Tsk gettimes

Back to Help Documents

tsk_gettimes will extract the metadata from the file systems in an image. The results will be a body file that can be used by mactime to make a timeline. This tool is equivalent to running fls '-m' on each file system in an image.

• Automatically Updated man Page