dls(1)
NAME
dls - disk data recovery
SYNOPSIS
dls [-aAbelsvV] [-f fstype] [-i imgtype] [-o imgoffset] image [images] [start-stop]
DESCRIPTION
dls opens the named image(s) and copies data blocks (disk units). By
default, dls copies unallocated data blocks (addressable disk units)
only. dls was called unrm in TCT.
Arguments:
- -b With file systems that have logical blocks that consist of frag
- ments, don't insert null-byte padding to preserve logical block alignment in the output. This option is a no-op with the LINUX ext2fs file system, where logical blocks and fragments have the same size.
- -e Copy every block. The output should be similar to dd(1).
- -a Display all allocated blocks (same as -e if -A is also given).
- -A Display all unallocated blocks (same as -e if -a is also given).
- This is the default behavior.
- -f fstype
- Specifies the file system type. Use the -? argument for a list of all supported types. If not given, the default type for the platform is used.
- -i imgtype
- Identify the type of image file, such as raw or split. Raw is the default.
- -o imgoffset
- The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using '@' (32@2048).
- -l List the data information in time machine format.
- -s Copy only the slack space of the image.
- -v Turn on verbose mode, output to stderr.
- -V Display version.
- image [images]
- One (or more if split) disk or partition images whose format is given with '-i'.
- start-stop ...
- Examine the specified block number or number range.
LICENSE
This software is distributed under the IBM Public License.
HISTORY
- First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema). Now
maintained by Brian Carrier <carrier@sleuthkit.org>.