: Processing extended entry for primary entry 0
ntfs_proc_attrseq: Resident Attribute in Type: 16 Id: 0 IdNew: 0 Name: 
ntfs_proc_attrseq: Resident Attribute in Type: 48 Id: 3 IdNew: 3 Name: 
ntfs_proc_attrseq: Non-Resident Attribute Type: 128 Id: 1 IdNew: 1 Name:   Start VCN: 0
ntfs_make_data_run: Len idx: 0 cur: 64 (40) tot: 64 (40)
0 Comments

Leave a reply

CONTACT US

We're are building as a community and a team. Be a part of it.

Sending

©2017 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?