|
|
| (One intermediate revision by one user not shown) |
| Line 1: |
Line 1: |
| − | Version 2.09 Man Page
| + | Back to [[Help Documents]] |
| | | | |
| − | NAME
| + | istat displays details about a specific meta data structure. |
| − | istat - Display details of a meta-data structure (i.e. inode)
| + | |
| | | | |
| − | SYNOPSIS
| + | * [http://www.sleuthkit.org/sleuthkit/man/istat.html Automatically Updated man Page] |
| − | istat [-b num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-vV] [-z zone
| + | |
| − | ] [-s seconds ] image [images] inode
| + | |
| − | | + | |
| − | DESCRIPTION
| + | |
| − | istat displays the uid, gid, mode, size, link number, modified ,
| + | |
| − | accessed, changed times, and all the disk units a structure has allo-
| + | |
| − | cated.
| + | |
| − | | + | |
| − | The options are as follows:
| + | |
| − | | + | |
| − | -b num Display the addresses of num disk units. Useful when the inode
| + | |
| − | is unallocated with size 0, but still has block pointers.
| + | |
| − | | + | |
| − | -f fstype
| + | |
| − | Specify the file system type. Use the -? option for supported
| + | |
| − | types. If not given, the default type for the platform is used.
| + | |
| − | | + | |
| − | -s seconds
| + | |
| − | The time skew of the original system in seconds. For example,
| + | |
| − | if the original system was 100 seconds slow, this value would be
| + | |
| − | -100.
| + | |
| − | | + | |
| − | -i imgtype
| + | |
| − | Identify the type of image file, such as raw or split. Raw is
| + | |
| − | the default.
| + | |
| − | | + | |
| − | -o imgoffset
| + | |
| − | The sector offset where the file system starts in the image.
| + | |
| − | Non-512 byte sectors can be specified using ’@’ (32@2048).
| + | |
| − | | + | |
| − | -v Verbose output of debugging statements to stderr
| + | |
| − | | + | |
| − | -V Display version
| + | |
| − | | + | |
| − | -z zone
| + | |
| − | An ASCII string of the original system’s time zone. For exam-
| + | |
| − | ple, EST5EDT or GMT. These strings are defined by the operating
| + | |
| − | system and may vary. NOTE: This has changed since TCTUTILs.
| + | |
| − | | + | |
| − | image [images]
| + | |
| − | One (or more if split) disk or partition images whose format is
| + | |
| − | given with ’-i’.
| + | |
| − | | + | |
| − | inode Meta-data number to display stats on
| + | |
| − | | + | |
| − | SEE ALSO
| + | |
| − | dd(1), ils(1)
| + | |
| − | | + | |
| − | HISTORY
| + | |
| − | istat first appeared in TCTUTILs v1.0.
| + | |
| − | | + | |
| − | AUTHOR
| + | |
| − | Brian Carrier <carrier@sleuthkit.org>
| + | |
istat displays details about a specific meta data structure.
