`icat`¶

$ target-query <path/to/target> -f icat

Details¶
Module	`dissect.target.plugins.filesystem.icat.ICatPlugin`
Output	`no output`

Module documentation

Plugin to output the contents of a file based on its MFT segment or inode number.

Function documentation

Output the contents of a file based on its MFT segment or inode number. Supports Alternate Data Streams

Example:

# outputs contents of segment defaults to 'sysvol'
target-query <TARGET> -f icat --segment 96997

# outputs contents of inode defaults to '/'
target-query <TARGET> -f icat --inode 50947

# outputs contents of segment's ADS
target-query <TARGET> -f icat --segment 96997 --ads Zone.Identifier

# outputs contents of segment in filesystem 3 of target
target-query <TARGET> -f icat --fs 3 --segment 96997

# outputs contents of inode in filesystem 2 of target
target-query <TARGET> -f icat --fs 2 --inode 50947

icat¶

`icat`¶