DATASTAT

NAME

datastat − Display details of a data structure (i.e. block or sector)

datastat [-f fstype ] [-i imgtype] [-o imgoffset] [-vV] image [images] addr

datastat displays the allocation status of the given data address.

The options are as follows:
-f fstype

Specify the file system type. Use the -? option for supported types. If not given, the default type for the platform is used.

-i imgtype

Identify the type of image file, such as raw or split. Raw is the default.

-o imgoffset

The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using ’@’ (32@2048).

	-v		Verbose output of debugging statements to stderr
	-V		Display version

image [images]

One (or more if split) disk or partition images whose format is given with ’-i’.

addr

Address to display stats on. This is a fragment for UNIX file systems or a sector for FAT.

datastat first appeared in TASK v1.0 as dstat. It has been renamed to datastat in Debian GNU/Linux because of the Debian package dstat.

Brian Carrier <carrier AT sleuthkit DOT org>

pdf