FSSTAT(1)

✨ FSSTAT(1) ✨

okay bestie, welcome to fsstat — it's a little tool from the section 1 of the General Commands Manual, and it's about to tell you everything about your file system's inner life 💅

🌸 NAME 🌸

fsstat — display general details of a file system 🫶

⭐ SYNOPSIS ⭐

fsstat [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
[-tvV] image [images]

💖 DESCRIPTION 💖

So like, fsstat shows you all the deets associated with a file system. and the output? file system specific, periodt. every fs has its own vibe.

at minimum you're getting the range of meta-data values (those are inode numbers) and content units (aka blocks or clusters). and you also get the tea from the Super Block — things like mount times and features. iconic.

for file systems that use groups (FFS and EXT2FS), the layout of each group gets listed out for you. no gatekeeping 💅

and for a FAT file system, the FAT table shows up in a condensed format. quick heads up though:

⚠️ that FAT table data is in sectors and not in clusters. don't get it twisted bestie 😭

🎀 ARGUMENTS 🎀

• -t type — just print the file system type and nothing else. short, sweet, main character energy ✨
• -f fstype — tell it which file system type you're working with. wanna know what's even supported? use -f list and it'll spill the whole list 🍓 if you don't give it one, it'll fall back on autodetection methods.
• -i imgtype — say what kind of image file this is, like raw. use -i list to see all the supported types. and if you skip it? yep, autodetection methods again bestie 🦋
• -o imgoffset — the sector offset where the file system actually starts inside the image. lowkey important if your fs isn't right at the top 👑
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't pass it, the value from the image format gets used (if it exists) or it just assumes 512-bytes 💀
• -v — verbose output of debugging statements to stderr. for when you need to see everything 🙈
• -V — display version. simple. slay.
• image [images] — the disk or partition image to read, whose format you set with -i. you can pass multiple image file names if the image is split into multiple segments 🧩 and here's the cute part: if you only give one image file and its name is the first in a sequence (like, as indicated by ending in .001), the subsequent image segments get included automatically. it just knows 💖

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org>

send documentation updates to <doc-updates at sleuthkit dot org> 🫶

and that's the whole page babes, no cap 🌈 this was FSSTAT(1) from the General Commands Manual — go forth and stat your file systems, you absolute icon 💅✨🎀