Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

sigfind(1) [debian man page]

SIGFIND(1)						      General Commands Manual							SIGFIND(1)

sigfind - Find a binary signature in a file SYNOPSIS
sigfind [-b bsize ] [-o offset ] [-t template ] [-lV] [ hex_signature ] file DESCRIPTION
sigfind searches through a file and looks for the hex_signature at a given offset. This can be used to search for lost boot sectors, superblocks, and partition tables. ARGUMENTS
-b bsize Specify the block size in which to search. The default is 512 and the value must be a multiple of 512. -o offset Specify the offset in a block in which the signature must exist. The default is 0. -t template Specify a template name that defines the signature value and offset. Run with no options to get a list of supported templates. -l The signature is stored in little-endian ordering and must therefore be reversed. -V Display version [hex_signature] The binary signature that you are searching for. It must be given in hexadecimal format. This argument must exist if -t is not used. file Any raw data. EXAMPLES
sigfind -o 510 -l AA55 disk.dd sigfind -t fat disk.dd AUTHOR
Brian Carrier <carrier at sleuthkit dot org> Send documentation updates to <doc-updates at sleuthkit dot org> SIGFIND(1)

Check Out this Related Man Page

JLS(1)							      General Commands Manual							    JLS(1)

jls - List the contents of a file system journal SYNOPSIS
jls [-f fstype ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image [images] [inode] DESCRIPTION
jls lists the records and entries in a file system journal. If inode is given, then it will look there for a journal. Otherwise, it will use the default location. The output lists the journal block number and a description. ARGUMENTS
-f fstype Specify the file system type. Use '-f list' to list the supported file system types. If not given, autodetection methods are used. -i imgtype Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection meth- ods are used. -o imgoffset The sector offset where the file system starts in the image. -b dev_sector_size The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. -V Display version -v verbose output image [images] One (or more if split) disk or partition images whose format is given with '-i'. [inode] The inode where the file system journal can be found. EXAMPLES
jls -f linux-ext3 img.dd AUTHOR
Brian Carrier <carrier at sleuthkit dot org> Send documentation updates to <doc-updates at sleuthkit dot org> JLS(1)
Man Page