Forensics - Sleuthkit and Autopsy
Linux CLI command reference for Sleuthkit
mmls [image]
fsstat -o [offset in sectors] [image]
General syntax:
[command] -o [offset] -f [filesystem] [image]
Command | Information |
fls | List allocated and deleted filenames (-r; -d; "/path"; -m timeline) |
ffind | Search by filename (-a all names) |
General syntax:
[command] -o [offset] -f [filesystem] [image]
Command | Information |
ils | List inode information (-r default removed only; -m mactime data; -e all inodes; -o find w/out filename; -z never used) |
istat | View details of an inode |
icat | Extract data at an inode |
ifind | Find the inode corresponding to a data block (-d) |
General syntax:
[command] -o [offset] -f [filesystem] [image]
Command | Information |
blkls | List data blocks and details |
blkstat | View details of a data block (-h) |
blkcat | Extract contents of a data block |
blkcalc | |
Command | Information |
mactime | Create a timeline from f/i tools (pipe to mactime -b) |
Last modified 1yr ago