blkls

SYNOPSIS
       blkls  [-aAelsvV]  [-f  fstype  ]  [-i  imgtype ] [-o imgoffset ] image
       [images] [start-stop]


DESCRIPTION
       blkls opens the named  image(s)  and  copies  file  system  data  units
       (blocks).   By  default,  blkls copies the contents of unallocated data
       blocks.  blkls was called dls in TSK versions prior  to  3.0.0.   blkls
       was called unrm in TCT.


ARGUMENTS
       -e     Copy every block. The output should be similar to dd.

       -a     Display all allocated blocks (same as -e if -A is also given).

       -A     Display all unallocated blocks (same as -e if -a is also given).
              This is the default behavior.

       -f fstype
              Specifies the file system type.  Use '-f list' to list the  sup-
              ported  file  system types.  If not given, autodetection methods
              are used.

       -i imgtype
              Identify the type of image file, such as raw or split.  Use  '-i
              list'  to list the supported types.  If not given, autodetection
              methods are used.

       -o imgoffset
              The sector offset where the file system  starts  in  the  image.
              Non-512 byte sectors can be specified using '@' (32@2048).

       -l     List the data information in time machine format.

       -s     Copy only the slack space of the image.

       -v     Turn on verbose mode, output to stderr.

       -V     Display version.

       image [images]
              One  (or more if split) disk or partition images whose format is
              given with '-i'.

       start-stop ...
              Examine the specified block number or number range.

LICENSE
       This software is distributed under the IBM Public License.

HISTORY