ILS(1)

✨ NAME ✨

ils — List inode information 💖

🎀 SYNOPSIS 🎀

ils [-emOpvV] [-f fstype ] [-s seconds ] [-i imgtype ] [-o imgoffset ]
[-b dev_sector_size] image [images] [start-stop]

ils [-aAlLvVzZ] [-f fstype ] [-s seconds ] [-i imgtype ] [-o imgoffset ]
image [images] [start-stop]

💅 DESCRIPTION 💅

okay so bestie, ils opens up the image(s) you name and just… lists inode information for you. That's the whole vibe. And by default? It only lists the inodes of removed files. Like, it's not gonna dump everything at you unless you ask, because it's polite like that. ✨

🌸 Arguments 🌸

• -e — List every single inode in the file system. All of them. The whole roster. 👑
• -f fstype — Specifies the file system type. Wanna know what you're even allowed to put here? Use -f list and it'll list the supported file system types for you. If you don't give it one, autodetection methods are used (it'll figure it out itself, main character energy fr).
• -s seconds — The time skew of the original system, in seconds. Example so you get it: if the original system was 100 seconds slow, this value would be -100. Yes, negative. Math is math. 🧮
• -m — Display the inode details in the format that the mactime program reads. (this replaces the ils2mac script from TCT, so if you were still out here using that, bestie… no you weren't. 💀)
• -O — List only inodes of removed files that are still open or executing. This option is short-hand notation for -aL (see the fine controls section below). (this used to be -o, just so you know). 🙈
• -p — Display orphan inodes (unallocated with no file name). They're out here with no name, no home, just vibes. 🥺
• -r — (default) List only inodes of removed files. This option is short-hand notation for -LZ (see the fine controls section below). Like I said — this is the default, so if you don't say anything, this is what you get. 🎀
• -i imgtype — Identify the type of image file, such as raw. Use -i list to list the supported types. If not given, autodetection methods are used. 🦋
• -o imgoffset — The sector offset where the file system starts in the image. Point it at the right spot, bestie.
• -b dev_sector_size — The size, in bytes, of the underlying device sectors. If you don't give it, the value in the image format is used (if it exists) or 512-bytes is assumed. So it's got a fallback, she's prepared. 💅
• -v — Turn on verbose mode, output to stderr. Chatty mode: activated. 🗣️
• -V — Display Version. Just the version. That's it. 🌟
• image [images] — The disk or partition image to read, whose format is given with -i. Multiple image file names can be given if the image is split into multiple segments. And here's the cute part: if only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in '.001'), subsequent image segments will be included automatically. She found the rest of them herself, no cap. 🫶
• start-stop — Examine the specified inode number or number range. So like, the range, not the whole thing. Targeted. ✨

🧚 Fine controls 🧚

• -a — List only allocated inodes: these belong to files with at least one directory entry in the file system, and to removed files that are still open or executing.
• -A — List only unallocated inodes: these belong to files that no longer exist. Gone. Poof. 💀
• -l — List only inodes with at least one hard link. These belong to files with at least one directory entry in the file system.
• -L — List only inodes without any hard links. These belong to files that no longer exist, and to removed files that are still open or executing.
• -z — List only inodes that were likely to have not been used.
• -Z — List only inodes that were likely to be used. (capital letter, different vibe, iykyk 😌)

🕰️ the output format 🕰️

The output format is in time machine format. ✨ The output begins with a two-line header that describes the data origin, and is followed by a one-line header that lists the names of the data attributes that make up the remainder of the output. So you always know what you're looking at before the data starts. Organized. Iconic. 🎀

• st_ino — The inode number.
• st_alloc — Allocation status: a for allocated inode, f for free inode.
• st_uid — Owner user ID.
• st_gid — Owner group ID.
• st_mtime — UNIX time (seconds) of last file modification.
• st_atime — UNIX time (seconds) of last file access.
• st_ctime — UNIX time (seconds) of last inode status change.
• st_dtime — UNIX time (seconds) of file deletion (LINUX only).
• st_mode — File type and permissions (octal).
• st_nlink — Number of hard links.
• st_size — File size in bytes.
• st_block0,st_block1 — The first two entries in the direct block address list.

🔥 SEE ALSO 🔥

• mactime(1)

📜 LICENSE 📜

This software is distributed under the IBM Public License. Read it, it's important. 💖

🌈 HISTORY 🌈

First appeared in The Coroners Toolkit (TCT) 1.0. A true OG. 👑

👑 AUTHOR(S) 👑

• Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA
• This version is maintained by Brian Carrier (carrier at sleuthkit dot org)
• Send documentation updates to doc-updates at sleuthkit dot org

and that's the whole page, bestie 🫶 this one's from the General Commands Manual, and you'll find it filed under ILS(1). go forth and list those inodes. periodt. 💅✨