`icat`#

$ target-query <path/to/target> -f icat

Details#
Module	`filesystem.icat.ICatPlugin`
Output	`no output`

Module documentation

Plugin to output the contents of a file based on its MFT segment or inode number.

Function documentation

Output the contents of a file based on its MFT segment or inode number. Supports Alternate Data Streams

Example:

# outputs contents of segment defaults to ‘sysvol’ target-query <TARGET> -f icat –segment 96997

# outputs contents of inode defaults to ‘/’ target-query <TARGET> -f icat –inode 50947

# outputs contents of segment’s ADS target-query <TARGET> -f icat –segment 96997 –ads Zone.Identifier

# outputs contents of segment in filesystem 3 of target target-query <TARGET> -f icat –fs 3 –segment 96997

# outputs contents of inode in filesystem 2 of target target-query <TARGET> -f icat –fs 2 –inode 50947

icat#