Package sleuthkit

• blkcalc(1) — Converts between unallocated disk unit numbers and regular
• blkcat(1) — Display the contents of file system data unit in a disk image.
• blkls(1) — List or output file system data units.
• blkstat(1) — Display details of a file system data unit (i.e. block or sector)
• fcat(1) — Output the contents of a file based on its name.
• ffind(1) — Finds the name of the file or directory using a given inode
• fls(1) — List file and directory names in a disk image.
• fsstat(1) — Display general details of a file system
• hfind(1) — Lookup a hash value in a hash database
• icat(1) — Output the contents of a file based on its inode number.
• ifind(1) — Find the meta-data structure that has allocated a given
• ils(1) — List inode information
• img_cat(1) — Output contents of an image file.
• img_stat(1) — Display details of an image file
• istat(1) — Display details of a meta-data structure (i.e. inode)
• jcat(1) — Show the contents of a block in the file system journal.
• jls(1) — List the contents of a file system journal
• mactime(1) — Create an ASCII time line of file activity
• mmcat(1) — Output the contents of a partition to stdout
• mmls(1) — Display the partition layout of a volume system (partition tables)
• mmstat(1) — Display details about the volume system (partition tables)
• sigfind(1) — Find a binary signature in a file
• sorter(1) — Sort files in an image into categories based on file type
• tsk_comparedir(1)
• tsk_gettimes(1)
• tsk_loaddb(1)
• tsk_recover(1)
• usnjls(1) — List the contents of a NTFS Update Sequence Number journal