Skip to content
Snippets Groups Projects
Commit 14bf880b authored by Brian Carrier's avatar Brian Carrier
Browse files

Added sector size to IMG_INFO and file and volume systems use it instead of...

Added sector size to IMG_INFO and file and volume systems use it instead of 512. Changed istat and mmls -b flags to -B.
parent 6e5595be
No related branches found
No related tags found
No related merge requests found
......@@ -101,6 +101,12 @@ in UFS/Ext2.
8/19/09: Bug Fix: Fixed part of 2840345 where extended DOS partitions
in extended partitions were not marked as Meta.
10/27/09: Update: 'mmls -b' is now 'mmls -B'. Similarly with istat -b.
10/27/09: Update: Added sector_size value to IMG_INFO and file and volume
systems now use it instead of assuming 512. Also added -b options to all
command line tools to allow user to specify the device sector size.
---------------- VERSION 3.0.1 --------------
11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
Bug: 2265927
......
......@@ -4,7 +4,7 @@ blkcalc \- Converts between unallocated disk unit numbers and regular
disk unit numbers.
.SH SYNOPSIS
.B blkcalc
[-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-f fstype] image [images]
[-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-f fstype] image [images]
.SH DESCRIPTION
.B blkcalc
creates a disk unit number mapping between two images, one normal and
......@@ -53,6 +53,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048)
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output to STDERR.
.IP -V
......
......@@ -2,7 +2,7 @@
.SH NAME
blkcat \- Display the contents of file system data unit in a disk image.
.SH SYNOPSIS
.B blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset] image [images] unit_addr [num]
.B blkcat [-ahswvV] [-f fstype] [-u unit_size] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image [images] unit_addr [num]
.SH DESCRIPTION
.B blkcat
......@@ -42,6 +42,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output to stderr.
.IP -V
......
......@@ -9,7 +9,7 @@ blkls \- List or output file system data units.
.B ] [-o
.I imgoffset
.B ]
.I image [images] [start-stop]
.I [-b dev_sector_size] image [images] [start-stop]
.SH DESCRIPTION
.B blkls
......@@ -45,6 +45,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -l
List the data information in time machine format.
.IP -s
......
......@@ -4,7 +4,7 @@ blkstat \- Display details of a file system data unit (i.e. block or sector)
.SH SYNOPSIS
.B blkstat [-f
.I fstype
.B ] [-i imgtype] [-o imgoffset] [-vV]
.B ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-vV]
.I image [images] addr
.SH DESCRIPTION
.B blkstat
......@@ -24,6 +24,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output of debugging statements to stderr
.IP -V
......
......@@ -2,7 +2,7 @@
.SH NAME
ffind \- Finds the name of the file or directory using a given inode
.SH SYNOPSIS
.B ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset]
.B ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
.I image inode
.SH DESCRIPTION
.B ffind
......@@ -36,6 +36,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output to stderr.
.IP -V
......
......@@ -14,7 +14,7 @@ fls \- List file and directory names in a disk image.
.I imgtype
.B ] [-o
.I imgoffset
.B ]
.B ] [-b dev_sector_size]
.I image [images]
.B [
.I inode
......@@ -68,6 +68,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -u
Display undeleted entries only
.IP -v
......
......@@ -4,7 +4,7 @@ fsstat \- Display general details of a file system
.SH SYNOPSIS
.B fsstat [-f
.I fstype
.B ] [-i imgtype] [-o imgoffset] [-tvV]
.B ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-tvV]
.I image [images]
.SH DESCRIPTION
.B fsstat
......@@ -31,6 +31,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output of debugging statements to stderr
.IP -V
......
......@@ -8,7 +8,7 @@ icat \- Output the contents of a file based on its inode number.
.I imgtype
.B ] [-o
.I imgoffset
.B ]
.B ] [-b dev_sector_size]
.I image [images] inode
.SH DESCRIPTION
.B icat
......@@ -36,6 +36,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Enable verbose mode, output to stderr.
.IP -V
......
......@@ -4,7 +4,7 @@ ifind \- Find the meta-data structure that has allocated a given
disk unit or file name.
.SH SYNOPSIS
.B ifind [-avVl] [-f fstype] [-d data_unit]
.B [-n file] [-p par_inode] [-z ZONE] [-i imgtype] [-o imgoffset]
.B [-n file] [-p par_inode] [-z ZONE] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
.I image [images]
.SH DESCRIPTION
.B ifind
......@@ -47,6 +47,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output to stderr.
.IP -V
......
......@@ -10,7 +10,7 @@ ils \- List inode information
.I imgtype
.B ] [-o
.I imgoffset
.B ]
.B ] [-b dev_sector_size]
.I image [images] [start-stop]
.B ils [-aAlLvVzZ] [-f
......@@ -60,6 +60,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP \fB-v\fR
Turn on verbose mode, output to stderr.
.IP \fB-V\fR
......
......@@ -2,7 +2,7 @@
.SH NAME
img_cat \- Output contents of an image file.
.SH SYNOPSIS
.B img_cat [-i imgtype] [-vV]
.B img_cat [-i imgtype] [-b dev_sector_size] [-vV]
.I image [images]
.SH DESCRIPTION
.B img_cat
......@@ -14,6 +14,8 @@ the appropriate tool.
