dls(1)

dls1

Disk data recovery

Usage

dls [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] [start-stop]

Overview

dls opens the named image(s) and copies data blocks (disk units). By default, dls copies unallocated data blocks (addressable disk units) only. dls was called unrm in TCT.

Arguments:

-b

With file systems that have logical blocks that consist of fragments, don't insert null-byte padding to preserve logical block alignment in the output. This option is a no-op with the LINUX ext2fs file system, where logical blocks and fragments have the same size.

-e

Copy every block. The output should be similar to dd(1).

-a

Display all allocated blocks (same as -e if -A is also given).

-A

Display all unallocated blocks (same as -e if -a is also given). This is the default behavior.

-f fstype

Specifies the file system type. Use the -? argument for a list of all supported types. If not given, the default type for the platform is used.

-i imgtype

Identify the type of image file, such as raw or split. Raw is the default.

-o imgoffset

The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using '@' (32@2048).

-l

List the data information in time machine format.

-s

Copy only the slack space of the image.

-v

Turn on verbose mode, output to stderr.

-V

Display version.

image [images]

One (or more if split) disk or partition images whose format is given with '-i'.

start-stop ...

Examine the specified block number or number range.

Releases

3 releases since Debian 3.1 (Sarge); the text changed 2 times.

  1. 3.1
  2. 4.0
  3. 5.0

-A since Debian 5.0 (Lenny); -a since Debian 5.0 (Lenny).

License

This software is distributed under the IBM Public License.

History

First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema). Now maintained by Brian Carrier <[email protected]>.

From sleuthkit 2.52-1 in Debian 5.0 (Lenny). Parsed by carta from the page's man source.