From SleuthKitWiki
Revision as of 08:21, 17 November 2007 by Dhawkins (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Version 2.09 Man Page


      istat - Display details of a meta-data structure (i.e. inode)


      istat [-b num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-vV] [-z zone
      ] [-s seconds ] image [images] inode


      istat displays the uid,  gid,  mode,  size,  link  number,  modified  ,
      accessed,  changed  times, and all the disk units a structure has allo-
      The options are as follows:
      -b num Display the addresses of num disk units.  Useful when the  inode
             is unallocated with size 0, but still has block pointers.
      -f fstype
             Specify  the  file system type.  Use the -? option for supported
             types.  If not given, the default type for the platform is used.
      -s seconds
             The  time  skew of the original system in seconds.  For example,
             if the original system was 100 seconds slow, this value would be
      -i imgtype
             Identify  the  type of image file, such as raw or split.  Raw is
             the default.
      -o imgoffset
             The sector offset where the file system  starts  in  the  image.
             Non-512 byte sectors can be specified using ’@’ (32@2048).
      -v     Verbose output of debugging statements to stderr
      -V     Display version
      -z zone
             An  ASCII  string of the original system’s time zone.  For exam-
             ple, EST5EDT or GMT.  These strings are defined by the operating
             system and may vary.  NOTE: This has changed since TCTUTILs.
      image [images]
             One  (or more if split) disk or partition images whose format is
             given with ’-i’.
      inode  Meta-data number to display stats on


      dd(1), ils(1)


      istat first appeared in TCTUTILs v1.0.


      Brian Carrier <>