Tsk gettimes

From SleuthKitWiki
Revision as of 18:25, 27 October 2010 by Carrier (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Back to Help Documents

tsk_gettimes will extract the metadata from the file systems in an image. The results will be a body file that can be used by mactime to make a timeline. This tool is equivalent to running fls '-m' on each file system in an image.

Retrieved from "http://wiki.sleuthkit.org/index.php?title=Tsk_gettimes&oldid=508"