Forensics - Sleuthkit and Autopsy
Linux CLI command reference for Sleuthkit

mmls [image]
fsstat -o [offset in sectors] [image]

General syntax: [command] -o [offset] -f [filesystem] [image]
Command
Information
fls
List allocated and deleted filenames (-r; -d; "/path"; -m timeline)
ffind
Search by filename (-a all names)

General syntax: [command] -o [offset] -f [filesystem] [image]
Command
Information
ils
List inode information (-r default removed only; -m mactime data; -e all inodes; -o find w/out filename; -z never used)
istat
View details of an inode
icat
Extract data at an inode
ifind
Find the inode corresponding to a data block (-d)

General syntax: [command] -o [offset] -f [filesystem] [image]
Command
Information
blkls
List data blocks and details
blkstat
View details of a data block (-h)
blkcat
Extract contents of a data block
blkcalc
​

Command
Information
mactime
Create a timeline from f/i tools (pipe to mactime -b)

Copy link
On this page