Fls

From SleuthKitWiki
Revision as of 17:34, 9 April 2012 by Flexeril12 (Talk | contribs)

Jump to: navigation, search

Back to Help Documents


fls lists the files and directory names in a file system. It will process the contents of a given directory and can display information on deleted files.

Output Data

The default output (i.e. if -l or -m are not given) has one line for each file in the directory. An NTFS example is:

r/r 1304-128-1: IO.SYS

File Type

The r/r value shows the file type. The first 'r' is the type as saved in the file's file name structure and the second 'r' is the type as saved in the file's metadata structure. For allocated files, these should always be equal. For deleted files, they could be different if one of the structures was reallocated to a different file type. The types are listed here:

  • -: Unknown type
  • r: Regular file
  • d: Directory
  • c: Character device
  • b: Block device
  • l: Symbolic link
  • p: Named FIFO
  • s: Shadow
  • h: Socket
  • w: Whiteout
  • v: TSK Virtual file / directory (not a real directory, created by TSK for convenience).

Most entries will be 'r' and 'd'. The others are Unix-focused.

Flexeril 10 mg: How to Deal with the Side effects of Flexeril

The drug flexeril is for those people who are suffering from any kind of a pain due to an injury. This medicine works in a simple way. It blocks the nerve’s impulse by sending a message to the brain that the body is in pain. Flexeril alone is very effective for certain medical conditions. But if the pain is severe then a combination of physiotherapy and rest should also be taken along with the medicine because in this way the tissues and muscles which got hurt in the injury go back to their normal conditions and work properly or sometimes in good working condition.

The possible side effects of flexeril 10mg are heart effects, dizziness, stomach ache, drowsiness, hyper tension etc. Therefore it is recommended that before using the flexeril 10 mg the patient should consult the physician or a doctor and do not exceed the amount that is being suggested by the doctor. Usually it is 30 mg per day.


flexeril Já posso ir embora da casa da minha mãe? Alguém me acolhe? Almost 20,000 plays in a week... that rules swaggiee e e e BOYFRIENDReview GOLD IS A PERSONAL THING FOR A MAN OF WEALTH..IT SHOWS VALUED DISTINCTION AND CLASS..A LITTLE ..... - fashion valeu cara espero que curta :] going to bed with alotta poo on your mind.< Grrrr. Ministério Público de Santa Catarina abre inscrições para concurso público. Acesse: No dream is ever too big You are my 1st & sexiest Boyfriend! :) Would you follow me? If I was you girlfriend I'd never let you go. I love YOU1816 VerguiadorDeMujeres Pobre cerote ese : Did you all catch last night's episode? Check out all of the items you saw on episode 4 right here: Gym time! letmeseeyoudripsweat Sem trampo hoje o/ We are excited about the announcements that VIZIO made at CES. What VIZIO products are at the top of your wish list?

HORAN MA TATUAŻ?! lol I need to get in touch with Sen. Patrick Leahy and loveing apologize for my angry outburst. It was fault. love . . . Sii es que como no usabamos la cuenta la regale :) 1440 Jacquie+Harry what was your favorite food as a child ? mine was BN Biscuits and Turkey Burgers!! <3 FF -c- Had the BEST mother-son date ever w . Dinner & a movie & gave me & early bday present - he wrote me a song! MomentsToCherish Dear random girl who shut the door on me: I saw you trip and almost take a digger moments afterwards. whatdidyoulearn You're never too old for a disney movie. A mi conservador amigo el poema de Benedetti "Soy un caso perdido": soy parcial, de esto no cabe duda... un parcial irrescatable! In unserer Serie zu Sprichwörtern erklären wir heute, wieso eine Spinne am Morgen und Sorgen bringt: BRAVES WIN!!!! 1-0. Slinkys<<<<< Terrible. , , , , , , , follow back(: I can attest to that no doubt.. Killer pose right there.. Soon I hope to be in one:) 28th?? Are you serious?

flexeril If Camp Rock 3 will not cast Jonas Brothers & Demi Lovato. Then its nothing. RT if you agree. I just went from 6 to Midnight Tô xegano jente! Boa noite. Ciencia Hallan en España el cráneo del dinosaurio más grande de Europa No es gracioso!!! >_< The Final Word with Marc Bertrand: Today on the Final Word with Marc Bertrand, Cam Neely joined Felger and Mazz ... i love you 4 Thanks! you too. When you're texting & u say something mean to a person then throw in an lol ... dormi demais hehe *--* seguindo, SDV. Sigo com toda honestidade. Girls always loose they virginity to somebody they really didnt want it be se So don't let your past destroy what comes tomorrow Idk storms are so relaxing When's that single coming out ? was rockin something the other day for 20 seconds that's some new poo by uvery soon

StayAwayFromMeIf Your Like This Girl -,- Don't forget you only have until March 9th to get your Early Clan Awards Dinner tickets at £38 each - after that they go up in price! Tonight is bout to be sucessful with the NBA all star game and the oscars! winnin Toit tu devrais travailler tes cour, parce que ta note de ce matin!!! ( live on I'm just trying to 'think like a brit' Eso es que tu ip ha participado en algun ataque, o sea que puede que estés infectado :O its black so thats impossible ;D says the person that said they gonna chop me lol iight.. andd mhmmm someone sayy somethin bout track..? lol ; :)) Come to "STAND WITH JAPAN" Thursday, March 24 from 6:30 pm to 9:30 pm. Minha mãe adorou NPNP hehe As was posting randomness heres my decks Breakfast club is still the best movie in the entire world ten million times over.

File Name

Finally, the IO.SYS part of the entry is the name of the file for this entry.

If you use the '-r' option to recursively go into directories, a '+' is added to the front of each entry to show how deep the file is. '++' means that the entry is two directories deep.

Deleted File Names

If the file name in unallocated space of the directory, there will be a '*' between the file type and the metadata address.

r/r * 1304-128-1: IO.SYS

In general, this means that the file is deleted. But, some file systems keep the directory contents sorted and will move file names around. This can result in unallocated copies of the file name, even when the file is still allocated. As of version 3.0.0, TSK suppresses duplicate file names and will suppress a deleted version of a name if an equivalent allocated version exists (equivalent is defined as the same name and pointing to the same metadata address).

Sometimes, you will see the text '(realloc)' after the metadata address.

r/r * 1304-128-1(realloc): IO.SYS

This occurs when the file name is in an unallocated state and the metadata structure is in an allocated state. This can only occur on file systems that separate the file name from the metadata (such as NTFS, Ext2/3, UFS, etc.). Seeing '(realloc)' with versions of TSK 3.0.0 and greater (because of the duplicate name suppression) is generally an indication that the metadata structure has been reallocated to a new file and therefore not likely to be the metadta or file content that originally corresponded to this file name.

-l format

The '-l' argument causes the "long" format with more details. It is tab-delimited with the following fields:

  • file type as reported in file name and metadata structure (see above)
  • Metadata Address
  • name
  • mtime (last modified time)
  • atime (last accessed time)
  • ctime (last changed time)
  • crtime (created time)
  • size (in bytes)
  • uid (User ID)
  • gid (Group ID)

Note that the 2.X versions of TSK do not print the created time.

-m format

The '-m' argument causes the data to be in the body file format. It is used to make timelines. An example:

# fls -r -m / image.dd > body.txt