TSK_GETTIMES(1)

💖 TSK_GETTIMES 💖

okay bestie, you're looking at TSK_GETTIMES(1), which lives in the General Commands Manual section of the Sleuth Kit fam. no cap, it's the one that hoovers up MAC times from a disk image and spits them into a body file. let's get into it 🫶

---

✨ NAME ✨

tsk_gettimes — Collect MAC times from a disk image into a body file.

---

🌸 SYNOPSIS 🌸

tsk_gettimes [-vV] [ -f fstype ] [ -i imgtype ] [ -b dev_sector_size ] [
-z zone ] [ -s seconds ] image [images]

---

🦋 DESCRIPTION 🦋

so what this icon actually does: tsk_gettimes goes through each of the file systems inside a disk image and hands back all the data about them in the MACtime body format — which is literally the same thing as running fls -m on every single file system. periodt.

and the output? it's giving input to mactime, bestie. feed it in and you get yourself a whole timeline of file activity. the data goes out to STDOUT, so you can redirect it wherever your heart desires. 💅

The arguments are as follows:

• -v — verbose output to stderr. she's chatty, she tells you what's happening 👀
• -V — Print version. the "who even are you" flag 🌈
• -f fstype — Specify the file system type. use -f list to see all the supported file system types, they're all there waiting for you. if you don't give this, autodetection methods are used (she'll figure it out herself, main character energy).
• -i imgtype — The format of the image file, such as raw. use -i list to list the supported types. not given? autodetection methods are used. she got this 💪
• -b dev_sector_size — The size (in bytes) of the device sectors. if not given, autodetection methods are used. again, she's competent, she doesn't need your help.
• -o sector_offset — Sector offset for a volume to recover (recovers only that volume). if not given, will attempt to recover all volumes in image and save them to different folders. so it's a "just this one pls" vs "give me everything" situation 🍓
• -s seconds — The time skew of the original system in seconds. for example, if the original system was 100 seconds slow, this value would be -100. yes the minus sign matters, don't come for me 🙈
• -z zone — The ASCII string of the time zone of the original system. for example, EST or GMT. these strings must be defined by your operating system and may vary — so like, don't just make one up, check your OS first, iykyk.
• image [images] — The disk or partition image to read, whose format is given with -i. Multiple image file names can be given if the image is split into multiple segments. and here's the cute part: if only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in .001), subsequent image segments will be included automatically. she's thoughtful like that ✨

---

🎀 EXAMPLES 🎀

To collect data about image image.dd:

# tsk_gettimes ./image.dd > body.txt

look at that. one line. body file acquired. slay 🔥

---

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org>

Send documentation updates to <doc-updates at sleuthkit dot org>

---

and that's the whole page, babe 💜 this was TSK_GETTIMES(1) from the General Commands Manual — the footer's just the page name again, no date on this one, so no tea to spill there. go forth and build timelines, bestie 🧚⭐