Archives par mot-clé : sleuthkit

Sleuth Kit Help Page

Image Operations

  • img_stat: gives the type of image and its size in bytes.
  • mmls: displays the partition table.
  • mmstat: information about the partition.

Use the option -t {dos, gpt,bad,mac} with mmls to specify the type of partition table.

Filesystem Operations

  • fsstat: provide filesystem information
  • fls: list file in the filesystem


Use the option -f <fs_type> to specify the type of filesystem. The option -o <size_bytes> tells where the filesystem starts in the image.