icat-sleuthkit

SYNOPSIS
       icat [-hrsvV] [-f fstype ] [-i imgtype ] [-o imgoffset ] image [images]
       inode

DESCRIPTION
       icat opens the named image(s) and copies the file  with  the  specified
       inode number to standard output.


ARGUMENTS
       -f fstype
              Specifies  the file system type.  Use '-f list' to list the sup-
              ported file system types.  If not given,  autodetection  methods
              are used.

       -h     Skip over holes in sparse files, so that absolute address infor-
              mation is lost. This option  saves  space  when  copying  sparse
              files.

       -r     Use file recovery techniques if the file is deleted.

       -s     Include the slack space in the output.

       -i imgtype
              Identify  the type of image file, such as raw or split.  Use '-i
              list' to list the supported types.  If not given,  autodetection
              methods are used.

       -o imgoffset
              The  sector  offset  where  the file system starts in the image.
              Non-512 byte sectors can be specified using '@' (32@2048).

       -v     Enable verbose mode, output to stderr.

       -V     Display version

       image [images]
              One (or more if split) disk or partition images whose format  is
              given with '-i'.

       inode  Inode  number.  icat  concatenates the contents of all specified
              files.

LICENSE
       This software is distributed under the IBM Public License.

HISTORY
       First appeared in The Coroners Toolkit (TCT) 1.0  and  is  now  in  The
       Sleuth Kit.

AUTHOR(S)
       Wietse  Venema  IBM T.J. Watson Research P.O. Box 704 Yorktown Heights,
       NY 10598, USA