fls: add page (#3786)

* fls: add page

Added a (very) basic description of fls

* Update fls.md

Changed imagefile to device in the first example

* Update fls.md

Added Link to the Sleuthkit wiki

* Moved to /pages/common

* Update fls.md

Fixed travis errors.

* Update pages/common/fls.md

Upper to lower case - sorry.

Co-Authored-By: Zlatan Vasović <zlatanvasovic@gmail.com>

* Update pages/common/fls.md

Upper to lower case - thanks and sorry

Co-Authored-By: Zlatan Vasović <zlatanvasovic@gmail.com>

* Update fls.md

Clarified description in the 2nd description

* Update pages/common/fls.md

Upper to lower case - sorry, my native tongue uses way more upper characters

Co-Authored-By: Iván Hernández Cazorla <ivan@ivanhercaz.com>

* Update pages/common/fls.md

Co-Authored-By: Iván Hernández Cazorla <ivan@ivanhercaz.com>

* Update pages/common/fls.md

Co-Authored-By: Iván Hernández Cazorla <ivan@ivanhercaz.com>

* Update pages/common/fls.md

Co-Authored-By: Iván Hernández Cazorla <ivan@ivanhercaz.com>

* Update fls.md

Reworded partition/timezone example

* fls: Example two clarified

Thanks @zdroid @sbrl

* fls: clarified lathes in examples, removed mactime

Thanks @agnivade

* fls: moved -o and -z into two examples

* fls: fixed typo

* fls: minor changes

- fix typo at paths
- apply snake case convention

Co-authored-by: Zlatan Vasović <zlatanvasovic@gmail.com>
Co-authored-by: Iván Hernández Cazorla <ivan@ivanhercaz.com>
Co-authored-by: Agniva De Sarker <agnivade@yahoo.co.in>
client-spec/clarity
z7y8hsBP 2020-02-03 20:07:11 +01:00 committed by GitHub
parent 131afc3ee1
commit 0ac937674d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 0 deletions

16
pages/common/fls.md Normal file
View File

@ -0,0 +1,16 @@
# fls
> List files and directories in an image file or device.
> More information: <https://wiki.sleuthkit.org/index.php?title=Fls>.
- Build a recursive fls list over a device, output paths will start with C:
`fls -r -m {{C:}} {{/dev/loop1p1}}`
- Analyse a single partition, providing the sector offset at which the file system starts in the image:
`fls -r -m {{C:}} -o {{sector}} {{path/to/image_file}}`
- Analyse a single partition, providing the timezone of the original system:
`fls -r -m {{C:}} -z {{timezone}} {{/dev/loop1p1}}`