Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

sigfind(1) [debian man page]

SIGFIND(1)						      General Commands Manual							SIGFIND(1)

NAME
sigfind - Find a binary signature in a file SYNOPSIS
sigfind [-b bsize ] [-o offset ] [-t template ] [-lV] [ hex_signature ] file DESCRIPTION
sigfind searches through a file and looks for the hex_signature at a given offset. This can be used to search for lost boot sectors, superblocks, and partition tables. ARGUMENTS
-b bsize Specify the block size in which to search. The default is 512 and the value must be a multiple of 512. -o offset Specify the offset in a block in which the signature must exist. The default is 0. -t template Specify a template name that defines the signature value and offset. Run with no options to get a list of supported templates. -l The signature is stored in little-endian ordering and must therefore be reversed. -V Display version [hex_signature] The binary signature that you are searching for. It must be given in hexadecimal format. This argument must exist if -t is not used. file Any raw data. EXAMPLES
sigfind -o 510 -l AA55 disk.dd sigfind -t fat disk.dd AUTHOR
Brian Carrier <carrier at sleuthkit dot org> Send documentation updates to <doc-updates at sleuthkit dot org> SIGFIND(1)

Check Out this Related Man Page

JCAT(1) 						      General Commands Manual							   JCAT(1)

NAME
jcat - Show the contents of a block in the file system journal. SYNOPSIS
jcat [-f fstype ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image [images] ] [ inode ] jblk DESCRIPTION
jcat shows the contents of a journal block in the file system journal. The inode address of the journal can be given or the default loca- tion will be used. Note that the block address is a journal block address and not a file system block. The raw output is given to STDOUT. ARGUMENTS
-f fstype Specify the file system type. Use '-f list' to list the supported file system types. If not given, autodetection methods are used. -i imgtype Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection meth- ods are used. -o imgoffset The sector offset where the file system starts in the image. -b dev_sector_size The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. -V Display version -v verbose output image [images] One (or more if split) disk or partition images whose format is given with '-i'. [inode] The inode where the file system journal can be found. jblk The journal block to display. EXAMPLES
jcat -f linux-ext3 img.dd 34 | xxd AUTHOR
Brian Carrier <carrier at sleuthkit dot org> Send documentation updates to <doc-updates at sleuthkit dot org> JCAT(1)
Man Page

Featured Tech Videos