TSK_COMPAREDIR(1)

💖 TSK_COMPAREDIR 💖

okay bestie, welcome to tsk_comparedir from the General Commands Manual section — it's the lil tool that holds your directory up next to your image (or your local device) and goes "these two are giving... the same? or not?" 🦋

✨ NAME ✨

tsk_comparedir — compare the contents of a directory with the contents of an image or local device. literally just a side-by-side vibe check between two sets of files. 👑

🌸 SYNOPSIS 🌸

tsk_comparedir [-vV] [-n start_inum ] [ -f fstype ] [ -i imgtype ] [ -b dev_sector_size ] [ -o sector_offset ] image [images]
comparison_directory

🎀 DESCRIPTION 🎀

so here's the tea: tsk_comparedir compares the contents of image to the contents of comparison_directory. that's it, that's the whole job. 💅

and why would you even want that? two reasons, bestie:

• rootkit detection — you can catch a rootkit by comparing the contents of a local directory against a local raw device. the way rootkits work, they typically don't hide data when it's read directly from the raw device, so the sneaky stuff shows up when you go around the file system instead of through it. iconic behavior, honestly. 🔥
• testing — it's just plain useful when you're testing stuff. no cap.

🫶 the arguments, one by one 🫶

• -o sector_offset — the sector offset of a partition inside the image or device that you wanna compare against. like, "start looking over here please."
• -n start_inum — the starting inum for a directory in the image where the comparison should kick off. your little "begin here" bookmark. 🔖
• -v — verbose output, and it goes to stderr. chatty mode activated. 🗣️
• -V — print the version. short and sweet, no notes.
• -f fstype — specify the file system type. and listen, if you don't know what you're working with, run -f list to get all the supported file system types laid out for you. if you don't give this at all, autodetection methods are used. she'll figure it out herself. ✨
• -i imgtype — the format of the image file, like raw. same deal: use -i list to see every supported type. skip it and autodetection methods are used again. 🌈
• -b dev_sector_size — the size, in bytes, of the device sectors. not given? you already know — autodetection methods are used. 💫
• image [images] — the disk or partition image to read, and its format is the one you gave with -i. you can pass multiple image file names if the image is split into multiple segments. and here's a cute lil trick: if you only give one image file and its name is the first in a sequence (like, say, it ends in .001), the subsequent image segments get pulled in automatically. no manual labor required, we love that for us. 🎀
• comparison_directory — the directory you're comparing everything against. the other half of the duo. 🫶

🔥 EXAMPLES 🔥

to compare the directories in image.dd to those in directory:

# tsk_comparedir ./image.dd ./directory

💜 AUTHOR 💜

Brian Carrier <carrier at sleuthkit dot org>

send documentation updates to <doc-updates at sleuthkit dot org> — yes, actual humans read those, so be nice. 😭

⚠️ bestie reminder: this tool is all about reading from the raw device to catch what's hiding. don't skip the -o sector offset if your partition isn't at the very start, or you'll be comparing vibes instead of data. 💀

and that's the whole page, fr fr 🌸 this was TSK_COMPAREDIR from the Sleuth Kit general commands manual, page 1 of the manual section — go forth, compare dirs, catch rootkits, slay 💅✨