.SH ARGUMENTS
.IP "-i imgtype"
Identify the type of image file, such as raw, split, or aff. Use '-i list' to list the supported types. If not given, autodetection methods are used.
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output of debugging statements to stderr
.IP -V
......
......@@ -2,7 +2,7 @@
.SH NAME
img_stat \- Display details of an image file
.SH SYNOPSIS
.B img_stat [-i imgtype] [-tvV]
.B img_stat [-i imgtype] [-b dev_sector_size] [-tvV]
.I image [images]
.SH DESCRIPTION
.B img_stat
......@@ -13,6 +13,8 @@ and the byte range of each file will be given for split image formats.
.SH ARGUMENTS
.IP "-i imgtype"
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used.
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP "-t"
Print the image type only.
.IP -v
......
......@@ -2,11 +2,11 @@
.SH NAME
istat \- Display details of a meta-data structure (i.e. inode)
.SH SYNOPSIS
.B istat [-b
.B istat [-B
.I num
.B ] [-f
.I fstype
.B ] [-i imgtype] [-o imgoffset] [-vV] [-z
.B ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-vV] [-z
.I zone
.B ] [-s
.I seconds
......@@ -18,7 +18,7 @@ displays the uid, gid, mode, size, link number, modified , accessed,
changed times, and all the disk units a structure has allocated.
The options are as follows:
.IP "-b num"
.IP "-B num"
Display the addresses of num disk units. Useful when the inode is
unallocated with size 0, but still has block pointers.
.IP "-f fstype"
......@@ -34,6 +34,8 @@ If not given, autodetection methods are used.
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -v
Verbose output of debugging statements to stderr
.IP -V
......
......@@ -4,7 +4,7 @@ jcat \- Show the contents of a block in the file system journal.
.SH SYNOPSIS
.B jcat [-f
.I fstype
.B ] [-vV] [-i imgtype] [-o imgoffset]
.B ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
.I image [images]
.B ] [
.I inode
......@@ -26,6 +26,8 @@ Identify the type of image file, such as raw or split. Use '-i list' to list th
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -V
Display version
.IP -v
......
......@@ -4,7 +4,7 @@ jls \- List the contents of a file system journal
.SH SYNOPSIS
.B jls [-f
.I fstype
.B ] [-vV] [-i imgtype] [-o imgoffset]
.B ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
.I image [images] [inode]
.SH DESCRIPTION
......@@ -23,6 +23,8 @@ Identify the type of image file, such as raw or split. Use '-i list' to list th
.IP "-o imgoffset"
The sector offset where the file system starts in the image. Non-512 byte
sectors can be specified using '@' (32@2048).
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP -V
Display version
.IP -v
......
......@@ -8,7 +8,7 @@ mmcat \- Output the contents of a partition to stdout
.I offset
.B ] [ -i
.I imgtype
.B ] [-vV]
.B ] [-b dev_sector_size] [-vV]
.I image [images] part_num
.SH DESCRIPTION
.B mmcat
......@@ -22,6 +22,8 @@ Specify the media management type. Use '-t list' to list the supported types. I
Specify the offset into the image where the volume containing the
partition system starts. The relative offset of the partition system
will be added to this value.
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP "-i imgtype"
Identify the type of image file, such as raw or split. If not given, autodetection methods are used.
.IP -v
......
......@@ -8,7 +8,7 @@ mmls \- Display the partition layout of a volume system (partition tables)
.I offset
.B ] [ -i
.I imgtype
.B ] [-brvV] [-aAmM]
.B ] [-b dev_sector_size] [-BrvV] [-aAmM]
.I image [images]
.SH DESCRIPTION
.B mmls
......@@ -22,9 +22,11 @@ Specify the media management type. Use '-t list' to list the supported types. I
Specify the offset into the image where the volume containing the
partition system starts. The relative offset of the partition system
will be added to this value.
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP "-i imgtype"
Identify the type of image file, such as raw or split. If not given, autodetection methods are used.
.IP -b
.IP -B
Include a column with the partition sizes in bytes
.IP -r
Recurse into DOS partitions and look for other partition tables. This setup frequently occurs when Unix is installed on x86 systems.
......
......@@ -8,7 +8,7 @@ mmstat \- Display details about the volume system (partition tables)
.I offset
.B ] [ -i
.I imgtype
.B ] [-vV]
.B ] [-b dev_sector_size] [-vV]
.I image [images]
.SH DESCRIPTION
.B mmstat
......@@ -22,6 +22,8 @@ Specify the media management type. Use '-t list' to list the supported types. I
Specify the offset into the image where the volume containing the
partition system starts. The relative offset of the partition system
will be added to this value.
.IP "-b dev_sector_size"
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP "-i imgtype"
Identify the type of image file, such as raw or split. If not given, autodetection methods are used.
.IP -v
......
......@@ -297,7 +297,7 @@ main(int argc, char **argv1)
hdb_info = NULL;
#endif
img_info = tsk_img_open_sing(argv[1], TSK_IMG_TYPE_DETECT);
img_info = tsk_img_open_sing(argv[1], TSK_IMG_TYPE_DETECT, 0);
if (img_info == NULL) {
fprintf(stderr, "Error opening file\n");
tsk_error_print(stderr);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment