mmls

       tables)

SYNOPSIS
       mmls [-t mmtype ] [-o offset ] [ -i imgtype  ]  [-brvV]  [-aAmM]  image
       [images]

DESCRIPTION
       mmls  displays  the  layout of the partitions in a volume system, which
       include partition tables and disk labels.


ARGUMENTS
       -t mmtype
              Specify the media management type.  Use '-t list'  to  list  the
              supported types. If not given, autodetection methods are used.

       -o offset
              Specify  the  offset  into the image where the volume containing
              the partition system starts.  The relative offset of the  parti-
              tion system will be added to this value.

       -i imgtype
              Identify  the  type of image file, such as raw or split.  If not
              given, autodetection methods are used.

       -b     Include a column with the partition sizes in bytes

       -r     Recurse into DOS partitions and look for other partition tables.
              This  setup frequently occurs when Unix is installed on x86 sys-
              tems.

       -v     Verbose output of debugging statements to stderr

       -V     Display version

       -a     Show allocated volumes

       -A     Show unallocated volumes

       -m     Show metadata volumes

       -M     Hide metadata volumes

       image [images]
              One (or more if split) disk images whose format  is  given  with
              '-i'.


       'mmls'  is  similar  to  'fdisk  -lu'  in Linux with a few differences.
       Namely, it will show which sectors are not being used so that those can
       be searched for hidden data.  It also gives the length value so that it
       can be plugged into 'dd' more easily for extracting the partitions.  It
       also will show BSD disk labels for Free, Open, and NetBSD and will dis-
       play the output in sectors and not cylinders.  Lastly, it works on non-


EXAMPLES
       To list the partition table of a Windows system using autodetect:

       # mmls disk_image.dd

       To list the contents of a BSD system that starts in sector 12345  of  a
       split image:

       # mmls -t bsd -o 12345 -i split disk-1.dd disk-2.dd


AUTHOR
       Brian Carrier <carrier at sleuthkit dot org>



                                                                       MMLS(1)