From 0ac937674dee1f4281a00de9373fce093b864a7f Mon Sep 17 00:00:00 2001 From: z7y8hsBP <51470766+z7y8hsBP@users.noreply.github.com> Date: Mon, 3 Feb 2020 20:07:11 +0100 Subject: [PATCH] fls: add page (#3786) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fls: add page Added a (very) basic description of fls * Update fls.md Changed imagefile to device in the first example * Update fls.md Added Link to the Sleuthkit wiki * Moved to /pages/common * Update fls.md Fixed travis errors. * Update pages/common/fls.md Upper to lower case - sorry. Co-Authored-By: Zlatan Vasović * Update pages/common/fls.md Upper to lower case - thanks and sorry Co-Authored-By: Zlatan Vasović * Update fls.md Clarified description in the 2nd description * Update pages/common/fls.md Upper to lower case - sorry, my native tongue uses way more upper characters Co-Authored-By: Iván Hernández Cazorla * Update pages/common/fls.md Co-Authored-By: Iván Hernández Cazorla * Update pages/common/fls.md Co-Authored-By: Iván Hernández Cazorla * Update pages/common/fls.md Co-Authored-By: Iván Hernández Cazorla * Update fls.md Reworded partition/timezone example * fls: Example two clarified Thanks @zdroid @sbrl * fls: clarified lathes in examples, removed mactime Thanks @agnivade * fls: moved -o and -z into two examples * fls: fixed typo * fls: minor changes - fix typo at paths - apply snake case convention Co-authored-by: Zlatan Vasović Co-authored-by: Iván Hernández Cazorla Co-authored-by: Agniva De Sarker --- pages/common/fls.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 pages/common/fls.md diff --git a/pages/common/fls.md b/pages/common/fls.md new file mode 100644 index 000000000..86df6bb99 --- /dev/null +++ b/pages/common/fls.md @@ -0,0 +1,16 @@ +# fls + +> List files and directories in an image file or device. +> More information: . + +- Build a recursive fls list over a device, output paths will start with C: + +`fls -r -m {{C:}} {{/dev/loop1p1}}` + +- Analyse a single partition, providing the sector offset at which the file system starts in the image: + +`fls -r -m {{C:}} -o {{sector}} {{path/to/image_file}}` + +- Analyse a single partition, providing the timezone of the original system: + +`fls -r -m {{C:}} -z {{timezone}} {{/dev/loop1p1}}`