DLS(1)

NAME
dls (unrm) - disk data recovery

SYNOPSIS
dls [-belsvV] [-f fstype] device [start-stop ...]

DESCRIPTION
dls opens the named device and copies data blocks (disk units). By default, dls copies unallocated data blocks (addressable disk units) only. dls was called unrm in TCT. Arguments:

-b  With file systems that have logical blocks that consist of fragments, don't insert null-byte padding to preserve logical block alignment in the output. This option is a no-op with the LINUX ext2fs file system, where logical blocks and fragments have the same size.

-e  Copy every block. The output should be similar to dd(1).

-f fstype
    Specifies the file system type. Use the -? argument for a list of all supported types. If not given, the default type for the platform is used.

-l  List the data information in time machine format.

-s  Copy only the slack space of the image.

-v  Turn on verbose mode, output to stderr.

-V  Display version.

device
    Disk special file, or regular file containing a disk image. On UNIX systems, raw mode disk access may give better performance than block mode disk access. LINUX disk device drivers support only block mode disk access.

start-stop ...
    Examine the specified block number or number range. Either the start, the stop, or the -stop may be omitted. If -b is not specified, the start block must be aligned to a logical block boundary (e.g. a multiple of 8 in the case of an FFS file system). With the LINUX ext2fs file system, the start block number must be >= 1.

LICENSE
This software is distributed under the IBM Public License.

HISTORY
First appeared in The Coroners Toolkit (TCT) 1.0 (Wietse Venema). Now maintained by Brian Carrier <carrier@sleuthkit.org>.