Fsstat

From SleuthKitWiki
Revision as of 03:42, 18 November 2007 by Dhawkins (Talk | contribs)

Jump to: navigation, search

Back to Help Documents

fsstat

Version 2.09


Purpose

Displays the details associated with a file system. The output of this command is file system specific. At a minimum, the range of meta-data values (inode numbers) and content units (blocks or clusters) are given. Also given are details from the Super Block, such as mount times and and features. For file systems that use groups (FFS and EXT2FS), the layout of each group is listed.
For a FAT file system, the FAT table is displayed in a condensed format. Note that the data is in sectors and not in clusters.


Usage

fsstat [-f fstype ] [-i imgtype] [-o imgoffset] [-tvV] image [images]


Options

Switch Purpose
-t type Print the file system type only.
-f fstype Specify the file system type. Use the -? option for supported types. If not given, the default type for the platform is used.
-i imgtype Identify the type of image file, such as raw or split. Raw is the default.
-o imgoffset The sector offset where the file system starts in the image. Non-512 byte sectors can be specified using ’@’ (32@2048).
-v Verbose output of debugging statements to stderr
-V Display version
image [images] One (or more if split) disk or partition images whose format is given with ’-i’.


Example

No example given.


History

fsstat first appeared in TASK v1.0.


Author

Brian Carrier <carrier@sleuthkit.org>