bcat(1)							  bcat(1)


NAME
       bcat  - Display the contents of disk block from a forensic
       image

SYNOPSIS
       bcat [-ahsw] [-f fstype ] image block [ size ]

DESCRIPTION
       bcat displays size bytes (default block size  is	 used  by
       default) of the contents of disk block block from image to
       stdout in different formats (default is raw).   The  image
       should be created using dd(1).

       The arguments are as follows:

       -a     Display the contents in ASCII

       -f     Specify  image  as a specific file type (See BUGS).
	      If swap is given here, the image will be	displayed
	      in pages of size 4096 bytes.

       -h     Display the contents in hexdump

       -s     Display  statistics  on the image (block size, file
	      block size, indirect address block size, and number
	      of fragments).

       -w     Display the contents in an HTML table format.

       image  Partition image created by dd(1).

       block_num
	      Block  number  to display (block size can be deter-
	      mined with -s option)

       size   Size of block to display (must  be  a  multiple  of
	      DEV_BSIZE (typically 512)).


       The basic functionality of bcat can also be achieved using
       dd(1).  To determine which inode	 has  allocated	 a  given
       block, the find_inode(1) command can be used.

EXAMPLE
       # bcat -hw image 264 1024

       or

       # bcat -hw image 264


SEE ALSO
       dd(1), find_inode(1)

BUGS
       Currently only reads FFS on OpenBSD and Solaris and EXT2FS
       on Linux.

HISTORY
       bcat first appeared in TCTUTILs v1.0.

AUTHOR
       Brian Carrier <carrier@cerias.purdue.edu>




























User Manuals		     MAY 2001				2


